this is susan bradley for cso online today we're going to talk about ransomware it's once again
in the news attackers are reportedly targeting care providers and are using phishing targets
to gain access to your network they're using phishing emails disguised as meeting invites or
invoices that contain links to google documents which then lead to pdfs these pdfs contain links
to signed executable files that have names with distinctive words like preview and test
once the ransomware enters the system the attackers go after low-hanging fruit
that we've left behind on our networks to be able to move through our networks and do more damage
so let's discuss a few of these low hanging fruit items and how you can check for them
to ensure that you're not making it easier for ransomware attackers to enter in your
system did you ever store passwords in group policy preferences back in 2014 ms ms-14025
patched a group policy preference vulnerability and removed the ability to store passwords and
securely but it didn't remove the passwords if you'd previously stored them in there
so think back if you were ever or actually in most cases a previous administrator ever stored
passwords inside group policy preferences the attacker may be able to
use a quick little powershell command and gather those information from your network there's a
tool called powersploit and it has a powershell command called get gpp password ps1 run this in
your network and it will expose those saved group policy preference passwords left behind think of
how else you say passwords for use in networks do you save them in an insecure manner do you have
them left behind in remote access tools things that can be easily obtained by attackers think
of the places that you store this information and think if you're protecting it as well as
you can another low-hanging fruit that often exposes us to attacks remote desktop protocol
i still see constant reports on various locations that brute force and credential harvesting is used
to break into remote desktop protocol that is open to the web too often it's easy to set up servers
even virtual machines even on azure that has open rdp so make sure you tuck it behind remote desktop
gateway or better yet two-factor authentication there's lots of tools out there one of them that i
personally use is duo.com as this uc berkeley tip use strong passwords use two-factor authentication
make sure you update your software restrict access using firewalls you can limit the ability
to remote in to specific ip addresses ensure that you're using network label authentication
and limit users who can log in remote via remote desktop set an account logout policy don't allow
remote desktop for servers or workstations for off campus make sure you check yourself behind
vpn or some other solution again do the basics the attackers know the low hanging fruit and
will go after you do you or your end users reuse passwords often websites suffer data breaches
and passwords are harvested attackers gain access to these harvested passwords in various
data dump locations they then use it against resources so for example someone will have a
intrusion passwords will be obtained and then they'll use them against your microsoft 365 access
the other day someone had a very good phrase that i borrowed and i'm going to keep
and i would recommend that you think about it too he said attackers don't break in these days
they log in think about that they don't have to crack the passwords anymore
they already have the password so ensuring that you've enabled multi-factor authentication in
your organization is key as well as picking a long strong password
so use a password manager program and encourage people in your organization to use it as well
microsoft warned the other day that attackers are now using the net logon vulnerability
called zero login they recently indicated that attackers are now attempting to exploit this
cso online actually has resources that you can read to how to best protect yourself and what
to do about this so keep in mind attackers know that we're still in the process of
patching for this you need to have the patch on your domain controllers and if you don't it leaves
yourself exposed that they can wiggle in and use that for more lateral movement another easy way of
lateral movement is have the smb v1 still enabled in your organization smbv1 is a 30 year old
protocol and you should move away from using it there are various ways to disable and remove smb
v1 from your network including group policy powershell and register keys again take the time
to look to see if you're making it easier for your attackers to have these old protocols in place
next make sure that you have an email hygiene in front of your email coming in attackers using
email as an easy way to get insider organization phishing emails come in all the time and if
you have an email hygiene program or office 365 microsoft 365 advanced threat protection make sure
you have it set up as good as you can make sure that it's scanning for links reviewing the content
and ensuring that your system is set up as secure can be there's a tool called orca that can check
the office 365 advanced threat protection settings as well as using the secure score inside microsoft
365. last but not least make sure you patch your humans i often see malicious emails enter into
my inbox even with all the settings properly set people and attackers know how to get in
even with all the fishing and hygiene equipment we have they still wiggle in recently troy hunt
wrote a really good blog post about how fonts we use in browsers often make it difficult
to determine what a good website is and what a bad website but he pointed out that really worrying
about fonts and browsers was not the right thing to think about what we really need to have instead
was a good password manager program that would automatically determine what is a valid website
and offer up to fill in the password only to those sites that match the database also make sure that
you have a good browser and it's set to proper security ensure that you give your network and
your users of finding chats by enabling tools and settings that you probably already have
or already should have as a baseline security posture take the time to understand what you
have already in your environment set it up properly and secure yourself remember to
make sure that your low hanging fruit is not exposing you remote desktop protocol virtual
desktop endpoints older unsupported platforms citrix pulse vpn misconfigured web servers
sharepoint servers exchange servers zoho manage engine systems look for those entry points and
make sure you've done the basics of ensuring that your patch for those items and as always stop by
the idg tech talk youtube channel for the latest in tech every day there's a new
video up until next time this is susan bradley for cosi cso online stay safe stay secure you