this is susan bradley for cso online recently there was a crowdstrike blog that talked about
how attackers are talking targeting a specific industry in particular agriculture but what
caught my eye was how they ensured they were able to steal the credentials in the firm
this section right here five minutes after gaining access to the host the officer modified the
registry to implement a widely known procedure that enables credentials to be stored in clear
text within memory guess what that setting was our old friend w digest it reminded me that
over a year ago i wrote up an article on how to prevent and stop the use of w digest credential
threat clearly we haven't learned the lessons from even a year ago attackers are using these
old attacks because they still work and they work well there's two two excellent posts out there
on a blog site that have some really good information about how credential dumping works
there's a part one and then it goes on to part two which shows how to mitigate credential stealing
now i'm going to once again urge you to proactively set the w digest setting to zero
to block the ability to store plain text passwords you want to push out the registry
key located at hkey local machine system current control set control security providers w digest
you want to set the value of use logon credential of zero if you do that w digest will not store
credentials in memory now while since server 2008 r2 by default the operating systems don't do this
attackers will go back and set this setting to one in order to enable it so you want to
set this proactively to zero and then if you have the ability to monitor registries
you want to monitor this to make sure no attacker comes in and changes the value another recommended
setting to do is to set lsass in protected mode lsass or local security authority subsystem
service is a processing microsoft windows operating system that is responsible for enforcing
the security policy on the system it writes to the windows security log and verifies users
logging onto a windows computer or server handles password changes and creates access tokens if you
go to the registry key h key local machine system current control set control lsa and then set the
value of the register key to run as ppl but the d word is one you want to reboot your system
it makes sure it protects those credentials if a third-party system is using lsass the
functionality could break if it doesn't adhere to certain mandates you'll want to check to the
see the impact in your firm before you do this firmwide specifically you'll want to
review any third-party authentication platforms or applications to ensure they will not be up
impacted by this setting this next recommended setting setting cache credential settings
may not be able to be done especially in work from home mode it specifically may impact vpn usage
in windows systems the cache credentials for the last domain 10 domain users is stored within the
registry key at hkey local machine security cache if you want to adjust that setting you go to the
policy local security policy local policies security options interactive login and then
you set the number of previous logins to catch now you may wish to set this to zero or low setting
if your on-premise assets don't move around you may not want to do this on laptops so
keep that in mind and test your settings accordingly credential manager is another location
that can hold network passwords again you may want to adjust this so it does not do that proactively
there are quite a few well-known tools out there nurseof being one of them
that has tools that allow you to expose the credentials saved in this this file
this tool easily decrypts and displays the passwords that are stored in credential files
of windows it's an easy download and an easy look to see what's saved on your systems if you
have windows 10 enterprise you're even better you can use windows defender credential guard
now all the previous settings that i recommended can be done with plain old windows 10 pro
credential guard the best protection of all can only be done with windows 10 enterprise
or education so as always check to see your resources check to see what you can put in place
and protect accordingly attackers want to go after your usernames and passwords so make sure
you're doing everything you can to protect those and as always check out the videos on the igt
tech talk youtube channel until next time this is susan bradley for cso online stay safe stay secure