Hello again this is Susan Bradley for CSO online today I'm going to talk about
some techniques that aren't new they've been around for a long time they're
probably not sexy or anything that you go gee Wow
they're tried-and-true things especially for domain based networks but clearly
we're still not doing them too well because we still have ulnar abilities
and and exploits in the news don't we as many of you know the FTC settled with
Equifax over there security breach and there was an interesting blog post that
came out that talked about some of the basics that they fail to do that's
actually quite surprising again they're not sexy techniques patcher software
segments your network monitor for intruders but when you don't get the
basics that's where we're having the big issues and I'd add one more making sure
you have a good backup especially when it comes to ransomware so here we go
again with another second session of how to not be low-hanging fruit so here's
some lessons learns from Equifax make sure that employees follow up on
patching processes make sure that you check to see if a patch is needed
make sure your automated scanners are actually doing what they're supposed to
do make sure you segment your network to limit how much sensitive data an
attacker can steal make sure you store admin credentials and passwords in
proper locations don't do them in plain text files make sure your update
security certificates and make sure you detect intrusions on even legacy systems
as we start 2020s take a step back and look at your network see if there's
places where you're putting data that shouldn't be there
look at the kinds of data you have on your network there's typically four
levels public data that anyone can have access to internal data data that should
not have public disclosure sensitive internal data
and the highest of all highly sensitive corporate employing customer data and
depending on where those are located you may need to redo how your network is
segmented the Center for Internet Security goes on and indicates that one
should segment the network based on leppe labels or classification levels of
the information stored in the servers locate all sensitive information on
separated VLANs with firewall filtering to ensure only those authorized
individuals are only able to communicate with systems necessary to fulfill their
specific responsibilities how many of you are ready to do that on old
fashioned workstations and servers that are in your corporate network look to
see how well you're using the plain old Windows Firewall again this is not new
you don't have to go out and buy anything new it's the plain old Windows
Firewall that you already have in your systems but are you using it as best as
you can on the sample Windows workstation go ahead and open up the
Windows Firewall and you can look at all of the different applications that have
built rules in your firewall it kind of gets a little scary sometimes especially
if you have to stop and go what application actually built that rule
something as simple as blocking RCP port TCP port 135 an SMB port TCP port 445
can help a great deal to stop the lateral movement of attackers inside
your network now you may not be able to block especially the SMB ports you may
have to test and see if you can do this but see if you can especially inside
sensitive transmission of data RDP is being used quite a bit in attacks inside
of networks on what you might want to do is see if you can do limits on a remote
desktop so go into the properties and enable what's called IPSec allow the
connection if it's secure and you can customize this and make the setting and
then go into remote users or remote computers and see if you can set that
for specific users so instead of opening it up to everybody put specific users
inside the domain that have access to that system again you may not be
to do that everywhere but again segment your network think about how attackers
come in and how they can use the different ports to come in limit access
as best as you can and use the Windows Firewall that you already have in your
system to build more rules obviously document this as well but please if
you're in the year 2020 and you're still disabling the Windows Firewall I hope
you're not doing that I hope you're taking the time to look to see what
applications have built ports and firewalls and see if you can lock them
down better and as we start 2020 don't forget to sign up for Tech Talk from ID
G with lots of tips on Windows and Linux and all sorts of news the tech of the
day again this is Susan Bradley for see us online thank you again