this is susan bradley for cso online we often set up technology to be accessible both internally and
externally to our firms especially now with the pandemic we want to make sure that people can
access technology when they want it and where they want it but often there's security vulnerabilities
that get disclosed that point out that it may not be so wise to expose everything to the internet
i've personally known businesses and educational institutions that in the past would set up their
entire infrastructure with all computers and devices with public ip addresses often attackers
use a blend of attacks including phishing lures to entice a user to enter a network and then the
attackers can go after the entire network as a result recently two microsoft security patches
released in october showcased how attackers can use attacks to go after an entire network
just how you set up the network infrastructure itself the first security patch we're going to
talk about is the bad neighbor ping of death the underlying issue is caused by the improper
handling of router advertisement messages which are part of the network discovery protocol this
attack can be triggered without authentication by remote attacker however it's not trivial to use it
in these attacks now the good news is this bug can only be exploited when the source addresses and
link local ipv6 that means it has to be internal to the to the network most of us these days do
not assign public ip addresses to our devices we now put them behind firewalls and other devices to
help protect them on the sans ise website they recommend that you do not disable ipv6 entirely
unless you want to break windows for example for many years people would often recommend to
disable ipv6 and that's not something you want to do willy-nilly especially when when you have
exchange deployed there's a very specific way you need to disable ipv6 first off you have to know
what specific interface you need to disable so you need to type in at a command prompt route print
and that lists the interfaces for example in my example here i'm going to disable a specific ipv6
item in interface number seven because that's my ip address or my network card that has the
ethernet connected to it the item you want to specifically disable is the rd dns so you want
to put in the command net sh int ipv6 set and this is where the interface comes in and you want to
identify the specific interface and then you want to disable it it gives a very quick and easy okay
now obviously once you patch you want to re-enable that setting so you want to go back and undo that
and that's just as easily done by putting disabled or i should say enable versus the disable command
the risk of this attack is not necessarily a direct remote attack from perimeter
but rather a blended attack starting with a fishing lure so they've got to
get inside the network first and then they'll go after you
the second security patch released in october that's just as serious to an enterprise if
not more so is the one impacting sharepoint cve 2020 16952 impact sharepoint 2013 2016 and 2019.
this vulnerability occurs when an attacker or user uploads a specially crafted sharepoint
application package to an effective version of sharepoint the software fails
to check the source markup of the application package and remote code execution can occur
if the user has a specific permission add and customize
pages permission it's possible that even unauthenticated users can be
triggering this remote code execution so you'll want to check to see how you've set up your share
sharepoint and specifically how you've set it up for guest users in your organization
both of these vulnerabilities point out the risks of exposure based on how your network is set up
while the immediate remedy in both of these examples to ensure you apply the patches
it's also time to step back for a moment and review and access how your configuration and
your networks are especially now with the pandemic if you're like many of us you've probably quickly
opened things up change permissions done different things to get it so that people can work from home
now it's time to call go back a little bit and say hey
is everything set up as good as it can be to make sure we are not attacked
anytime you set up a computer a server cloud service or any resource with the ability to be
logged in from the internet you need to evaluate the extra precautions and resources you might need
in order to protect that access too often we set up group policy rules to set up firewall rules
to allow access and don't make them specific to a certain network or grouping
the nist organization has several documents and white papers on this very topic talking about
network segmentation it's been a foundational best practice for many years for both on-premise
machines and now as we're moving more and more to the cloud you should have the same things in mind
whether you're protecting physical machines or servers virtual machines or even cloud resources
review how you've set up your resources and who and what has access to them
always set up devices that are on the same subnet to only those that are required or
authorized to do so when you set up dmz configure logging and monitoring to the appropriate levels
make sure you record the header and the payload information going through that network border
as well as sending the information to a logging system you should establish an inventory of
technology assets that connect to your network including obtaining a listing of devices
and iep addresses ideally it should include any and all systems on the network at one time we
would only have traditional computer systems printers things like that nowadays the listing
of devices that have ip addresses connecting to your network can also include internet of thing
devices printers telephones or and with working from home being the new norm it can even include
home devices that have been inadvertently added to your network so not only look at the impact of
patching on your own network look to see how you can better protect your network and your perimeter
if you looked at the risk of the october updates and and immediately patched because you had a risk
maybe it's time to resegment your network redesign it reconfigure it see if there's better ways to
protect that access this is not the first nor will it be the last time that a remote code execution
vulnerability will be found on sharepoint service review how you have them deployed and see if you
can better protect them as always take the time to take a look at the topics out on igd tech talk
for the news of the day until next time this is susan bradley for cso online