hello again it's Susan Bradley for CSO online well here we are another weekend
we've survived so far and we're kind of settling into a new normal of
abnormality so it's time to kind of stop reflect in a particular kind of review
some of the settings and some of the things we've done in our networks this
talk today's is inspired by a recent Twitter post from Jake Williams founder
a rendition sec and in his malware Jake Twitter account he reminded me that it's
time to stop a bit reflect review and kind of see what's going on in our
environments and make sure that we've made the right choices he recommended
first and foremost that you use it a scanning tool to review your external
ranges from our DP ports open to the Internet if you find anything open out
there remember if you find it the attackers can too so make sure you
configure it so that network level authentication is mandatory on anything
now preferably you'll have no RDP open to the external ports at all hopefully
you'll tuck it behind our D gateway or you'll put it behind a two-factor
authentication such as duo comm but you do want to do an external scan and make
sure that you're safe if you aren't familiar with external scanning you can
use tools like nessus to do a port scan there's other tools out there you may
look to your outside consultants to assist you but bottom line look to see
what your outside ports look like to attackers because believe me they're
looking to to set up the mandate for network level authentication remember
you need to go into Group Policy go into computer policies windows components
Remote Desktop Services Remote Desktop session host security and then you want
to go into the setting that is require you user authentication for remote
connections using NLA you want to click on enabled and you
make sure you do this on the server that's running the RDS H roll next you
want to take a look at your firewall logs and DNS logs to review what
additional outbound traffic is suddenly going outside your network you want to
make sure that only those are remote authorized tools that you think should
be running our running so if all of a sudden you see go to my PC or log me in
or TeamViewer or something that you didn't authorize going outbound you want
to look make sure that it's not so how can you look at your firewall logs it
all depends on which firewall vendor you have reach out to your firewall vendors
there are training courses out there for generic information on firewall log
viewing but in general your best bet is reach out to your vendors have them give
you guidance and training on how to review those logs if you're not familiar
with it next you want to take a look at an additional configuration rules you've
set up in the last week or so did you suddenly change them to make something
work and maybe there's a better way to do it now perhaps you don't need it
anymore again reach out to your firewall vendors if you may change this into any
organizational units or Active Directory again take the time to go back and
review do you still need to do it did you make file changes again review
the changes you've made in the last couple of weeks and make sure they're
still effective especially because attackers are now trying to come in on
our remote ports it's time to review that maybe not everyone needs access to
the same file sets that they used to maybe you can limit the access so that
attackers can't get in as well you've probably seen in the news this week all
the issues and concerns about zoom and security but before you run to any
conclusions keep in mind that zoom is making actually inroads into the
security they've stopped all feature updates and instead are focusing on
security fixes but if your firm is concerned about it there are
alternatives out there including Microsoft teams that can do the same
ability and now I'm going to talk about something that's a little bit awkward
you might be in the position right now to look to where you want to restrict or
reduce the number of licenses I hope that your firm hasn't been
mandated to to layoff or to shut down completely but unfortunately if you are
in that situation keep in mind that cloud services allow you to limit and
reduce the number of licenses in the easy way even if you shut down a license
data is retained for a number of days so look into that and look into your your
licensing to help you out in this situation keep in mind that Microsoft
has opened up a free six-month trial version of Microsoft 365 II 1 to allow
companies to better work from home if you are a government customer you should
look into the office 365 g1 trial educational customers should use the
free Office 365 hey one license these provide web-based
versions of Office apps and business services last but not least reach out to
your vendors many of them are adding additional services or providing
additional tools in this time for example proof point is offering up free
covered 19 related IDs rules and finally don't forget the resources out at the
IDG Tech Talk Channel this week we have how will the corona virus change how we
do your jobs until next time stay safe stay well stay secure
this is Susan Bradley for see us online