this is susan bradley for cso online best practices i actually don't like the phrase best
practices too often in security we want to abide by best practices but who decides what's best
and if something is best for one firm is it best for your firm so too often we don't take
the time to analyze what we're protecting to ensure that we're protecting it as well as we
can so i'm going to go over some things that i'm going to call minimum practices number one
two-factor multi-authentication in my personal opinion two two-factor or multi-factor is now the
must-have protection that every firm needs to have and you need to determine how best to deploy it
now you'll hear from many that say for best practices you shouldn't use text messages
of their phone based authentication techniques that could be potentially be cracked or hacked but
i'd argue the goal here especially in the short term is not perfection but rather to be secure
enough so the attacker passes you by and goes on to the next victim so you just want to be good
enough with the goal to keep over time increasing increasing increasing so again have some sort of
two-factor multi-center factor authentication next you want to prioritize patching
too many times we patch workstations and we wait and patch servers and especially these days we've
seen with the exchange server attacks that that wasn't the smartest thing to do so you want to
identify which one of those public facing applications are you most at risk when you get to
the second tuesday every of the month you want to look around at the patches that are being released
from all of your vendors and say okay which one of these impact a public-facing thing whether it's a
application a server even a device a network hardware think in terms of vpn devices
again think in terms of how they can get inside your environment and prioritize the patches
for those those vulnerabilities that they're going to come after first
and sometimes you have to know your environment better than what we do now
take the time to go through the att attack navigator view to see how they can possibly get
inside your organization and again think in terms of how the attackers are targeting these days
and how they're coming in and what you can do to change things and protect yourself better
you want to look at office macros and scripting controls i've said this before not everyone in
your organization needs to have office macros enabled so identify those people in your
environment that need it and those people that don't and disable macros where needed next you
want to review your options for controlling powershell and other scripting techniques
at least have powershell 5.1 deployed and consider upgrading to the recently released powershell 7
or 7.1 passwords and i'm not talking just about passwords that gain access to your environment
you need to think about where you're storing passwords for applications
too often we've seen passwords stored in github repositories so you want to make sure
that when you have developers developing custom deployments for you if they build
in passwords into that deployment make sure doing it in a proper way hashes salted not storing them
make sure that they're trained to handle those passwords appropriate they should not be stored in
plain text and they should certainly shouldn't be put in a public repository microsoft has already
put in something called secret scanning that scans through the public repositories
for passwords to make sure that that's not put up there don't overlook the tried and true firewall
many times we don't put in proper ingress and egress rules take the time to review
to understand what's coming in and out of your environment and put in the appropriate rules
next you want to make sure you have logging and if you have not deployed sysmon in your environment
and you're not storing those logs either in splunk or in microsoft sentinel you want to make sure
you take the time to pull those log files off and store them you will need them someday so make sure
that you understand sysmon and deploy it so there you have it my not best but minimum practices
how many are you doing now how can you strive to be better we all need to do better as the
attackers are getting much better than we are as always make sure you subscribe to the idg
tech talk youtube channel until next time this is susan bradley for cso
online
you