Happy New Year to everyone from CSO online this is Susan Bradley and I'm
gonna talk about how to make yourself a little less low-hanging fruit in year
2020 so what's the idea of low-hanging fruit it's a concept that attackers go
after what's easy and if you make yourself a little bit harder to be
attacked they'll go after somebody else I'm gonna hit some highlights about how
you can make yourself a little bit more safer in the year 2020 first up we're
gonna talk about ways to protect how you get in so that they can't get in number
one you want to protect remote access and management access there's many ways
that you gain access to your network and the attackers know this too so if you
gain access to your network in any of these methodologies ssh telnet FTP
NetBIOS LDAP Kerberos RDP management services over a web port MS sequel
Oracle MySQL or VNC the attackers know that you get in that way too
so first ask yourself is there any way that you can have add two-factor
authentication to these access or stop doing these accesses altogether you may
have to add third party products such as duo
which adds two-factor authentication for RDP you may have to check with your
vendors to see if they can provide more secure ways to access these management
ports remember even Microsoft is realizing that we need to take better
actions there when enforcing LDAP signing in March of 2020 so remember to
review those settings now to determine if you're ready for those upcoming
changes review if you need to reset Kerberos passwords especially if you
suspect credential reuse in your own own organization if you recently have
retired older operating systems such as Server 2008 or suit Server 2008 r2
remember you may wish to reset those passwords for any read/write domain
controllers and read only domain controllers
got some links on some post that you can go to to reset those passwords next up
we have to protect our credentials better right now we choose really bad
passwords and we tend to reuse them a lot so make sure that you check out
those pasts the hash attacks and what you can do to defend from them start
with the low-hanging fruit and stop using land manager and ntlm v1 you may
find that especially that as you retire these older Server 2008 domain
controllers that you can disable and men and ntlm without any problem at all
now comes a little bit harder dealing with the end users review your password
policy rules and educate users to pick better passwords remember that if you
have a password policy that requires people to change passwords often they
don't typically choose better passwords be aware of how often you reuse
passwords in an organization use a password manager program use the Lapps
toolkit the local administrator password solution in your network organization to
set local administrator passwords so they're not the same throughout the
organization too often attackers get in able to harvest a single local
administrator credential on a workstation and off they go throughout
the entire organization because they know that we're we tend to reuse that
same local administrator password throughout our entire network especially
as you get rid of server 2008 and 2008 r2 domain controllers take the time to
review your Active Directory I've got some scripts linked to to scan and check
all accounts in the Active Directory forest for account and password hygiene
you will need to add a couple of PowerShell downloads one is for the lift
net and the other is for DES internals and use those modules to check your
Active Directory lift net is an 80 password protection module you can find
it on github and these internals can be installed by a little script is's
install module D essentials force and some of the
you want to look for in your organization this is on my own domain
and I have some work to do for example you want to look at that column that
says app has LM hash and if it's true like that one there and that one there I
need to make sure those are out of our organization because they are low
hanging fruit and attackers can come in and harvest those hashes and use them I
also want to make sure that I see what's going on with these shared passwords
that's not good you can see the hash values there and again I've got some
cleanup in my network as well so take the time to review your Active Directory
and see what's going on next up know that browsers and email are the new
entry port points tuned to our network attackers know that our users are there
our weakest links they also know that users can be tricked into clicking on
things so browsers and emails are the number one way that entries come into
our network for email look for the use of attack tools such as ruler you can
see in on github that abuses the client-side outlook features and gains
of shell remotely to counter such attacks for on-premise deployments
there's a tool called what else not ruler which you can use to investigate
and review your exchange environment to make sure it hasn't been compromised
for office 365 you can use PowerShell to audit and review if rules or injections
have been set up remember multi-factor authentication is your friend here for
browsers you want to review and set up policies and set up boundaries for what
users can download and install into their browsers you want to use group
policy or in tune and set limitations of what users can install remember chromium
based edge will be coming out to Windows 10 is an update in January of 2020 so
look for that coming soon get ready to control the edge based chrome in your
organization using both group policy and in tune so this is just a start of some
of the low-hanging fruit that I want you to look at your your network and see if
you two need to do some work for 2020 stay tuned as we review more of these
techniques as all don't forget we're here on Tech Talk on
the idg youtube channel for the tech news of the day hope to see you there as
well this is Susan Bradley for CSO online