hello everyone this is Susan Bradley for CSO online well here we are another week
we've survived another day and well the bad guys are out to get us and one of
the tools they used to exploit us is to go after the web servers we have in our
organization's recent guidance from the US National Security Agency and the
Australian signals Directorate gives information about techniques that can
detect and prevent web shell malware from affecting web servers I know
everyone's busy right now but I highly suggest that you take the time to review
this document and go through some of the suggestions they make bad guys that go
after web shells target existing applications and files because of that
because they're just like proper files it's often difficult to determine that
an attack has occurred so one of the ways you have to determine if you have
been attacked just look at the files on the system and compare it to known files
and there's several ways you can do it you can look at what's called hash
values your shot to values and you can also do with the wind if utility wind if
is utility that allows you to compare good files to other files if you've ever
wondered how attackers can come up with an exploit so soon after Patch Tuesday
this is one of the tools where they compare what the files used to be with
what they are now and you can use the same techniques to determine if you have
an attack on your system and if bad guys have taken good files from your system
and replace them with malicious ones because remember the bad guys will
probably replace bad files with file names of the same things that are on the
system but the main differences is they're going to be slightly changed in
size and slightly changed in content and so therefore you can compare the two and
say AHA this has changed why is it different
another thing you want to do is enable logging on your web servers and
interesting enough even in the 2019 server era this is not default if you
went through the wizard to set up a web server on 2019 server this is the GUI
version you'll notice that the defaults are 2 log file only and to go to a
location on the system drive you want to make two changes first off you want to
change this to log both file and what's called etw events secondly you want to
determine a place two offs load these log files to a permanent location and
last but starting certainly not least you want to make a decision as to what
local timezone you'll be using for file naming and rollover time in the past
when we were back with all of our information on premise servers we tended
to use the local time whatever the timezone you were in it
made more sense to match up the firewall the server all the information in the
local time now have however with so much of our information in cloud servers and
various data centers more and more people are doing a universal time
therefore every single server in your organization is not set to local time
but to set to a universal time so that you can be able to match up the events
and that all the time logs once you have logging set there's some
scripts out here on github that will allow you to look through and see what
malicious events are occurring there's a PowerShell script that will check your
iis web logs and parse it out you'll also want to make sure that you're
up-to-date on tracking external databases of public exploits web server
platforms are often highly targeted so make sure you keep up to date on
patching for your sharepoint exchange citrix and even any wordpress
deployments that are on windows-based servers in any random free time you
might have with all of your other IT duties take a look at these zero trust
concept zero trust focuses on the following
concepts it focuses on identity providers to track users and we user
related information device directory to maintain a list of devices policy
evaluations and access proxies especially with so many things going to
the cloud these days zero trust it's different way of thinking about
deploying your network to make sure that employees still have access to the
needed resources but it's more reliant on tracking identity than the
traditional security model in the meantime as you transition to this model
make sure that your old-fashioned servers don't have access to write to a
web accessible directory if you're unable to do this then look to implement
file integrity modern monitoring intrusion prevention is also a key to
preventing web shell attacks IPS and web application firewalls add layers of
Defense's sequel injections for example are often one way that attackers use
specific pattern techniques to gain access to the web server and finally if
you haven't done so already check out sis monde and make sure you put it on
your web servers system on logs information about how each process is
created and it helps you identify when you've been attacked you should make
sure you off-board those logs to a SEI m tool and even check out microsoft's
sentinel to do more analysis of the logs in your your network bottom line the bad
guys are out to get us and it's time you took the time to investigate ways to
better protect and defend your systems take the time now to start to ensure you
won't be a victim of cyber events at the same time you're impacting with kovat 19
and finally don't forget to check out aug tech talk with all the videos on
their site take the time each day to reward yourself with a video each day
you deserve it with everything you've been doing for your firm until next time
stay safe stay well stay protected this is Susan Bradley for CSO online