Routine Security Governance and Management Activities you should plan…

Security Planning 101

I have been thinking about how organisations manage (or do not manage) their security postures from both a governance and management point of view. To help organisations that are just starting on their security improvement journey I thought I have put together a list of activities they may want to have in a forward schedule document (you could even call it a roadmap). It is not going to be all things to all people and different organisations and markets will have different requirements.

Defense

New Year , New You! Securing Active Directory

By default, a ‘domain user’ can read mostly everything in active directory. I’m not sure every sysadmin knows this as I often find passwords stored in the description filed (see the example screenshot, this was from a domain user with no third-party tools leveraged). Read more “New Year , New You! Securing Active Directory” →

Defense

Things to try & keep an environment safe

I chose these words on purpose, I don’t think keeping environments secure and working is easy. I don’t think anyone has all the answers, even with massive budgets large organisations fail to keep their data and systems secure. But I do know that by doing these activities we can massively change the game when compared to the security posture of an organisation compared to organisations that don’t do this! So, I thought I’d share some of the things I do to try and keep on top of environments cyber heigine. But to start let’s think about the kind of questions are we looking to answer:

Defense

Make Logging Great Again (MLGA)

Ok so i’ve been showing how alot of things do NOT get audited in Windows out of the box (on Twitter obviously) so I thought I’d export the CSV which you can import to enable some of the advanced logging features into a GPO without so many clicks (RSA sucks!)

So here is a CSV file that you can use to import! this isn’t everything you need to do, but it’s a start!

Defense

CVE-2020-27130 – Path Traversal on CISCO Security Manager

CVSS 9.1 – CWE-35

“A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to gain access to sensitive information.

The vulnerability is due to improper validation of directory traversal character sequences within requests to an affected device. An attacker could exploit this vulnerability by sending a crafted request to the affected device. A successful exploit could allow the attacker to download arbitrary files from the affected device.”

On the 16/11/2020 a POC for a range of CISCO device vulnerabilities was released on GitHub by https://twitter.com/frycos.

Defense

Secure Remote Access VPN

If your VPN can be brute forced, I hate to break it to you, but it’s got a bit of a design/implementation problem! Now I’m not going to go into VPN RCE’s (we’ve seen a lot of them in recent times) but let’s look at what we can do to protect our remote access services! Read more “Secure Remote Access VPN” →

Defense

Modern Windows Device Security Assurance

Imagine the scenario… your environment is fully cloud based. there are no domain controllers, you have no “corporate” network and every device is an island. Here we are going to explore what that world might look like from a security pov. This is the modern Windows environment.

Devices are enrolled to Azure AD
Devices are managed by Intune
Office 365 is deployed in cloud only mode

As a security professional on either the offensive of defensive side you have a new landscape to deal with. No longer are you running responder and moving latterly via WMI/RPC, PowerShell or RDP, because well there isn’t a ‘network’ per say. Read more “Modern Windows Device Security Assurance” →

Defense

Things you wish you had done!

Hindsight is great

When you get online/into the virtual office at 0900 on a Monday morning the last thing you want to be greeted with is something like this:

Ransomware and various other major cyber incidents are not fun to deal with, they hard everyone, from the end customer, your staff and ultimately your bottom line. We hate ransomware so we’ve put together a quick list of things to think about to help you prepare not only to prevent but also to respond so that hopefully your security posture holds strong but also if it does falter you can recover in a timely manner without any bitcoin payments being made! Read more “Things you wish you had done!” →

Defense

Lack of HTTPS does not automatically mean that you…

An industry mainly filled with good people but too many sharks

It’s becoming more and more common, I see content posted online, I hear people in meetings (hell I’ve been invited into some ‘opportunities’) and the basic theme seems to be:

Fill your profile with as many buzzwords as possible
Try and make your organisation seems legit and have links to the police and security services
Call out crazy stuff like the lack of HTTPS as “TOTALLY COMPROMISED”
Ignore science
Post sales adverts under Security Services and Police posts to leach ‘authority’
Constantly use statistics to back up their position
Use social swarming (multiple people from the same company will rally around to defend/attack someone who questions the narrative)

Defense

Regular Security Operations Activities – Small Business Edition

Introduction

Barely a day goes by without reading about a new breach, organisations both large and small are under constant thread from cyber criminals and most organisations are either living in ignorant bliss or are one mistake away from being pwn3d. To this end I wanted to publish a list of activities that small businesses can conduct on a regular basis to help improve their security posture. The focus here is on organisations that operate an active directory domain environment but some of the areas can apply to many systems/architectures.