3 ms·

This really isn't all that hard, technically. (I've been in infosec for about 20 years now) 1. MFA all the things 2. don't disable windows updates 3. don't g

by px43 5y ago

This really isn't all that hard, technically. (I've been in infosec for about 20 years now) 1. MFA all the things 2. don't disable windows updates 3. don't give Domain Admin rights to half the company 4. don't use shitty software For some reason, companies refuse to do these simple steps, and then they get hacked. It's not a technical problem, it's a political problem. Sysadmins naturally want to run their networks in the least secure way possible, and in shitty orgs, there's no one there to stop them. Over and over again, it's the same thing, and it's hard to have sympathy when standard security posture seems to be getting more and more lax as time goes on.

belter 5y ago
You do realize the implication given by step 2 and point 4 are a contradiction in itself :-) ? Most large corporate ransomware attacks spread by hosting into the Active Directory Domain server. It will slowly spread to each corporate machine as the users log in. It seems this was the way Software AG, the second largest German software company, was hit by Clop. As they did not pay the ransom their private emails are available on the internet, scans of their CEO passport etc... https://www.cpomagazine.com/cyber-security/clop-ransomware-attack-hits-german-software-giant-software-ag-confidential-documents-stolen-23-million-ransom-demanded/ https://www.cpomagazine.com/cyber-security/clop-ransomware-a... Maybe ransomware gangs will finally prompt the industry to fix security practices...Also, maybe the technical stack that most companies hit by these ransomware attacks use, should be mentioned every time we see these news ;-)
- px43 5y ago
  > You do realize the implication given by step 2 and point 4 are a contradiction in itself :-) ? Absolutely. Microsoft is a mess. I could go on for hours about how Windows networks are fundamentally insecure, and cannot be fixed without a massive psychological shift. Sysadmins love it though for some reason, probabally because it gives them way more power than they should ever need over their users. I love hearing war stories from people who worked offense at places like Google, with almost zero AD footprint. Even the most basic attacks take SOOO much more effort. I would love it if a ChromeOS centric Zero Trust model actually became a thing, but it's not going to happen naturally. Maybe if we let all these ransomwared companies fail spectacularly, and refuse to bail them out, then the only companies that will be left will be those who care. Unfortunately telling people not to use Windows rarely goes over well. To that main point, as bad as Microsoft is, there are so many companies that are so much worse. This Kaseya thing is essentially a rootkit with shitty authentication. Installing this thing on endpoints is a fundamentally flawed concept, yet here we are.
  - pjc50 5y ago
    What does Google do instead for SSO and machine administration?
    - px43 5y ago
      I don't know all the details, but for SSO think about how you log into GMail. They enforce U2F and I'm pretty sure special certs get deployed to client machines. As for machine administration, it's ChromeOS, what needs administration? Just keep logs of auth and app usage on the server side and you have all the logs you ever need to track down bad behavior. Nothing can be installed on a majority of client systems, and nothing needs to be installed, as it should be.
      - deleted 5y ago
        [deleted]

by px43 5y ago

belter 5y ago

You do realize the implication given by step 2 and point 4 are a contradiction in itself :-) ? Most large corporate ransomware attacks spread by hosting into the Active Directory Domain server. It will slowly spread to each corporate machine as the users log in. It seems this was the way Software AG, the second largest German software company, was hit by Clop. As they did not pay the ransom their private emails are available on the internet, scans of their CEO passport etc... https://www.cpomagazine.com/cyber-security/clop-ransomware-attack-hits-german-software-giant-software-ag-confidential-documents-stolen-23-million-ransom-demanded/ https://www.cpomagazine.com/cyber-security/clop-ransomware-a... Maybe ransomware gangs will finally prompt the industry to fix security practices...Also, maybe the technical stack that most companies hit by these ransomware attacks use, should be mentioned every time we see these news ;-)

px43 5y ago
> You do realize the implication given by step 2 and point 4 are a contradiction in itself :-) ? Absolutely. Microsoft is a mess. I could go on for hours about how Windows networks are fundamentally insecure, and cannot be fixed without a massive psychological shift. Sysadmins love it though for some reason, probabally because it gives them way more power than they should ever need over their users. I love hearing war stories from people who worked offense at places like Google, with almost zero AD footprint. Even the most basic attacks take SOOO much more effort. I would love it if a ChromeOS centric Zero Trust model actually became a thing, but it's not going to happen naturally. Maybe if we let all these ransomwared companies fail spectacularly, and refuse to bail them out, then the only companies that will be left will be those who care. Unfortunately telling people not to use Windows rarely goes over well. To that main point, as bad as Microsoft is, there are so many companies that are so much worse. This Kaseya thing is essentially a rootkit with shitty authentication. Installing this thing on endpoints is a fundamentally flawed concept, yet here we are.
- pjc50 5y ago
  What does Google do instead for SSO and machine administration?
  - px43 5y ago
    I don't know all the details, but for SSO think about how you log into GMail. They enforce U2F and I'm pretty sure special certs get deployed to client machines. As for machine administration, it's ChromeOS, what needs administration? Just keep logs of auth and app usage on the server side and you have all the logs you ever need to track down bad behavior. Nothing can be installed on a majority of client systems, and nothing needs to be installed, as it should be.
    - deleted 5y ago
      [deleted]