Goltsev Yuriy - Ломать - не строить!

DEFCON Moscow 8

Transcript

1. Ломать - не строить! Юрий Гольцев @ygoltsev
2. Intro
3. Invest in your knowledge of practical information security
4. Please, don’t order a penetration test until…
5. My own TOP of security issues, related to internal networks: 1. Weak password policy 2. Default accounts 3. Local accounts/unnecessary privileges 4. Windows architecture 5. WPAD configuration mismatch 6. Antivirus software configuration mismatch 7. No network segmentation 8. No patch management
6. Weak password policy Description Easy to bruteforce Common Targets Directory Service (Active Directory/Lotus Domino/LDAP/Novell/etc) Recommendations Implement strong password policy, just follow next rules: - 8 chars (at least) -Lower, upper case -Alpha-Numeric Check for common passwords once a day (at least) - Special chars - Change every 60 days
7. Default accounts Description Easy to bruteforce Common Targets DBs, network devices (routers/printers/etc) Recommendations -Disable all unused accounts -Set strong password
8. Local accounts/unnecessary privileges Description Local administrator accounts/privileges – is bad Common Targets Windows hosts Recommendations -Disable accounts of local administrators on Windows hosts -Do not use GP to manage accounts of local administrators on Windows hosts
9. Windows architecture Description You can’t prevent it, if you use it Common Targets Windows hosts Recommendations -Follow principle of minimal privileges -Use privileged accounts for administration tasks only -Implement two factor authentication for privileged accounts -Implement patch management
10. WPAD configuration mismatch Description Very useful for corporate users if implemented, and for attacker – if not Common Targets Windows hosts Recommendations Disable WPAD (Web Proxy Auto Discovery) feature if it is not implemented
11. Antivirus software configuration mismatch Description Antivirus software can be disable with local admin privileges Common Targets Windows hosts Recommendations Configure self defense feature of antivirus software
12. No network segmentation Description No restrictions and no data filtration on network level Common Targets Network topology Recommendations Implement data filtration – it is better to use white lists for access
13. No patch management Description MS08-067 still can be found during penetration test Common Targets Windows/Unix hosts Recommendations Implement patch management
14. Outro