Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1391 Thanks!
OK. I'm very happy to announce to
you the talks security
cannot be bots held to you
by monitors.
She's a regular at Kyle's events since
2007, and she's a security
engineer who's managing a corporate
I.T., so notice the statue use.
Three years ago, I was lucky enough
to start a new job in a company
where when it came to modern I.T.
infrastructure, was a late bloomer
family run company in the business
for over 70 years,
so secure it didn't have a high
volume.
Even only I.T.
only got higher importance in about
2010.
Imagine that.
Luckily, luckily for me again,
there was full management commitment on
security when I started in that company.
Just to give you some numbers about the
company right now, we have around 150
Windows service.
And about 2000 Active Directory
users.
So it's not a small company anymore.
Active Directory is a good keyword
today. In this talk, we will solely
focus on Windows Active Directory
environments.
But some parts could be interesting for
non Active Directory environments as
well.
When it comes to security requirements,
we have to imagine a scale
on one end of the scale.
They are like banks, high
tech industry, electricity suppliers.
But on the other end of the scale,
they are small and medium enterprises
that these shnll enterprises.
Low tech companies or family run
companies.
And today we will focus on the first
third of the scale forward.
Low tech industry companies because
their requirements are way
different from that high to industry
companies.
And as I have worked in such a company
for three years, I want to share my
knowledge I gained industry as we see you
today.
First, we need to define what is the
threat we protect ourselves from.
And in this type of companies, it's
not targeted in targeted
industrial sabotage because to be
honest, we would have no chance
at all, no chance.
What we protect these companies from
is shotgun attacks, mainly
in the form of automated malware.
Can't we just install
a super fancy security solution
or two or three, right, and then
we'll save?
No, unfortunately,
we have limited resources and is
super fancy solutions.
They need both people
and money.
And in these type of companies,
there isn't even one
full time employee responsible
for security.
And also money sometimes is
an issue.
I am a passionate climber
and one man in front of a wall like this.
Sometimes I cannot see a way through.
It seems impossible for me to climb.
And the same goes for taking measures to
improve security.
There is so much information nowadays
that occurs in the blessing
that Reddit blogs conferences.
So you stand in front of you and tee
environment that said well
and you've Brazilian of ideas in your
head.
But you just don't know where to
start.
And today in the song, I want to share
the knowledge. I want to show you a path
through that whole.
So he asked Resections, We want to climb
together today, it's people
organization.
And of course, Tesch take measures.
Let's start with people first.
Why people?
Because behind that, Reno's
Active Directory user accounts
people, the colleagues you work
with are people.
Your customers are people.
I know it's very,
very, very tempting.
Something happened again.
Company got hacked, millions of credit
data records leaked.
That's what you want to do.
Red faced.
The thing is
security people tend to
believe everyone else is stupid,
incompetent, sleazy, lazy,
whatever.
But it doesn't matter if it's because
of missing knowledge, missing
technology or even
laziness, because in
the end you
are responsible for the security in your
company, you're responsible
for your company getting hacked.
And how do you think a sysadmin
will feel if your face Paul him
if you blame him?
William truly working with you
will even come up with your own his own
ideas.
Or will he rather play hide and seek
with you?
So.
Honestly.
Stop complaining,
complaining is not acting
and not acting is not taking
responsibility and not taking
responsibility is failing.
That's all what's to say there.
To add a little practical
example of what I mean, wish that.
Imagine you wanted to introduce lapse
in your company.
Oh, probably some of you already.
If local area press would solution
where there's for each
client, a different password
and it's resets, it's automatically.
So imagine you would
have one
password for all your clients
and you can be the up and dear.
It's maybe not that good.
So you tried, you could use a go to your
sysadmins and you were in command
with lops needs to be installed.
Or maybe
you could talk to them, listen to
them, and they
probably understand the necessary to
behind it.
If you explain to them because it's just
sometimes just music knowledge.
But the issue to her is
you cannot copy the password
from the lab school to a password
request in windows.
So when your desktop is enabled,
you can. So it's it's blank.
You can't do this, but once you
disable secure desktop, that's possible.
Unfortunately, that's not the password
dialog, but just imagine
one.
And the question is now
will disable secure desktop.
We lose the security to future.
Or would you keep it if we if
we secured? If you disable secure
desktop, we then
could introduce labs, have the full
support of all the takeit.
What would you choose?
When it comes to people and working
together with people,
we need to visualize what we want
with them.
Do you want to work in the 1950
Henry Ford assembly line where you just
do one task the whole
time?
Or would you prefer to work in a modern
Japanese assembly line where you work
together with your colleagues,
where you can bring up your own ideas?
In next Pod, we're going to talk
about how to introduce this Japanese
assembly line in our security
organization.
When we think about our security
organization, there's two
requirements we need to fulfill.
Number one, see the award process
like an assembly line and number
two, have goals and have an end
in mind.
See, and that's the thing.
Security never has an end run.
It's a continuous process.
It goes on forever,
but it's not a concept you can sell.
People work like this.
We want just want
to complete the task.
We want to go home, be happy that
we achieved something today.
So our job is to
create these achievement moments.
How do we do that?
He has three suggestions
make the current. That is risible.
This means create
statistics meaningful statistics.
He's an example.
Total vulnerabilities in the Windows
server environment.
You can see how this goes down.
Make a common goal like it always must
be. Below 500.
Whatever number
to create brick programs
make the goals visible.
For example, we wanted to improve in
in windows and environment security.
So we draw this fancy
little bricks. There was goals behind
that, things we wanted to discuss.
And once it's done in most colors, print
that all you can put it somewhere
in the office.
It's made visible
number three at one point.
You probably already have a lot of ideas
at best, not only yours,
but also from your colleagues or your
boss.
And you need to prioritize them
because you can never do all of them.
But before you prioritize them,
you need to collect them and group them.
What we use there is it's called Redmon.
It's actually from software development.
So we will have several ideas collected
and we would also read them.
You considered on the right side like a
feasibility and effectiveness.
Unfortunately, this is not a talk about
risk management, so it just added
the link on how we do that at the end
of the slides.
So for this, for this part,
prioritization is the key.
And it all comes up in
three steps like these are
going building up on each other, it's
past, present and future.
In the past, you see what you did in
the current status.
The BRIC problems defined
what you do now. Your goals and
the idea repository de is a future.
What do you want to do?
What's climbed our last section together?
When I talk about Tesh
and Venus active director environment
and a tech that's used very often
is either the hash or best
a ticket, its meaning you don't try
to steal a password, you try to steal
a password and hash
or a Cabarrus ticket from there, the
authentication process.
So the first core principle
to defend against this is the three
tier model that's also published
and very well documented by Microsoft.
So what did you use?
Split your assets in three different
levels.
Sometimes more.
And typically, these levels would be to
assure your domain controllers to your
one, your servers and your three.
I mean, clients or clients.
And on each level, you have
a user.
So you don't only have one user, you
have two or three or four or five users.
And the next step is you restrict
access. So this is the technical
implementation of the need to know
principle.
It's so often in security management,
so to have zero admin cannot log
in in a Tier one or Tier two device.
Because this core principle is, of
course, not the only thing we can do.
I prepared some quick wins I
believe are easy to implement and do
not cost anything.
This three, my three favorite
ones when it comes to rituals, youth
delegation, their account operators,
it's a group, an active directory
where you can
add and remove group or membership.
And because permissions are often
steered given by Active
Directory groups, that's a sensible group
and you could use delegation based on
this PowerShell. There's a good bye.
This partial is better.
So let's say that from a specific
country, a branch of this government can
just work on specific
rules to add or remove membership.
Partial constraints language mode like
Porsche is often used in attacks.
What you can do is with
a chip you that
the partial Canada you exit all comment
and execute all comments.
But of course, this is only
a small security improvement because
that can be reversed but against
mobile wear.
That's a very good start.
And the third one, it has the biggest
spa reduce membership
in high value groups.
That's a task that has no and no goal.
Administrators, enterprise
administrators, cima administrators,
system administrators, checklist groups
all the time,
there are four more.
I just want to quickly note not talking
about them because 20 minutes is not
enough.
Maybe passwords in group policy
preferences is something just quickly.
There is group policy preferences.
Sometimes a clear text passwords was a
script. You can just check that
regularly.
Of course, password manager and
impossible policy is nothing new,
but it's easy and it's free.
There are also so-called trackable quick
wins because many
companies don't have security
seem like because they're expensive, but
you can build up your own security
monitoring, monitoring,
and there are five trackable quick
wins that I believe are nice.
What we do is like we have scheduled
tasks and these execute a partial script.
For example, we check if the
assails certificates are running out.
We check if previously managed
to hide privilege groups.
Users are added if a domain admin logs
in because I believe nobody needs
to be domain admin,
so I want to know
when somebody uses this domain.
I also gave up my domain at home before
Christmas.
There are sometimes passwords in Active
Directory description fields
because that's convenient, right?
And of course, if a new admin is added
to a local client or service because we
don't want that.
If you have a little bit more time
for them, reduce travel
and flash. Of course, no client and no
server needs flash anymore.
It's actually going to die in 2020.
Java should just be installed on request,
of course, the SMB
versions and encryption, as well as the
database connection, you just have to
check them all the time.
What's going on?
And we are in passwords, passwords,
hashes.
That's why I'm close to my house could
answer that one for
four counts.
There's five different or six different
appeals where I can limit what
can be done or how that account can be
used.
So for uses, I believe
only log on locally should be allowed
like dipping or running.
A scheduled task or service
is unnecessary for admins,
I could imagine.
I think through ADP should
be as well as loud and for service
accounts.
These are used as service accounts,
so this should just be allowed
to run services or pet shop,
which is a scheduled task.
Of course, every service account is
differenza. You need to
define it for each account.
The three last one's the most
important one we already talked about
Lops.
The GMC is a managed service account.
We want to get rid of this normal
service accounts.
Does one password for the account never
changed? It's never expire, and everybody
knows it's sometimes these service
accounts are even domain uplands.
So what you can do is use this group
managed service account, where the
password is managed by
the Active Directory and nobody knows it
anymore and also gets changed regularly.
Or if you can't do that,
reduce permissions,
duties, log on restrictions, log on
times. So we have about
10 percent of group managed service
accounts and we are kind of the
class copied
and can't really find ModeSwitch.
What's the most important
measure after that core principle
to actually should look like this?
Because if you use smart cards,
so many attacks don't work anymore,
especially for admins.
And thing is, that's the only measure
almost leads, which is not for free,
but a modern.
A modern and smart card costs about $40.
So even if you have 20, 30, 50 people
in added, it's very, very affordable
and with winners, it's a chance
to roll out. You just install it
and it's just usable.
At the end of the day and the end of the
talk, we always need to ask
ourselves, did we do
the right thing
and how do we know if we did the right
thing?
Let's go full circle again and
listen to the people
for me if we did the right
thing.
I know when somebody
puts himself on the security train
and as one of my colleagues who wrote
that email where he said,
I just remove the last Windows XP
machine.
And I didn't tell him to do that.
He was just really, really proud.
And he sent out his email and I have 10,
15 printed emails like this on my
on my desk, in the office.
A second one, which I really, really
enjoyed. But another colleague, I told
you, we have this monitoring
where you get alarmed, when there's a new
admin, new local admin.
So that guy from the DOD and contact the
guy who's responsible in the country
and said, Why
are you still looking at me?
Please explain it to me.
We don't accept local governments.
And I just I just love
what language you use for this.
And you know, we we just created
this monitoring, and it's so nice
to see how people actually use
it and then in a day to day use.
So talk is over.
Just to sum it up.
What's the three ideas we have
when we talk about people?
We should stop complaining
and start listening.
When we talk about organization,
we're seeing it make it visible
and we talk about hash
keys. The very same issue.
Thank you.
Thank you, Moses, for your talk.
So unfortunately, we don't have time
for questions for this talk.
So as
always.