A recent report by Praetorian, a cybersecurity company headquartered in Austin, TX, focused on threats that resulted in data compromise or access to sensitive information. Based on a review of 100 separate internal penetration test engagements the study identified the five most prevalent threats to corporate data. The amazing thing about these weaknesses is that the top four are all based on utilizing stolen credentials and the last one helps an attacker be more effective in using those stolen credentials. In other words, the enemy is right there in the mirror! The study spanned 75 unique organizations and only focused on security weaknesses that were used to obtain a full network compromise.
 |
| Where are your pain points? |
The most prevalent threat is something we’ve all heard of
before – Weak Domain User Passwords. Since most corporate environments use
Microsoft’s Active Directory to manage employee accounts and access, it needs
some improvements in order to fully address complex passwords. Since Active
Directory only requires passwords to be a specific length and contain specific
character sets so addressing this weakness will require the use of third-party
software.
The next most common corporate threat is Broadcast Name Resolution Poisoning. Using this vector, an attacker responds to
broadcast requests (i.e. LLMNR, NetBIOS, MDNS, etc) by providing its own IP. When this is done, the credentials of a user
accessing network resources can be instead transmitted to the attacker’s
system.
The next big no-no is when system administrators all use the
same Local Admin password. If an
attacker is able to compromise the LM/NT hash representation of the password,
then the attacker can use the hash to authenticate and execute commands on
other systems that have the same password.
Using the hash, an attacker doesn’t need the actual password at all!
Microsoft Windows operating systems have another embedded password
weakness. Believe it or not, the
operating system stores domain
credentials in cleartext within memory of the Local Security Authority
Subsystem Service (LSASS) process.
Although this weakness requires an attacker to have Local Admin or
SYSTEM-level access, it ranks high on the threat list.
This last threat enhances all of the other - Insufficient Network Access Controls.
Many organizations don’t restrict network access based on business
requirements. This will enable
unfettered attacker mobility after only a single system on the internal network
has been compromised.
These threat vectors, last updated by Praetorian in June 2016, were evaluated
as part of a complete corporate network compromise kill chain. They also highlight the importance of understanding
the cybersecurity threat. Although the
mirror is a good place to start improving on network security, you must also
work to identify all your organization’s security pain points.
With that knowledge you can more effectively enhance your team’s
defenses and eventually evolve towards a better understanding of your security
threat environment.
If you are serious about protecting your data, download
the full report and read about the effective strategies your company can
use to protect itself. If you are a CISO
or corporate executives, IBM also provides some excellent information on how to
secure the C-suite. They also provide an
interactive tool
that can help better analyze your threats, protect your users and save your
data from these and many other security challenges.
