hmm hey
we all set Oh Oh God
okay well first of all good afternoon
everybody
thanks for coming honestly appreciate
that first time speaking at this
conference but I've heard a lot of
really good things about it so how is
the conference treating y'all so far
sweet okay I will say this I came in
from Florida for the weather and man let
me tell you I'm freezing up here right
now like I'm well insulated and I'm
still freezing pretty good right now so
this is pretty interesting for me but I
did have some practice I just came out
of Pennsylvania and last week I went to
Chicago which was hell so thank you for
at least not being that bad I'm gonna
warn you right now this talk is very
blue in nature I am a blue side guy for
the most part in other words defensive
okay and the reason I came up with this
talk is I've been doing this for a while
now I've been an IT insecurity I'll
throw that up there in a minute but I've
been doing this for a long time now and
what I found is over the years we have
really started moving towards technical
solutions for things and blinky boxes
which I totally understand I love it
I honestly in a place that I used to
work we had this beautiful switch that I
would go in and turn off the lights in
the server room just to watch the lights
blink I kid you not it was absolutely
beautiful to watch that right but we've
been transfixed by that in many cases
were pulled into that and now we're just
used to throwing up more technology the
problem is some of the foundational
things in organizations are not getting
done and part of that is the technology
pieces are out there part of that is
we're seeing a lot of growth in
organizations and so somebody starts off
very small and it's okay to have a small
network flat network but within about 2
or 3 years you're so busy running around
trying to do this other stuff now you've
got a pretty decent-sized network and
it's still dead flat that's one of the
things we'll talk about here that means
everything can talk to everything else
that's a problem and it's getting away
from us but we keep putting technology
in place to try to fix these problems
that found
additionally are still an issue out
there and so that's what I'm covering
today is a lot of the foundational
things that are getting missed in
organizations that I've seen throughout
my career so that being said the
good-looking guy in the screen that's me
so Eric Crone is my name I work with no
before again out of Florida my
background
first of all do we have any CIS ESPYs in
here okay we got a couple there was an
email came out a few years ago said your
annual minimum CPEs are gonna go to 40
per year my name was at the bottom of
that be gentle
oh great so you have a lot of time with
my mouth moving and no sound so
principle of least privilege is very
very similar to the same only it's
taking the rights that people have and
limiting what they can get to so how
many of you and your organization's have
like a shared drive like an S Drive or
something like that right wherever and
dumps files okay lots of people do that
well again not to pick on receptionist
but does your receptionist have access
to write to the accounting drive
possibly do you know what people have
the rights to write to so going back to
ransomware Fran somewhere hits it
usually launches in the context of the
user they launched it if they cannot
write to the file they cannot encrypt
the file that makes a big difference
right there but far too often we add
users we're just like okay cool cool
cool now when I was with the army one of
my projects was to help with role based
access control it's it's basically hell
in a project okay you're trying to
figure out what all these people's roles
are but here's the problem we had there
people would move from department to
department okay and what happens when
this happened this happens in the real
world two people go from one role to
another or one department to another you
add their permissions to that but very
rarely do you know what the hell to take
away and so these people are running
around how many of you have ever had an
account you're like I can still get into
that right oh I have that perpetuates
you loose can track you lose track of it
you lose control over it and now you
have somebody who gets hit by something
or they get fish somebody goes in and
now they have access to their box now
they have those permissions to start
moving around on the network and that's
really really dangerous stuff pretty
much all the tools are already there we
don't have to buy more stuff to put this
stuff in place it's a matter of focusing
on setting it up that way and in all
these things that I'm talking about here
I'm not suggesting you go out and you
start ripping wires out of the switch
and go okay we're gonna segment today or
gonna fix this today all right these are
things that you can start to roll out as
you continue to roll things out in the
future start having a plan for the new
things are going in this area here and
then you start moving things in take
your time and do this I'm not saying
that you want to do it you know by
Wednesday but we've got to have this
thoughts and we've got to be considering
this we have to have more of these talks
with people about dealing with the
fundamentals that's what this is about
right 74 percent of IT decision makers
surveyed whose organizations have been
breached in the past say it involved
privileged access credential abuse
that's brutal what are you doing to
protect those accounts who has access to
them if their key accounts do you have
multi-factor authentication on now MFA
can be bypassed my colleague Roger
Grimes he loves to because I'm a big MFA
junkie and he loves to poke ways at me
he's like I think I have 31 ways to
bypass MFA now and I'm like yeah and a
lot of them are human based right you
get the text message and you know you
have to put that in well they have
attacks where they pretend to be a bank
and they tax they say hey we're beta
testing or we're testing a new security
system we want to make sure this works
they already have your username and
password so what do they do they put it
in and say okay now you should have
gotten a text from the new system please
help us out by telling us what the
number is that we just sent you here we
go hey cool I'm helping out they give me
the number and bam right in through the
MFA that's a human attack but it's
bypassing MFA right but it's better than
nothing so if your organization has
social media accounts have you ever
thought about protecting those what
those can do anyone here remember when
The Associated Press Twitter account got
got breached number of years back and
they turned around and they said oh
there was a explosions in the White
House not sure what's going on with the
president I have a slide for some MFA
talks I do you can see when that tweet
came out and the the stock market price
went ding right at that moment okay in
Tampa the the mayor of Tampa had his
Twitter account hacked in other words
somebody got the credentials and posted
all kinds of just crazy crazy crap
overnight one day now it was so far over
the top that it was everyone's like okay
we see what happened but imagine in your
organization if somebody does that sort
of thing
your reputation is built a lot on those
sorts of things and it can come back and
bite you pretty hard so protect those
accounts to know who has access to those
so you don't just keep adding people to
having access to those of course you
probably just share one account with
with the same female anyways right write
it down put it under the keyboard it's
all good we all do that right what's
that Oh like like Hawaii did right you
all remember that when Hawaii had that
missile scare that happened and then
they come in and they do the the the
news segment on it and the guys sitting
there and the password for the system
was on a post-it note on the monitor
seriously right it doesn't matter if you
have a 42 character password with no
repeating digits and I don't know how
that's possible but I'm sure it is it
doesn't matter if you're gonna put on a
post-it note and stick it on the damn
monitor right these things happen but
again when it comes to this sort of
things protect your accounts protect
what's going on with these sorts of
things and make sure that you know who
has permissions to what it does require
auditing it requires going in and
looking at this like I said I rolled out
role base access for my army
organization was about 300 something
people that were all IT people we all
bounced around all over the place you
wouldn't believe some of the permissions
I turned up in some of this stuff we
need to take some time and do that we
already have the tools we just need to
do the time oh I think you guys kind of
understand my feeling on this one
already okay
I love RDP
I use RDP all the time but I VPN first
RDP is just the problem isn't
necessarily with RDP itself but most of
the implementations of RDP are sloppy
okay sometimes people will move it from
port 3389 to 3390 and they're like yes
no one's ever gonna find that that
doesn't work folks if you think if you
didn't know gathered on the response the
other thing that happens though is you
put something out there that's
internet-facing and a lot of times they
don't do good lockout policies so what
are you doing you just sit there and hey
it's on the Internet
I'll throw some credentials at it every
you know four or five minutes see what
happens just run a script that does that
until he goes hey you're in right if
we're not watching for that if we're not
monitoring heavily on accounts that are
internet facing that's a problem but RDP
is just once you're in that machine
you're in the machine and then the you
know the game is pretty much over at
that point
my recommendation is what I've seen work
better is use a VPN first VPN into
something VPN into a safe Network
probably not directly into the corporate
network I'm just not a fan of that and
use a jump box another an RDP session in
there that you can get to that has your
tools on it I'm a big let's not go
straight to your actual real box from
the internet sort of guy but if you're
gonna do it monitor the hell out of it
make sure you understand what's going on
make sure you have some DLP in place to
watch for data leaving your network
through that you know if your user all
of a sudden starts pulling you know 50
Meg's a second out for sustained periods
of like three days you should probably
be spotting that but a lot of people
aren't looking for that so data gets
actual traded out of some of these airs
but again look for these things make
sure that you're monitoring these if you
have them but the easiest way to do it
is just remove it Sam Sam is a group
that's been doing ransomware they're
fantastic it's just blowing through this
sort of thing they find unsecured RDP
and they're in it and notes
so finally everyone's favorite keep up
with patches we all love patching right
who here has a a primary or a
significant duty that involves patching
show of hands funk you poor bastards man
I'm yeah well the thing about patching
is man it is tough it is absolutely
tough no doubt about it where I see us
trip up on patching sometimes is we
we're patching the wrong things okay and
where this falls into play is I see a
lot of people break-in their necks to
patch a bunch of things that don't have
an active exploit with them yet and in
the meantime they're ignoring other
things that could be a bigger deal now
you want to keep that on the list but a
lot of times people do the wrong things
I also coming out of medical this is a
phenomenon that I saw a lot in medical
is you have a device say an MRI machine
that's fantastic it does great imaging
the doctors are familiar with it they're
used to looking at it they can spot
cancer and a in a in a fly you know I
mean it it's so precise they can see
everything they need and it's running on
Windows Vista okay so what do you do
alright the manufacturer possibly has
been acquired four or five times by now
in the last year because that's how a
medical stuff works they're never gonna
be a patch for this machine so what do
you do you put it in its own little area
and you you ignore it from patching well
all of your other patched stuff is
running around this machine in the
meantime some of these patches don't
require Microsoft bundled things it's
fixing certain things maybe turning off
a certain version of you know of SMB or
something like that right you still need
to keep that on your list of things to
look at so when these vulnerabilities do
roll out you need to understand hey I
need to fix this or maybe maybe you turn
off file-sharing on that thing a little
bit as these come out but a lot of times
people will just patch and think that
they're good but that's not the end of
it right or they spend all over their
effort patching
some new vulnerability that it has a
cool-ass logo sorry has a very cool logo
and and such and that's not their threat
right so they're working on their
windows boxes when they're Linux
machines are over here they were on a
shop that has 99% Linux machines but
they're gonna spend all their time
trying to patch the one Windows box is
that really your threat so patching is
not easy but it is something we have to
do and I will say this we got a pretty
good way of running through this
coordinating with other people in the
army in the beginning when we did
patching we did a lot of this
self-inflicted wound thing so like okay
cool we're gonna patch the domain
controllers tonight and in the meantime
the network team is gonna down a switch
as they do their patching and so halfway
through your patch it loses connections
and ever all hell breaks loose right we
got really good at doing that to
ourselves until we started coordinating
with each other on that and honestly it
actually got pretty easy once we stopped
stepping in our own stuff so you can do
it
think about it though and we got to put
some effort into doing that so in
summary usually a lot of ways to improve
security without adding additional
technology it's always fun to have those
extra things but there's a lot of stuff
that we probably left behind that we
haven't done already some of these
inquire improve documentation
overhauling some processes that is fun
if you guys aren't all excited about the
idea of new policies and processes man
yeah I know it's not easy but working on
a strong security culture will help your
organization adapt to this stuff as well
you know like I said with the patching
working with other people that made a
huge difference so that being said I'm
bad out of time here's my info this is
the Twitter I use most of the time open
for any questions you have always open
to to comment anything else anyone have
any questions okay Oh
Yeah right right it's all numbers yeah
yeah yeah so and I'm not just trying to
plug a colleague of mine I work with a
guy named Roger Grimes and Roger is a
very very smart guy he wrote a book
called data-driven defense and so what
you do is for Christmas you drop that on
your executive on your boss's desk or
whatever with a little bow on it it
actually focuses a lot on where are my
real problems here what do I need to be
focusing on and it lays it out in a way
that is very helpful with that because
when you're patching for compliance just
like anything else you're doing for
compliance it's different than patching
for security and so if you're just going
this many came out this many CVS came
out this many patches came out we need
to get this many out that is not an
effective way of actually working with
your risk and so I highly recommend his
book it's not a very long read but it's
really eye-opening in the simplicity
you'll read it and be like well yeah duh
but he puts it out in such a way that
it's good for leadership to be able to
understand those principles then and be
able to focus on the things that are not
compliance it's called a data-driven
defense so yeah it's it's just a nice
way to look at that so all right
appreciate it thank you everyone
thank you
[Applause]
you