1. Fixing Bad IT Security: Stupid Mistakes and Dangerous Conveniences
11/28/ :52 AM
THR1033
Fixing Bad IT Security: Stupid Mistakes and Dangerous Conveniences
Philip Lieberman |
President of Lieberman Software
Copyright © 2017 Lieberman Software Corporation
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. 11/28/ :52 AM
Overview
Security gets worse over time via “IT Conveniences & Mistakes”
#1 reason for breach = something stupid happened or was missed
Regular Interactive Security Health Checks find and repair Drift
What to look for and how-to repair it is what this session is about
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

3. 11/28/ :52 AM
Problems and Issues
Temporary settings/accounts become forgotten and permanent
Missing patches, bad BIOS, bad OS versions
IT makes mistakes in account and group configurations
Group Policies sometimes don’t “take” or get it wrong
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4. Problems and Issues Good security configurations drift off target
11/28/ :52 AM
Problems and Issues
Good security configurations drift off target
Bad designs never get cleaned up after deployments
Existing practices/processes generate unintended consequences of excessive capabilities
Little thought to limiting lateral motion in compromises
Machines rarely get rebooted with credentials living in memory forever
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5. Question: How would you find and repair these common mistakes?
11/28/ :52 AM
Question: How would you find and repair these common mistakes?
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

6. Demo Philip Lieberman 11/28/2018 10:52 AM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

7. Using Lieberman Software RED Tools
11/28/ :52 AM
Using Lieberman Software RED Tools [
Discover and Repair
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

8. Machine Inventory and Access
11/28/ :52 AM
Machine Inventory and Access
Extra /Missing Machines in Domain
Loss of Administrative Machine Control & Access
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

9. Account Management Excess # of Local and Domain Accounts
11/28/ :52 AM
Account Management
Excess # of Local and Domain Accounts
Terminated and Temporary Accounts still active
Unowned Accounts (attestation)
Misconfigured Accounts (blank password allowed)
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

10. Account Management Account used in too many places (i.e. Services)
11/28/ :52 AM
Account Management
Account used in too many places (i.e. Services)
Account used in unknown places (embedded in applications)
Potentially compromised Accounts need Change Password on next logon
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11. Account Management Accounts with too much privilege: Groups Rights
11/28/ :52 AM
Account Management
Accounts with too much privilege:
Groups
Rights
Abilities
Auditing turned off
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

12. Groups & Membership Excess # of Groups Excess Membership in Groups
11/28/ :52 AM
Groups & Membership
Excess # of Groups
Excess Membership in Groups
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

13. Groups & Membership Hostile Processes Rogue installed applications
Malware or Root Kits running (processes)
Bad Registry Entries
Information Leakage
Excessive/Unauthorized Shares

14. 11/28/ :52 AM
Summary
Regular health checks of security and configurations are easy and quick
Don’t depend on Group Policies – Check actual configuration (you will be surprised)
Stop by our booth #627 for a more in-depth demo of these tools
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

15. 11/28/ :52 AM
Q & A
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

16. Please evaluate this session
Tech Ready 15
11/28/2018
Please evaluate this session
From your
Please expand notes window at bottom of slide and read. Then Delete this text box.
PC or tablet: visit MyIgnite
Phone: download and use the Microsoft Ignite mobile app
Your input is important!
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.