Security West 2013

Overview

The best analogy for modern network penetration is biological warfare. A vulnerable client is exploited through weak software and social engineering to install the hacker's malware. The malware opens an SSL command-and-control channel back to the attacker. This channel is used to control the initial "Typhoid Mary" computer to infect other vulnerable systems and to exfiltrate valuable data (or to destroy it). When you add stealth, self-updating features, worm-like mobility, and corporate/government sponsorship to the malware, you've got an Advanced Persistent Threat (APT) situation. You're in trouble.

We don't just want to detect hackers and malware; we want to try to prevent the case-zero compromise to begin with. Prevention comes first, and then detection and remediation come afterwards. An ounce of prevention is worth a pound of cure. Today's course is on prevention through Windows operating system and applications hardening. The aim is to try to deny hackers and malware that initial foothold inside the network, because once they're in, they're hard to clean out.

We start by choosing malware-resistant software and Windows operating systems, then we regularly update that software, limit what software users can run, and then configure that software so that its exploitable features are disabled or at least restricted to work-only purposes. Nothing is guaranteed, of course, but what if you could reduce your malware infection rate by more than half? What if your next penetration test wasn't just an exercise in embarrassment?

The trick is hardening Windows in a way that is cost-effective, scalable, and with minimal user impact. In this course we'll look at tools like Group Policy, security templates, WSUS, and SCWCMD.EXE to hopefully make it easier. In today's course and during the week, we'll see how to implement many of the SANS Critical Controls.

Overview

Windows Server 2012 introduced a major new security enhancement called Dynamic Access Control (DAC). If you have millions of files spread across multiple servers, how can you manage access to and auditing of these ever-changing files? How can we avoid relying on NTFS permissions and auditing alone?

DAC allows you to mark files as "Trade Secret", "PII", or as any other classification tag you need, then apply restrictions and auditing based on these hidden file tags. But it's not done with AD group memberships and NTFS alone, DAC is not an NTFS management system, there's much more. With your own custom user and computer attributes defined in Active Directory, you can implement a Data Loss Prevention (DLP) solution based on "claims" associated with your users and their various devices. You can also perform auditing this way to help comply with regulations in your industry.

Dynamic Access Control works best with Server 2012 and Windows 8, but Windows 8 is not required. There is a gentle deployment pathway as you migrate off Windows XP. You do not have to deploy Windows 8 to benefit from DAC today.

Today's course also includes more recommendations for thwarting malware and APT adversaries. Hackers and malware love it when users are members of the local Administrators group on their computers. It makes it easier for the computer to get compromised. We will talk about what's so dangerous about the Administrators group and how to either get users out of that group or to secretly curtail the power of that group.

User Account Control (UAC) helps in this regard, but there's much more to UAC than just the annoying pop-up dialog boxes (in fact, those pop-ups can be turned off). We'll also talk about the dangers of NTLM, how to get rid of it, and use Kerberos only. But even Kerberos is vulnerable to attack, so there is a new enhancement in Server 2012 called "Kerberos armoring" to deal with the problem.

Network administrators are also prime targets for hackers. The Domain Admins group is just too attractive. In today's course we'll talk about how to delegate authority safely in order to limit the scope of harm from a compromise. Using Active Directory permissions we can delegate authority to various IT groups and contractors without giving the farm away.

Overview

Public Key Infrastructure (PKI) is not an optional security infrastructure anymore. Windows Server includes a complete built-in PKI for managing certificates and making their use transparent to users. With Windows Certificate Services you can be your own private Certification Authority (CA) and generate as many certificates as you want at no extra charge.

Digital certificates play an essential role in Windows security: IPSec, EFS, secure e-mail, SSL/TLS, Kerberos authentication with smart cards, smart card authentication to IIS and VPN servers, script signing, etc. They all use digital certificates. Everything needed to roll out a smart card solution, for example, is included with Windows except for the cards and readers themselves, and generic cards are available in bulk for cheap.

You also have to encrypt your laptops and portable drives to stay in compliance, but why spend a fortune on third-party products when BitLocker is built into Windows already? BitLocker is manageable through Group Policy and from the command line. BitLocker has automatic encryption key archival features for recovery, requires little or no user training, and can be used to encrypt portable USB drives. If you have a TPM chip in your motherboard, it can help BitLocker to detect rootkits, but note that a TPM chip is definitely not required to use BitLocker.

With UEFI firmware and Windows 8, you can also use Secure Boot to help fight off bootkits and other malware too.

Planning a PKI or data encryption project isn't easy, and mistakes and redeployments can be costly, so this course, in part, is designed to assist in the planning process to help avoid these mistakes. If you're not encrypting tablets, laptops and portable drives now, you will be soon.

Overview

Are you using Remote Desktop Protocol (RDP), DNS name resolution, or the File and Print Sharing (SMB) protocol? You shouldn't really trust them, they are hacker favorites. Do you have an 802.11 wireless network with just a pre-shared key? There's much more to wireless and Ethernet security than just key length. Today's course is on securing wireless and wired network access, hardening vulnerable protocols and ports, and using the Windows Firewall with IPSec.

You don't need third-party host firewalls anymore; the built-in Windows Firewall can be managed through Group Policy and is deeply integrated with IPSec.

IPSec is not just for VPNs. IPSec can authenticate users in Active Directory to implement share permissions for TCP and UDP ports based on the user's global group memberships. IPSec can also encrypt packet payloads to keep data secure. Imagine configuring the Windows Firewall on your servers and tablets to only permit access to RPC or SMB ports if 1) the client has a local IP address, 2) the client is authenticated by IPSec to be a member of the domain, and 3) the packets are all encrypted with AES. This is not only possible, but is actually relatively easy to deploy with Group Policy. We will see exactly how to do this in seminar.

But if the firewall allows the use of RDP, DNS and SMB, then the firewall by itself can't secure these dangerous protocols, they have to be hardened with DNSSEC, SMBv3 encryption, IPSec, and SSL. Many applications rely on SSL, but this ancient protocol is no silver bullet, it's better to upgrade to a recent version of TLS. And as more of our servers are moved out to the cloud, we will rely on SSL, RDP and IPSec even more.

Windows Server includes a built-in RADIUS service that can be used to regulate access to your wireless access points, managed Ethernet switches, and VPN gateways. Everything you need for a WPA2 wireless network solution, including certificate-based PEAP authentication, is built into Windows for free. This week we will see how to set it all up, step-by-step, including the PKI.

Overview

Of all the servers you manage, your Internet-facing IIS servers are probably the most at risk. IIS is a magnet for hackers, so great care must be taken in planning how to deploy and configure Microsoft's notorious HTTP and FTP server.

In this course, we will talk about how to harden the OS, how to strip IIS down to its essentials to reduce its attack surface, how to enforce authentication and authorization rules, how to implement application-layer HTTP/FTP filtering rules, and in general how to help keep your website from becoming another victim statistic.

During the day, the Code Red worm will be used as an example of an exploit, which could have been easily blocked through proper configuration even if the patch for Code Red had not been applied prior to the attack. IIS security is much more than just setting up a firewall and applying patches; it's about proactively anticipating tomorrow's attacks and being ready for them. Using free Microsoft add-ons, like URL Rewrite, we can do our own application-layer firewalling and satisfy some PCI requirements at the same time.

We will also see how to require SSL/TLS for the greatly improved FTP service and how to configure an FTP server farm to provide secure remote access to internal file servers.

The demand for IIS security personnel is great because IIS is so widely deployed. As more and more of your previously-internal servers are pushed out to cloud providers as VMs, you'll want to know how to harden them, your IaaS cloud provider will not do it all for you. If you're new to IIS, this course will get you up to speed.

Overview

PowerShell is Microsoft's upgrade for the old CMD.EXE shell and a Perl-like scripting language for it too. PowerShell is available as a free download for Windows XP/2003/Vista and is built into Windows 7 and later operating systems by default (get the latest version from http://www.microsoft.com/powershell/). In Server 2012 especially, everything is PowerShell, PowerShell, PowerShell...

PowerShell takes the best features of UNIX shells, like ksh and bash, and then blows them out of the water. What's the big deal? PowerShell rides on top of the .NET Framework; hence, the entire .NET class library is available at the command prompt. And, when PowerShell scripts and tools pipe data into other PowerShell scripts and tools, it's not plain text that gets piped, but entire .NET objects, including all their properties and methods.

PowerShell is the future of administrative scripting on Windows. For example, Exchange Server and Operations Manager have graphical management tools, but these tools are really just GUI wrappers for PowerShell commands. There are also PowerShell cmdlets for IIS, Server Manager, AppLocker, Active Directory, Server Core, and more. Microsoft has promised that other products will be PowerShell-ized too, so the long-term trend is clear: almost everything in Windows will eventually be manageable through PowerShell.

What about managing older systems and software? PowerShell can access scriptable COM objects just like VBScript and JavaScript too. This means you can use PowerShell with Windows Management Instrumentation (WMI), Active Directory Services Interface (ADSI), ActiveX Data Objects (ADO), and other COM interfaces. So while VBScript gives you COM, PowerShell gives you both .NET and COM.

And just like the old CMD shell, PowerShell is also designed to run built-in binaries, like WMIC.EXE, NETSH.EXE, SC.EXE, etc., but with a scripting language that's far more flexible than CMD batch scripting. What does the PowerShell scripting language look like? It looks a little bit like Perl or C#, but it's much easier to learn.

During the course we will walk through all the essentials of PowerShell together. The course presumes nothing. You don't have to have any prior scripting experience to attend. And, most importantly, be prepared to have fun - PowerShell is just plain cooooooool...