Profile picture
Amanda Berlin @InfoSystir
, 7 tweets, 1 min read Read on Twitter
Here are 50 FREE things you can do to improve the security of most environments:
Access control lists are your friend (deny all first)
AD delegation of rights
App Whitelisting
Best practice GPO (NIST GPO templates)
Block browsing from servers. Not all machines need internet access
Block Dns zone transfers
Change ilo settings/passwords
Close open mail relays
Diff. local admin passwords (LAPS)
Disable LLMNR/NetBios
Disable ports that are unused, & setup port security
Disable telnet & other insecure protocols or alert on use
DMZ behind separate firewall
DNS servers should not be openly recursive
Don't forget your printers (saved creds aren't good)
Egress Filtering (should be just as strict as Ingress)
EMET (when OSes prior to 10 are present)
Ensure web logins use HTTPS
Fail2ban
For the love of god implement TLS 1.2
Force advanced file auditing (ransomeware detection)
Geoblocking
Get rid of open shares
Incident Response drills
Incident Response Runbook & Bugout bag
Incident Response tabletops
Internal & OSINT honeypots
Least privileges EVERYWHERE
Locate and destroy plain text passwords
Log successful and unsuccessful logins - Windows/Linux logging cheatsheets
MITRE ATT&CK Matrix is your friend
Mod security
MSBSA
Network device backups
No open wi-fi, use WPA2 + AES
Password safes
Patch *nix boxes
Purple Team
Remove unneeded software
Restrict access to backups
Role based servers only! DNS servers/DCs are just that
Segment with Vlans
Separation of rights - Domain Admin use should be sparce & audited
Setup centralized logins for network devices. Use TACACS+ or radius
Upgrade firmware
URLscan
Use Bitlocker/encryption
User Education exercises
Vulnerability Scanner
WSUS
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to Amanda Berlin
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

More from @InfoSystir see all

Profile picture
#infosecstaples = Time for a new hashtag to help out our #infosec students. Asked some remedial questions that anyone going into a tech field should know and was surprised they hadn't been taught these things in school.
I know my own college degree didn't prepare me at all for the work that I would be doing after I graduated, but I thought maybe it had gotten a little bit better at this point. I guess not. They seem to be failing the participants still.
One of the main reasons @synackpse & I wrote the Defensive Security Handbook was to put staple information all down into one place as well as we could, but it doesn't even come close to covering everything someone may need to know, that's what universities should be trying to do.
Read 11 tweets

Related threads

Profile picture
Just to be clear - my Aldi post wasn't paid - I just asked for vouchers to give away to my readers. I spent my own money on the shopping and didn't ask for payment, because I thought the opportunity to feed 10 people was greater than the opportunity to earn a few quid. Thanks!
I choose my work carefully; I don't often work with big companies for nothing but I chose to effectively donate my fee for this one to do something better with it. I hope that clears up any queries! Also, er, the only person who can ask me to work for free is me. Thanks :)
I felt I had to clarify that as a few people asked why I hadn't put #ad or #spon on the post - and I hope that clears it up :) Collab stuff is new to me but I hope I'm doing okay :)
Read 3 tweets
Profile picture
Friction is the enemy of #compliance. Before you conduct security awareness training for topics like third-party security, make sure you understand and FEEL the friction in the end-to-end experience for employees who have to follow those processes and policies. #UX matters. 1/
Sit with your sales team to understand the #UX of getting an NDA in place with a prospective customer or partner. Try to understand the pain and confusion when it comes to delays, manual steps, confusion, approval workflows, or lack of integration with things like #CRM. 2/
Ask yourself: do the right people have access to the #ContractManagement or e-signature systems, or do they need to REQUEST access and wait for approval? Do the systems support #SSO? Do people have to manually print and scan docs (in 2018!), and if so - do they know how? 3/
Read 8 tweets
Profile picture
Bad tech can cripple companies and turn productive people into data entry folks. I saw this first hand as a professor, when @cornell's bad IT infrastructure turned professors into clerical workers.
There was a year when I had to go to a web page and click on a button between 9am-noon on Wednesdays, just like Desmond in Lost.
The key problem is that most enterprise software fails to support delegation, so tasks that were previously done by admin assistants can no longer, because admins aren't on the right access control lists.
Read 9 tweets
Profile picture
Here are my favorite quotes from this amazing book. #THREAD
1. "Bitcoin can be best understood as distributed software that allows for transfer of value using a currency protected from unexpected inflation without relying on trusted third parties"
2. "While Bitcoin is a new invention of the digital age, the problems it purports to solve - namely, providing a form of money that is under the full command of its owner and likely to hold its value in the long run - are as old as human society itself"
Read 137 tweets
Profile picture
#Aadhaar hearing. KVV about to complete. He continues on proportionality and how the Act has not done the balancing.

(Internet issues inside the Court.)
Continuing internet issues.

KVV now referring to misinterpretation of LokNiti order by Union and challenges cell phone linking.

KVV concludes by pressing for extension even in Section 7 notifications. Pleading with A-G not take this in an adversarial manner.
Senior Adv Anand Grover now begins his submissions. He appears for @mathew111938.

His first point is that there are vast swathes of the Aadhaar project not even regulated by the Aadhaar Act.
Read 20 tweets
Profile picture
1/ A year later, @NickSzabo4's essay on blockchains and social scalability remains a must read. H/T @Naval. unenumerated.blogspot.com/2017/02/money-… Some key takeaways:
2/ “Social scalability is the ability of an institution to overcome shortcomings in human minds and in the motivating or constraining aspects of said institution that limit who or how many can successfully participate.”
3/ While social scalability is about human limitations, not technical limitations, it can be beneficial to think about “the social scalability of a technology that facilitates an institution”.
Read 14 tweets

Trending hashtags

#Rstats #bills #suspense #TooGoodNotToShare #GDPR #Free #spon #DontNameThem #ACCESS #glasses #compliance #Parkland #table #AgeActivatedAttentionDeficitDisorder #ThankGod #SSO #garbage #car #books #NoNotoriety #FLYJOHNNYFLY #FLY #AD #UX #Meltdown

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member and get exclusive features!

Premium member ($3.00/month or $30.00/year)

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!