,
6 tweets,
2 min read
Read on Twitter
Attackers don’t make assumptions that security policies are followed - they test them. There’s probably at least one person in your org that thinks Winter2019! is a strong password, and your service account passwords may not be as strong as you assume them to be.
Have a safe, legal, and documented way to verify your user accounts are following password best practices, Password Sprays are a common entry vector because human generated passwords that match ‘complexity’ tend to overlap. microsoft.com/en-us/microsof…
Service account passwords are excellent targets because of Kerberoasting and the availability of credentials via account sharing of use as services - and while these may be assumed to be strong passwords often times they are old and haven’t been rotated.
Security incidents are often thought of in terms of malware delivery, but with cloud services a password spray against a user with access to company email could be incredibly damaging to a company and remarkably low effort to an attacker.
Make sure your incident response plans include your cloud services - do you know all the features attackers could use and where the logs live? Can you verify password spray attempts via patterns and if unusual mailbox activity occurred?
Microsoft Office Flow is a powerful orchestration tool (attractive to attackers) that enables user workflows to upload documents to external services or do forwarding of emails - security teams may not know this is available or how to find the logs: flow.microsoft.com/en-us/blog/sec…
