Thread by @ErrataRob

Ransomware is an 'existential threat' to business. What's your plan to respond to it? Wrong answers include "we are prepared" and "doing better at cybersecurity basics".

https://twitter.com/AP/status/1399803191412367362

I mention this because I read a lot of op-eds by infosec types that claim that ransomware demonstrates the need to for better cybersecurity. I disagree. I think we need to actually pay attention to the specifics how ransomware attacks work, and address those specifics.

Anybody says "we need to take it seriously", about any topic. Here's my take on the Israel-Palestinian crisis: "The recent rocket attacks by Hamas and Israel's response demonstrate how the United States needs to take this conflict more seriously". See how it works?

Every ransomware attack I've analyzed, going back years, has exploited "Windows networking" to move laterally in the network, usually gaining domain admin privileges to take down the entire network.

Thus, just hire pentesters skilled at getting domain admin (e.g. using mimikatz or something), given them a typical employee desktop, and document exactly how they get domain admin.

Now look at how you've setup your domain privileges. Notice how your offsite backup data center has trust relationships with the main domain? That falls easily to ransomware attackers.

I mean, good job, you've protected your business from a terrorist bombing your headquarters, but you disaster recovery still falls victim to ransomware.

Active Directory puts all your eggs into a single basket. It's the ventilation shaft in your Death Star. A single enemy X-wing fighter can fly in past your devices and lob a single shot to blow the entire thing up.

As a pentester, I just know how everybody I've seen does Active Directory wrong. However, I'm ignorant in that I don't know how to do it right, how to fix things to make the network resistant to attacks.

By the way, "least privilege" does not help nearly as much as you think. I can take whatever privileges I have and use them to elevate myself to the next level of privileges in Windows.

I mean, yes, do it, the fewer privileges admins have, the better. It's just that when setting up trust relationships between domains, don't assume "least privilege" will save you.

I assume trust relationships like this -- done in such a way that there is no bridge from one account to those in places like backup domains.

https://twitter.com/GeorgeOu/status/1399869493967425541

This is how backup works at home. I have a separate Linux server with snapshots that I have to login locally to administer. Short of an 0day in it's SMB stack (which happen) it's not getting hit by ransomware.