Microsoft Certified Master #ActiveDirectory & MVP. Founder @TrimarcSecurity. He/Him. Work requests: https://t.co/VRrL9cUKFv #BLM
1 subscribed
Jun 2, 2023 • 17 tweets • 3 min read
A little over 7 years ago I decided to embark on a journey which I named "Trimarc", with the goal of helping improve enterprise security for organizations and companies around the world
In this thread I will share some of my thoughts about my approach and goals
Trimarc has performed security assessments for hundreds of environments & have seen some really, really interesting things.
One key goal for Trimarc is sharing information with the community.
In many ways, I had achieved this goal with ADSecurity.org
Mar 4, 2022 • 6 tweets • 3 min read
Let's talk about something that is rarely mentioned in these conversations: VMware.
"100 percent of Fortune 500 and Fortune Global 100 companies use VMware"
VMware hosts servers (including AD Domain Controllers) in most sizable companies. It's rarely secured appropriately.
What do companies get wrong with VMware security?
* not limiting net access to vCenter/ESXi systems
* not restricting management protocols (Shell, SSH, DCUI, etc)
* not using lockdown mode or host profiles
* not patching VMware systems
* Root account pw not unique & complex
Mar 3, 2022 • 4 tweets • 2 min read
Agree to disagree. Active Directory can be secured. Biggest issues tend to be with administration, overpermissioned rights, legacy config, & service accounts no one wants to change.
I have personally seen some of the largest most complicated AD environments. They can be improved
AD is the best product Microsoft has released & its ease of deployment & uptime tends to be its detriment. This means that AD gets less attention & resources than things like network & Exchange.
I was once asked by an IT manager (50k person org), “we need 1 person for AD right?”
Oct 5, 2021 • 12 tweets • 3 min read
Here's the really crazy thing:
NO service account should be in Domain Admins in 2021.
Take a journey with me in this Thread to see why...
Domain Admins:
Full AD Admin rights (through membership in the domain's Administrators group) +
Local admin rights (default) on domain joined computers (workstations & servers) +
explicit ACLs on some privileged AD objects
Administrators:
Admin rights to AD (not on computers)
Tweet Thread on Resumes & Interviewing & things I look for (IT/Infosec focused).
I have likely seen hundreds of resumes (aka CVs) and interviewed many dozens of people in various positions. Here's what I've learned.
Resume (1)
It can get you "in the door" for an interview or you can get lost among the pile.
Resumes can be tough since everyone's experience is different. Try to stay at or under 2 pages - most reviewers will only skim the top of page 1
Resume clinics are great to help optimize
Dec 14, 2020 • 16 tweets • 6 min read
SolarWinds is only the latest system attack that results in a large scale compromise. Attackers target these systems because they have widespread and long-standing access.
Any system that has some level of admin rights across your environment is vulnerable.
THREAD follows
SolarWinds can monitor pretty much any system/device on typical networks &there is value to doing so.
Originally SolarWinds used SNMP (en.wikipedia.org/wiki/Simple_Ne…) to get system status. As more checks & status added, more capability was needed which means agent/remoting capability
Apr 20, 2020 • 77 tweets • 20 min read
Tonight’s movie
Great, now I need to change my password
Jan 17, 2020 • 6 tweets • 5 min read
Mitigation: "Active Directory Configuration"
That's right. Tighten up AD and leverage to mitigate typical attack methods:
[thread follows]
* Add all AD Admins to the Protected Users group to provide additional protections (including Kerberos delegation attack mitigation) docs.microsoft.com/en-us/windows-…
Please share in this thread some defensive techniques that are relatively simple to configure/deploy that has a high success rate (low false positives).
[Thread]
Enterprise password vaults (CyberArk, SecretServer, etc) can be useful but when they store privileged AD credentials, the security of that system needs to be protected like a DC. adsecurity.org/wp-content/upl…
When using the RDP (or RDP proxy), if the remote system the credential is used on is compromised, the credentials can be re-used (default). Changing the password mitigates reuse of the NTLM cred (pw hash), not existing Kerberos tickets (good for 10 hrs) adsecurity.org/?p=2362
1 subscribed
