Attacking and Defending Active Directory July, 2017
|
|
|
- Jonah Johnson
- 6 years ago
- Views:
Transcription
1 Attacking and Defending Active Directory July, 2017
2 About: Adam Steed 20 years of experience in IAM, working for financial, websites, and healthcare organizations Associate Director Protiviti Security and Privacy Practice Identity and Access Management
3 About: Andrew Allen Senior Consultant Protiviti Security and Privacy Practice Penetration Testing
4 About: Zac Davis Senior Consultant Protiviti Security and Privacy Practice Penetration Testing
5 Todays Attacks (Time Permitting) Lab 1 Enumeration Of AD/Endpoint Lab 2 Kerberoast Excessive Permissions (ACL/Delegated) Lab 3 Group Policy Preferences (GPP) in SYSVOL Shared Local Admin Credential Theft From LSASS NTDS.DIT (Domain Hashdump) Lab 4 Scripts In SYSVOL DCSync Golden Tickets
6 Todays Goal
7 1. Don t get yelled at by your boss because you got hacked.
8 2. Don t get yelled at because you failed a Pen Test.
9 The Days Of Password Guessing Is Over
10 Intro into Windows Passwords Hashes
11 Passwords are not stored in Active Directory
12 Windows Password Hashes Contain No Salt
13 Only Password Hashes Should Be Used
14 NTDS.DIT File Contains All Of The Password Hashes For The Domain What does it mean when you see users with the same password hash?
15 Why we don t need to guess passwords
16 Why we don t need to guess passwords
17 Attacker: Why Not Just Steal A Copy Of NTDS.DIT?
18 Defender: Making A Copy Of NTDS.DIT Is Hard NTDS.DIT is a locked file by LSASS process so you cant just copy it If you tamper with the LSASS process on a domain controller you could crash it NTDS.DIT is encrypted so you cant just open it
19 Attacker: Volume Shadow Copy FTW!
20 Defender: I Hate You!!
21 Volume Shadow Copy
22 NTDS.DIT Is Protected With Encryption Thank you Microsoft for storing the encryption key in the registry
23
24 Lab 1 Attacking the NTDS.DIT
25 Lab 1 Remediation Stopping LAN Manager
26 Lab 2 The more you know the quieter you can be
27 Attacker: You know why I like to drive in through brand new expensive neighborhood?
28 Defender: No Idea
29 Attacker: Because no one can afford blinds or curtains so I can see inside everything
30
31 Active Directory Enumeration (The GUI Method)
32 PowerShell Active Directory Module Cmdlet (System Admin Method) Requires install of AD PowerShell modules
33 PowerView (Hacker Method)
34 PowEnum (Lazy Hacker Method)
35 Lab 1 - Recap Enumeration Active Directory Users and Computers PowerShell PowerView PowEnum Overall Takeaway Live off the land More you know the quieter you become
36 Defender: I feel a little violated but your information is more detailed than my documentation. Can I get a copy?
37 Remediation For Lab 1 Does every user need to know every object in Active Directory? Does everyone need to know who a member of Domain Admins?
38 Remediation For Lab 1 Controlling who has the ability to discover sessions running a host
39 Lab 2 Kerberoasting: Beating the three headed dog
40 Kerberoast Agenda What is Kerberos What is a SPN How do you request a TGS Invoke-Kerberoast / PowEnum Roasting Cracking with Hashcat
41 Kerberoast What Is Kerberos
42 Kerberoast What is a SPN A SPN is a unique name that identifies an instance of a service. A SPN is associated with the user account under which the service instance runs. SPN = serviceclass / hostname [ : port] [ / servicename] MSSql Server: MSSQLSvc/SQL01.defcon.local:1433
43 Kerberoast Requesting a TGS
44 Kerberoast Requesting a TGS (Powerview)
45 Kerberoast Downloading PowEnum
46 Kerberoast Requesting a TGS (PowEnum) What do you see?
47 Kerberoast Requesting a TGS (PowEnum)
48 Cracking with Hashcat Part of the service ticket is encrypted with the NTLM hash of the target service instance
49 Cracking with Hashcat
50 Cracking with Hashcat
51 Abusing Insecure ACLs Agenda What is an ACL Objects access vs. system access How To Identify Insecure ACLs Attacking an Insecure ACL
52 Abusing Insecure ACLs What is an ACL An access control list (ACL) is a list of access control entries (ACE). Each ACE in an ACL identifies a trustee and specifies the access rights allowed, denied, or audited for that trustee. The security descriptor for a securable object can contain two types of ACLs: Discretionary access control list (DACL) System access control list (SACL)
53 Abusing Insecure ACLs - How To Identify Insecure ACLs
54 Abusing Insecure ACLs - How To Identify Insecure ACLs
55 Abusing Insecure ACLs - How To Identify Insecure ACLs 7 8 9
56 Abusing Insecure ACLs - How To Identify Insecure ACLs What Do You See?
57 Abusing Insecure ACLs - How To Identify Insecure ACLs Is this a problem? What other issues?
58 Abusing Insecure ACLs - How To Identify Insecure ACLs Normal?
59 Abusing Insecure ACLs - Attacking an Insecure ACL How can this be leveraged?
60 Abusing Insecure ACLs - Attacking an Insecure ACL How can this be leveraged?
61 Lab 3 - Recap Kerberoast Weak Service Account Password Abusing Insecure ACLs Kerberoasted Elliott.Alderson Cracked the Password Elliott.Alderson Used Elliott.Alderson full control of DA Object to add Elliot to DA group DOMAIN ADMIN! + + =
62 Remediation For Attack Path 3 Kerberoast Weak Service Account Password Abusing Insecure ACLs Validate all service accounts (user accounts with Service Principal Names) have long, complex passwords greater than 25 characters, preferably 30 or more. This makes cracking these passwords far more difficult Validate all service account passwords are changed regularly (at least once a year)..
63 Lab 3 When Microsoft gives you the keys
64 GPP Password Decryption Agenda What Is Group Policy Group Policy Preferences Files Get-GPPPassword (Powersploit) / PowEnum
65 GPP Password Decryption - What Is Group Policy
66 GPP Password Decryption - Group Policy Preferences Files Map drives (Drives.xml) Create Local Users (Groups.xml) Data Sources (DataSources.xml) Printer configuration (Printers.xml) Create/Update Services (Services.xml) Scheduled Tasks (ScheduledTasks.xml)
67 GPP Password Decryption Downloading PowEnum
68 GPP Password Decryption SYSVOL What do you see?
69 GPP Password Decryption SYSVOL
70 GPP Password Decryption - Powersploit
71 Credential Theft Agenda Windows Credential Theft (SAM / LSASS / Credman / LSA Secrets/NTDS.DIT) Mimikatz Invoke-Mimikatz CrackMapExec
72 Credential Theft Agenda - Windows Credential Theft (SAM) Security Accounts Manager (SAM) database Stores password HASHES for all LOCAL accounts Built-in local admin, local users, guest account, etc. NT Hashes (LM on legacy OS) Unsalted MD4 hash of user s clear text
73 Credential Theft Agenda - Windows Credential Theft (LSASS) LSASS (Local Security Authority Subsystem Service) Stores Creds in-memory Single Sign On Multiple Forms of Storage LSA credentials created in memory when RDP RunAs task started Run active windows service Schedule task or batch job Run task remotely using admin tool (Psexec, etc.)
74 Credential Theft Agenda - Windows Credential Theft (LSA Secrets) Secret piece of data that is accessible only to SYSTEM account processes May persist through reboot LSA Secrets Creds include Computer AD DS account Windows Service configured locally Scheduled task accounts IIS app pools and websites
75 Credential Theft Agenda - Windows Credential Theft (Credman) Credential Manager Control Panel (Credman) Saved passwords in windows Stored on disk protected by Data Protection App. Programming Interface (DPAPI) Credman obtains infor in two ways Explicit creation System population Uses Credential Locker (Formally Windows Vault) Dumped at same time as LSASS with mimikatz
76 AD DS database (NTDS.DIT) Store of credentials for all users in the AD DS domain The database stores a number of attributes for each account, which includes user names types and the following: LM/NT hash for the current password LM/NT hashes for password history (if configured)
77 Credential Theft Agenda Mimikatz / Invoke- Mimikatz
78 Credential Theft Agenda CrackMapExec Target 1 Win 2016 cme u gpo_la -p 'HoldTheDoor!' -M mimikatz
79 Credential Theft Agenda CrackMapExec Target 1 Win 2016 cme u gpo_la -p 'HoldTheDoor!' -M mimikatz What Happened?
80 Credential Theft Agenda CrackMapExec Target 2 Win 2012 cme u gpo_la -p 'HoldTheDoor!' -M mimikatz
81 Credential Theft Agenda Dump Domain Creds ALL DOMAIN CREDS!!!
82 Lab 4 - Recap GPP Password Decryption Shared Local Admin Credential Theft (LSASS) Decrypted GPO_LA from a GPP file Used GPO_LA to perform a local login on LabWin2012.defcon.local as a local admin As a local admin dumped account (Domain Admin) creds with mimikatz Dump domain creds with NTDS.DIT DOMAIN ADMIN!!!!
83 Remediation For Lab 4 GPP Password Decryption Shared Local Admin Credential Theft (LSASS) Patch DC + Remove Scripts/ Lock Down SYSVOL 3 tier arch, restricted admin, wdigest disable, win10 CG, workstation isolation Different admin passwords on all endpoints
84 Lab 5 More Low Hanging Fruit / Abuse of Core AD functionality
85 SYSVOL Script - Agenda What is the SYSVOL How to access the SYSVOL Powerview / PowEnum
86 SYSVOL Scripts - What is the SYSVOL SYSVOL is simply a folder which resides on each and every domain controller within the domain. It contains the domains public files that need to be accessed by clients and kept synchronized between domain controllers. The SYSVOL folder can be accessed through its share \\domainname.com\sysvol or the local share name on the server \\servername\sysvol.
87 SYSVOL Scripts - Powerview
88 SYSVOL Scripts Downloading PowEnum
89 SYSVOL Scripts Downloading PowEnum What do you see?
90 SYSVOL Scripts Downloading PowEnum
91 SYSVOL Scripts Reviewing Scripts Anything Juicy?
92 DCSync- Agenda What is DCSync Who can DCSync Mimikatz (lsadump::dcsync) ZAC TO MAKE VISIO DIAGRAM OF DCSYNC
93 DCSync- What is DCSync Abuse DC Replication Services Impersonate a Domain Controller to request account password data With appropriate rights (replication rights), extract password hash for ANY account in the FOREST Mimikatz Pull past and present hashes for any user No interactive logon No copy of NTDS.DIT QUIET Persistence
94 DCSync- Who can DCSync How can we identify who has the correct privileges?
95 DCSync- Who can DCSync How can we identify who has the correct privileges?
96 DCSync- Mimikatz
97 Golden Tickets
98 Lab 5 - Recap SYSVOL Scripts DcSync Golden Ticket?? Identified cleartext credentials for a Sharepoint Service Account Identified that the Sharepoint account has replication rights Used DCSync to steal the KRBTGT account hash Created a Golden Ticket with the KRBTGT account hash
99 Remediation For LAB 5 SYSVOL Scripts DcSync Golden Tticket Validate no hard coded creds in script (.bat/ps1/.cmd ) files Lock down replication rights to appropriate users
100 Security Recommendations: 3-Tier Administration Model Implement 3-Tier Administration Model for Enhanced Security Transitive Nature of Control/Security Can Control Effectively: Can Control Can Control The Attack Surface of an environment is the sum of the different points from where an unauthorized user can compromise the environment. 3-Tier Administration Model reduces the attack surface by isolating the environment into 3 Tiers. Account used to logon to the servers/workstations in each tier must be different and can t be used in other two. Tier-0: Domain/Forest Level Servers(Domain Controllers) and any jump/admin servers used in administration. Tier-1: Member Servers, servers which host internal, monitoring, security, mail & collaboration apps. Tier-2: User Workstations/Devices, where users logon to do their regular day to day work like checking s, creating documents/reports etc.
101 Security Recommendations: Admin Boundaries Define clear administrative Boundaries, even within the same tier Example 1. (Tier 3) Helpdesk Technicians in Tokyo cannot exercise the same rights on the New York office Example 2. (Tier 2) Similarly, DBA groups should not have the same rights on Mail & Collaboration servers Database & Collaboration Tier 2 Tokyo New York Tier 3
102 1.Computer Configuration\Policies\Windows Settings\Security Settings\Local Settings\User Rights Assignments: 1. Deny access to this computer from the network 2. Deny log on as a batch job 3. Deny log on as a service 4. Deny log on locally 5. Deny log on through Remote Desktop Services user rights
103 The End
Active Directory Attacks and Detection
Active Directory Attacks and Detection #Whoami Working as an Information Security Executive Blog : www.akijosberryblog.wordpress.com You can follow me on Twitter: @AkiJos This talk is Based on Tim Madin
Active Directory Attacks and Detection
Active Directory Attacks and Detection #Whoami Working as an Information Security Executive Blog : www.akijosberryblog.wordpress.com You can follow me on Twitter: @AkiJos Lab Setup AJLAB.COM: 2 Domain
Pass-the-Hash Attacks
Pass-the-Hash Attacks Mgr. Michael Grafnetter www.dsinternals.com Agenda PtH Attack Anatomy Mitigation Proactive Reactive Windows 10 + Windows Server 2016 Microsoft Advanced Threat Analytics PtH Attack
Active Directory Attacks and Detection Part -II
Active Directory Attacks and Detection Part -II #Whoami Working as an Information Security Executive Blog : www.akijosberryblog.wordpress.com You can follow me on Twitter: @AkiJos Key Takeaways How to
7 EASY ATTACKS AGAINST ACTIVE DIRECTORY
NEW TITLE: 7 EASY ATTACKS AGAINST ACTIVE DIRECTORY And How to Prevent Them Through Good Practices and a Little Group Policy ABOUT ME Kevin McBride Security Specialist at Meridian Credit Union 12 years
Pass-the-Hash Attacks. Michael Grafnetter
Pass-the-Hash Attacks Michael Grafnetter www.dsinternals.com Agenda PtH Attack Anatomy Mitigation Proactive Reactive Windows 10 + Windows Server 2016 PtH History and Future 1988 Microsoft releases Lan
Premediation. The Art of Proactive Remediation. Matthew McWhirt, Senior Manager Manfred Erjak, Principal Consultant OCTOBER 1 4, 2018 WASHINGTON, D.C.
Premediation The Art of Proactive Remediation Matthew McWhirt, Senior Manager Manfred Erjak, Principal Consultant OCTOBER 1 4, 2018 WASHINGTON, D.C. Overview Case Study Remediation Overview Premediation
Useful Hacking Series
Useful Hacking Series Welcome to the Useful Hacking Series, in this series of 20 Episodes our world-renowned penetration tester/international speaker will share with you the top useful tips used during
Modern Realities of Securing Active Directory & the Need for AI
Modern Realities of Securing Active Directory & the Need for AI Our Mission: Hacking Anything to Secure Everything 7 Feb 2019 Presenters: Dustin Heywood (EvilMog), Senior Managing Consultant, X-Force Red
Deploy and Configure Microsoft LAPS. Step by step guide and useful tips
Deploy and Configure Microsoft LAPS Step by step guide and useful tips 2 Table of Contents Challenges today... 3 What is LAPS... 4 Emphasis and Tips... 5 How LAPS Work... 6 Components... 6 Prepare, Deploy
10 Active Directory Misconfigurations That Lead to Total Compromise Austin, TX 201 W 5th St.
10 Active Directory Misconfigurations That Lead to Total Compromise hello@javelin-networks.com +1-888-867-5179 Austin, TX 201 W 5th St. 1. Group Policy Preferences Visible Passwords Group Policy Preferences
Configure advanced audit policies
7 LESSON Configuring Advanced Audit Policies 70-411 EXAM OBJECTIVE Objective 2.4 Configure advanced audit policies. This objective may include but is not limited to: implement auditing using Group Policy
Computers Gone Rogue. Abusing Computer Accounts to Gain Control in an Active Directory Environment. Marina Simakov & Itai Grady
Computers Gone Rogue Abusing Computer Accounts to Gain Control in an Active Directory Environment Marina Simakov & Itai Grady Motivation Credentials are a high value target for attackers No need for 0-day
n Describe the CEH hacking methodology and system hacking steps n Describe methods used to gain access to systems
Outline n Describe the CEH hacking methodology and system hacking steps n Describe methods used to gain access to systems n Describe methods used to escalate privileges Chapter #5: n Describe methods used
Active Directory Security: The Journey. Sean Metcalf s e a n TrimarcSecurity.com TrimarcSecurity.
Active Directory Security: The Journey Sean Metcalf (@Pyrotek3) s e a n [@] TrimarcSecurity.com www.adsecurity.org TrimarcSecurity.com ABOUT Founder Trimarc (Trimarc.io), a professional services company
10 Ways Credit Unions Get PWNED
10 Ways Credit Unions Get PWNED NASCUS 2017 Investment advisory services are offered through CliftonLarsonAllen Wealth Advisors, LLC, an SEC-registered investment advisor. Intro I am going to share with
Hacking in the Attack Kill Chain
Hacking in the Attack Kill Chain Håkan Nohre, Consulting Systems Engineer, GIAC GPEN #9666, CISSP #76731 Erkan Djafer, Consulting Systems Engineer, CISSP #535930 Chung-wai Lee, Cyber Security Partner Account
KERBEROS PARTY TRICKS
KERBEROS PARTY TRICKS Weaponizing Kerberos Protocol Flaws Geoffrey Janjua Who is Exumbra Operations Group? Security services and consulting Specialized services: Full scope red-team testing, digital and
Active Directory Security: The Journey. Sean Metcalf s e a n TrimarcSecurity.com TrimarcSecurity.
Active Directory Security: The Journey Sean Metcalf (@Pyrotek3) s e a n [@] TrimarcSecurity.com www.adsecurity.org TrimarcSecurity.com ABOUT Founder Trimarc, a security company. Microsoft Certified Master
Securing Active Directory Administration
Securing Active Directory Administration April 18, 2019 Sponsored by @BlackHatEvents / #BlackHatWebcasts Agenda On-Prem AD vs Azure AD Evolution of Administration Exploiting Typical Administration Methods
RID HIJACKING Maintaining Access on Windows Machines.
RID HIJACKING Maintaining Access on Windows Machines. Security Conference Bogotá, Colombia. 2018 Agenda 0x01. Exposing the RID Hijacking Attack. 0x02. Windows Logon in a nutshell. 0x03. Hijacking the RID.
CS 290 Host-based Security and Malware. Christopher Kruegel
CS 290 Host-based Security and Malware Christopher Kruegel chris@cs.ucsb.edu Windows Windows > 90 % of all computers run Windows when dealing with security issues, it is important to have (some) knowledge
Server. Client LSA. Winlogon LSA. Library SAM SAM. Local logon NTLM. NTLM/Kerberos. EIT060 - Computer Security 2
Local and Domain Logon User accounts and groups Access tokens Objects and security descriptors The Register Some features in Windows 7 and Windows 8 Windows XP evolved from Windows 2000 Windows 10, 8,
Hunting for Credentials Dumping in Windows Environment. Teymur Kheirhabarov
Hunting for Credentials Dumping in Windows Environment Teymur Kheirhabarov Senior SOC Analyst @Kaspersky Lab SibSAU (Krasnoyarsk) graduate Ex- System admin Ex- Infosec admin Ex- Infosec dept. head Twitter
Joe Stocker, CISSP, MCITP, VTSP Patriot Consulting
Joe Stocker, CISSP, MCITP, VTSP Patriot Consulting Microsoft Cloud Evangelist at Patriot Consulting Principal Systems Architect with 17 Years of experience Technical certifications: MCSE, MCITP Office
Bojan Ždrnja, CISSP, GCIA, GCIH, GWAPT INFIGO IS
Laterally pwning Windows Bojan Ždrnja, CISSP, GCIA, GCIH, GWAPT Bojan.Zdrnja@infigo.hr INFIGO IS http://www.infigo.hr Who am I? Senior information security consultant at INFIGO IS Penetration testing (all
Active directory : How to change a weak point into a leverage for security monitoring Vincent LE TOUX ENGIE France OSSIR 2017 Paris (France) April,
Active directory : How to change a weak point into a leverage for security monitoring Vincent LE TOUX ENGIE France OSSIR 2017 Paris (France) April, 11th 2017 CONTENTS Chapter 1 Why focusing on Active Directory?
The of Passw0rds: Notes from the field
The L@m3ne55 of Passw0rds: Notes from the field Ben Williams Senior Security Consultant Previously Presented at various conferences including BlackHat and other smaller conferences in Europe Exploitable
Pentesting Windows Domains
Pentesting Windows Domains Active Directory security model and weaknesses 2017-01-09 Jean MARSAULT AGENDA / 01 Introduction / 02 The Active Directory model & Windows domains / 03 Pentesting Windows domains
Active Directory: What can make your million dollar SIEM go blind?
Active Directory: What can make your million dollar SIEM go blind? Whoarewe Vincent LE TOUX Main Speaker @mysmartlogon Security researcher CEO of «My Smart Logon» (smart card & windows authentication)
Interested in learning more about security? Windows Logon Forensics. Copyright SANS Institute Author Retains Full Rights
Interested in learning more about security? SANS Institute InfoSec Reading Room This paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission. Windows
#BLACKALPS17. Harman Singh DEFENDZA LTD. 1
#BLACKALPS17 Harman Singh www.defendza.com @defendzaltd 1 Managing consultant at Defendza Pen Tester/Security Consulting Tweets are welcome @digitalamli #BlackAlps17 Hacktivity, BlackAlps, Bsides, BlackHat
MU2b Authentication, Authorization and Accounting Questions Set 2
MU2b Authentication, Authorization and Accounting Questions Set 2 1. You enable the audit of successful and failed policy changes. Where can you view entries related to policy change attempts? Lesson 2
Networks: Access Management Windows NT Server Class Notes # 10 Administration October 24, 2003
Networks: Access Management Windows NT Server Class Notes # 10 Administration October 24, 2003 In Windows NT server, the user manager for domains is the primary administrative tool for managing user accounts,
Security and Authentication
Security and Authentication Authentication and Security A major problem with computer communication Trust Who is sending you those bits What they allow to do in your system 2 Authentication In distributed
Privileged Identity App Launcher and Session Recording
Privileged Identity App Launcher and Session Recording 2018 Bomgar Corporation. All rights reserved worldwide. BOMGAR and the BOMGAR logo are trademarks of Bomgar Corporation; other trademarks shown are
Advanced Security Measures for Clients and Servers
Advanced Security Measures for Clients and Servers Wayne Harris MCSE Senior Consultant Certified Security Solutions Importance of Active Directory Security Active Directory creates a more secure network
Mike Pilkington. SANS Forensics and IR Summit June, 2011
Mike Pilkington SANS Forensics and IR Summit June, 2011 Since graduating from UT- for a large oil and gas services company Systems Admin, Network Admin, and Security Analyst My current role focuses on
Post-Exploitation with WCE v1.2
Post-Exploitation with WCE v1.2 Pass-the-Hash. Pass-the-ticket & more Date: 01-07-2011 Author: Hernan Ochoa Windows Authentication h1 = LMHash( pwd1 ) h2 = NTHash( pwd1 ) SAM
Password policy settings control the complexity and lifetime for passwords. This section discusses each specific password policy setting
Windows Security Reference This document is a checklist of the security options with reference material (provided by Microsoft) for a Windows server implementation. The options are based on Windows 2003
3 ways of supporting a group of computers. Machine by machine Centrally structured Centrally managed (AD/Novell)
3 ways of supporting a group of computers Machine by machine Centrally structured Centrally managed (AD/Novell) Pre-reqs for Remote/Central Administration list of machines NT based OS Known Account w/
Active Directory Delegation Dissected. Copyright 2018 NotSoSecure Global Services Limited, all rights reserved.
Active Directory Delegation Dissected Copyright 2018 NotSoSecure Global Services Limited, all rights reserved. About NotSoSecure Specialist IT security company providing cutting-edge IT security consultancy
Tactics, Techniques, and Procedures
Dec 8, 2017 This report maps Cobalt Strike's actions to MITRE's Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) matrix. Command-Line Interface Command-line interfaces provide a way of interacting
COPYRIGHTED MATERIAL. Contents. Part I: The Basics in Depth 1. Chapter 1: Windows Attacks 3. Chapter 2: Conventional and Unconventional Defenses 51
Acknowledgments Introduction Part I: The Basics in Depth 1 Chapter 1: Windows Attacks 3 Attack Classes 3 Automated versus Dedicated Attacker 4 Remote versus Local 7 Types of Attacks 8 Dedicated Manual
Data Security and Privacy : Compliance to Stewardship. Jignesh Patel Solution Consultant,Oracle
Data Security and Privacy : Compliance to Stewardship Jignesh Patel Solution Consultant,Oracle Agenda Connected Government Security Threats and Risks Defense In Depth Approach Summary Connected Government
Outline. Security. Security Ratings. TCSEC Rating Levels. Key Requirements for C2. Met B-Level Requirements
Outline Ausgewählte Betriebssysteme Institut Betriebssysteme Fakultät Informatik Ratings System Components 2 Ratings TCSEC Rating Levels National Computer Center (NCSC) part of US Department of Defense
Hacking Our Way to Better Security: Lessons from a Web Application Penetration Test. Tyler Rasmussen Mercer Engineer Research Center
Hacking Our Way to Better Security: Lessons from a Web Application Penetration Test Tyler Rasmussen Mercer Engineer Research Center About Me Cybersecurity Engineering Intern @ MERC Senior IT/Cybersecurity
Contents. Auditing Microsoft Domain Environment
Contents About the Author...2 About The Microsoft Domain Environments:...3 About Auditing:...4 Gaining First User:...5 Enumerating AD Users and Groups With Gained User:...8 Checking Common Vulnerabilities:...12
Security. Outline. Security Ratings. Ausgewählte Betriebssysteme Institut Betriebssysteme Fakultät Informatik
Ausgewählte Betriebssysteme Institut Betriebssysteme Fakultät Informatik Outline Ratings System Components Logon Object (File) Access Impersonation Auditing 2 Ratings National Computer Center (NCSC) part
From Workstation to Domain. Sean Metcalf s e a n TrimarcSecurity.com TrimarcSecurity.com
From Workstation to Domain Admin Sean Metcalf (@Pyrotek3) s e a n [@] TrimarcSecurity.com www.adsecurity.org TrimarcSecurity.com ABOUT Founder Trimarc (Trimarc.io), a professional services company that
Remote Administration
Windows Remote Desktop, on page 1 pcanywhere, on page VNC, on page 6 Windows Remote Desktop Remote Desktop permits users to remotely execute applications on Windows Server 2012 R2 from a range of devices
Tracking changes in Hybrid Identity environments with both Active Directory and Azure Active Directory
Tracking changes in Hybrid Identity environments with both Active Directory and Azure Active Directory Presenters: Sander Berkouwer Senior Consultant at SCCT 10-fold Microsoft MVP Active Directory aficionado
Event Log 101. What is Event Log? Windows version of syslog.
Event Log Analysis Event Log 101 What is Event Log? Windows version of syslog. Where are these artifacts located in? %SystemRoot%\System32\winevt\Logs %SystemRoot% is C:\Windows typically. 2 Event Log
Identity, Authentication, and Access Control
Identity, Authentication, and Access Control License This work by Z. Cliffe Schreuders at Leeds Metropolitan University is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.
Becoming the Adversary
SESSION ID: CIN-R06 Becoming the Adversary Tyrone Erasmus Managing Security Consultant MWR InfoSecurity @metall0id /usr/bin/whoami Most public research == Android Something different today 2 Overview Introduction
WHITEPAPER ATTIVO NETWORKS THREATDEFEND PLATFORM AND THE MITRE ATT&CK MATRIX
WHITEPAPER ATTIVO NETWORKS THREATDEFEND PLATFORM AND THE MITRE ATT&CK MATRIX 1 INTRODUCTION The MITRE Corporation Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK ) Matrix provides a model
IT Service Delivery And Support Week Four - OS. IT Auditing and Cyber Security Fall 2016 Instructor: Liang Yao
IT Service Delivery And Support Week Four - OS IT Auditing and Cyber Security Fall 2016 Instructor: Liang Yao 1 What is an Operating System (OS)? OS is a software that designed to run on specific hardware
Securing Active Directory Administration. Sean Metcalf s e a n TrimarcSecurity.com TrimarcSecurity.
Securing Active Directory Administration Sean Metcalf (@Pyrotek3) s e a n [@] TrimarcSecurity.com www.adsecurity.org TrimarcSecurity.com ABOUT Founder Trimarc (Trimarc.io), a professional services company
Network Security: Kerberos. Tuomas Aura
Network Security: Kerberos Tuomas Aura Kerberos authentication Outline Kerberos in Windows domains 2 Kerberos authentication 3 Kerberos Shared-key protocol for user login authentication Uses passwords
ALL ROADS LEAD TO DOMAIN ADMIN BREACH TO CDE A SECTOR CONFERENCE PRESENTATION OCTOBER 2016
BREACH TO CDE ALL ROADS LEAD TO DOMAIN ADMIN A SECTOR CONFERENCE PRESENTATION OCTOBER 2016 Introduction Yannick Bedard Security Consultant Network Penetration Testing SpiderLabs, Trustwave email: ybedard.infosec@gmail.com
SERVER HARDENING CHECKLIST
SERVER HARDENING CHECKLIST WINDOWS 2003 SERVER CHECKLIST This checklist contains server hardening procedures for Windows 2003 Server. The procedures listed in this document are a balance of industry best
IMPLEMENTING MICROSOFT CREDENTIAL GUARD FOR ISO 27001, PCI, AND FEDRAMP
IMPLEMENTING MICROSOFT CREDENTIAL GUARD FOR ISO 27001, PCI, AND FEDRAMP North America Latin America Europe 877.224.8077 info@coalfire.com coalfire.com Coalfire sm and CoalfireOne sm are registered service
Future Forests: Realistic Strategies for AD Security & Red Forest Architecture
SESSION ID: STR-R02 Future Forests: Realistic Strategies for AD Security & Red Forest Architecture Katie Knowles Security Consultant MWR InfoSecurity @_sigil Introduction: Why AD Matters How AD is Targeted
CISNTWK-11. Microsoft Network Server. Chapter 5 Introduction Permissions i and Shares
CISNTWK-11 Microsoft Network Server Chapter 5 Introduction Permissions i and Shares 1 In a Nutshell Payroll Data? Payroll Data? Introduction A permission is a rule associated with an object, such as a
Persistent key, value storage
Persistent key, value storage In programs, often use hash tables - E.g., Buckets are an array of pointers, collision chaining For persistant data, minimize # disk accesses - Traversing linked lists is
An Analysis of Local Security Authority Subsystem
An Analysis of Local Security Authority Subsystem Shailendra Nigam Computer Science & Engineering Department DIET, Kharar Mohali(Punjab) India. Sandeep Kaur Computer Science & Engineering Department BBSBEC,
MEETING HIPAA/HITECH DATA ACCESS AND PASSWORD REQUIREMENTS IN THE WINDOWS HEALTHCARE ENTERPRISE
Specops Software presents: MEETING HIPAA/HITECH DATA ACCESS AND PASSWORD REQUIREMENTS IN THE WINDOWS HEALTHCARE ENTERPRISE By Derek Melber, MCSE, MVP Meeting HIPAA/HITECH Data Access and Password Requirements
Security Testing. - a requirement for a secure business. ISACA DAY in SOFIA. Gabriel Mihai Tanase, Director, Cyber Services KPMG in CEE
Gabriel Mihai Tanase, Director, Cyber Services KPMG in CEE Cyber Security Services Security Testing - a requirement for a secure business ISACA DAY in SOFIA Agenda No Agenda Some minimum theory More real
Active Directory Attacks and Detection Part -III
Active Directory Attacks and Detection Part -III #Whoami Working as an Information Security Executive Blog : www.akijosberryblog.wordpress.com You can follow me on Twitter: @AkiJos Key Takeaways Abusing
Manage and Maintain Active Directory Domain Services
Active Directory 101 Manage and Maintain Active Directory Domain Services Sander Berkouwer CTO at SCCT 10-fold Microsoft MVP Active Directory aficionado Daniel Goater Systems Engineer Netwrix Active Directory
MODERN DESKTOP SECURITY
MODERN DESKTOP SECURITY I M GOING TO BE HONEST. WE RE IN THE FIGHT OF OUR DIGITAL LIVES, AND WE ARE NOT WINNING! M I C H A E L M C C A U L, C H A I R M A N, U S H O M E L A N D S E C U R I T Y C O M M
Windows 10 Security & Audit
Windows 10 Security & Audit John Tannahill, CA, CISM, CGEIT, CRISC, CSX-P jtannahi@rogers.com Windows 10 Editions Home Pro Enterprise Education Mobile IoT Editions 1 Windows 10 Builds Windows 10 (initial
RastaLabs Red Team Simulation Lab
RastaLabs Red Team Simulation Lab LAB OUTLINE Description RastaLabs is a virtual Red Team Simulation environment, designed to be attacked as a means of learning and honing your engagement skills. The focus
PROPOSAL OF WINDOWS NETWORK
PROPOSAL OF WINDOWS NETWORK By: Class: CMIT 370 Administering Windows Servers Author: Rev: 1.0 Date: 01.07.2017 Page 1 of 10 OVERVIEW This is a proposal for Ear Dynamics to integrate a Windows Network
Lateral Movement Defcon 26. Walter Mauricio
Lateral Movement 101 @ Defcon 26 Walter Cuestas @wcu35745 Mauricio Velazco @mvelazco About Workshop goals Lab Environment Hands-on exercises & CTF #Whoarewe Walter Cuestas (@wcu35745) Mauricio Velazco
Unified CCE Security Compliance for Windows Server 2012 R2
Unified CCE Security Compliance for Windows Server 2012 R2 This topic contains the security baseline for hardening Windows Server 2012 R2 Servers running Unified CCE. This baseline is essentially a collection
A Taste of SANS SEC 560: Adventures in High-Value Pen Testing
All Rights Reserved 1 Network Penetration Testing and Ethical Hacking A Taste of SANS SEC 560: Adventures in High-Value Pen Testing SANS Security 560 Copyright 2015, All Rights Reserved Version 2Q15 All
Radius, LDAP, Radius, Kerberos used in Authenticating Users
CSCD 303 Lecture 5 Fall 2018 Radius, LDAP, Radius, Kerberos used in Authenticating Users Kerberos Authentication and Authorization Previously Said that identification, authentication and authorization
Single Sign-On Showdown
Single Sign-On Showdown ADFS vs Pass-Through Authentication Max Fritz Solutions Architect SADA Systems #ITDEVCONNECTIONS Azure AD Identity Sync & Auth Timeline 2009 2012 DirSync becomes Azure AD Sync 2013
DirectDefense. Catch Me If You Can. PenTester/Hacker vs. BlueTeam Defender
DirectDefense Catch Me If You Can PenTester/Hacker vs. BlueTeam Defender Who are we? Jim Broome DirectDefense and Red Teamer Michael Gough InfoSec & Malware researcher and Blue Teamer Agenda Quick Introductions
Detecting Lateral Movement in APTs ~Analysis Approach on Windows Event Logs~ June 17, 2016 Shingo ABE ICS security Response Group JPCERT/CC
Detecting Lateral Movement in APTs ~Analysis Approach on Windows Event Logs~ June 17, 2016 Shingo ABE ICS security Response Group JPCERT/CC Agenda Introduction to JPCERT/CC About system-wide intrusions
Application Launcher & Session Recording
Installation and Configuration Guide Application Launcher & Session Recording 5.5.3.0 Copyright 2003 2017 Lieberman Software Corporation. All rights reserved. The software contains proprietary information
Hardcore PI System Hardening
Hardcore PI System Hardening Jozef Sujan, Lubos Mlcoch 1 Agenda 1. No-nonsense approach to Cyber Security 2. The Power of... PowerShell 3. Deadly Sins of PI Administrators Note: All examples in this presentation
Expert Webinar: Hacking Your Windows IT Environment
Expert Webinar: Hacking Your Windows IT Environment Presenters: Liam Cleary Microsoft MVP, Blogger helloitsliam@protonmail.com Jeff Melnick Pre-Sales Director, Netwrix Jeff.Melnick@netwrix.com www.helloitsliam.com
How NOT To Get Hacked
How NOT To Get Hacked The right things to do so the bad guys can t do the wrong ones Mark Burnette Partner, LBMC -Risk Services October 25, 2016 Today s Agenda Protecting Against A Hack How should I start?
Advanced iscsi Management April, 2008
April, 2008 Gene Nagle, istor Networks SNIA Legal Notice The material contained in this tutorial is copyrighted by the SNIA. Member companies and individuals may use this material in presentations and
Lotus Domino Security NSL, Web SSO, Notes ID vault. Collin Murray Program Director, Lotus Domino Product Management
Lotus Domino Security NSL, Web SSO, Notes ID vault Collin Murray Program Director, Lotus Domino Product Management Challenge: Reduce Cost of Ownership IBM Lotus Notes and Domino have been providing a secure
5 MANAGING USER ACCOUNTS AND GROUPS
MANAGING USER ACCOUNTS AND GROUPS.1 Introduction to user accounts Objectives.2 Types of User Accounts.2.1 Local User Account.2.2 Built-in User Account.2.3 Domain User Account.3 User Profile.3.1 Content
Index. Advertisers gleaning /browser information,
13Shea Index.qk 4/3/02 1:25 PM Page 183 Index A Absolute security, xvii Acceptable risk assessing, 6 defined, xvii Access Control defined, xvii granting to files, 54 58 network security and, 24 25 Access
10 FOCUS AREAS FOR BREACH PREVENTION
10 FOCUS AREAS FOR BREACH PREVENTION Keith Turpin Chief Information Security Officer Universal Weather and Aviation Why It Matters Loss of Personally Identifiable Information (PII) Loss of Intellectual
Hunting Lateral Movement with Windows Events Logs. SANS Threat Hunting Summit 2018 Mauricio
Hunting Lateral Movement with Windows Events Logs SANS Threat Hunting Summit 2018 Mauricio Velazco @mvelazco $whoami Peruvian Recovering pentester, threat management lead @mvelazco Derbycon, Bsides, Defcon
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 10 Authenticating Users
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 10 Authenticating Users Learning Objectives Explain why authentication is a critical aspect of network security Explain
Install and Configure Active Directory Domain Services
Active Directory 101 Install and Configure Active Directory Domain Services Sander Berkouwer CTO at SCCT 10-fold Microsoft MVP Active Directory aficionado Daniel Goater Systems Engineer Netwrix Active
Protect Your Application with Secure Coding Practices. Barrie Dempster & Jason Foy JAM306 February 6, 2013
Protect Your Application with Secure Coding Practices Barrie Dempster & Jason Foy JAM306 February 6, 2013 BlackBerry Security Team Approximately 120 people work within the BlackBerry Security Team Security
Operating systems and security - Overview
Operating systems and security - Overview Protection in Operating systems Protected objects Protecting memory, files User authentication, especially passwords Trusted operating systems, security kernels,
Operating systems and security - Overview
Operating systems and security - Overview Protection in Operating systems Protected objects Protecting memory, files User authentication, especially passwords Trusted operating systems, security kernels,
MCSM:Directory2012 MCM:Directory2008 MVP:Enterprise Security Certified Ethical Hacker CISA.
NTLM Ing. Ondřej Ševeček GOPAS a.s. MCSM:Directory2012 MCM:Directory2008 MVP:Enterprise Security Certified Ethical Hacker CISA ondrej@sevecek.com www.sevecek.com GOPAS: info@gopas,cz www.gopas.cz www.facebook.com/p.s.gopas
COMPUTER PASSWORDS POLICY
COMPUTER PASSWORDS POLICY 1.0 PURPOSE This policy describes the requirements for acceptable password selection and maintenance to maximize security of the password and minimize its misuse or theft. Passwords
? Resource. Announcements. Access control. Access control in operating systems. References. u Homework Due today. Next assignment out next week
Announcements Access control John Mitchell u Homework Due today. Next assignment out next week u Graders If interested in working as grader, send email to Anupam u Projects Combine some of the project
Windows Server 2008 Active Directory Resource Kit
Windows Server 2008 Active Directory Resource Kit Stan Reimer, Mike Mulcare, Conan Kezema, Byron Wright w MS AD Team PREVIEW CONTENT This excerpt contains uncorrected manuscript from an upcoming Microsoft