Because of the current state of cybersecurity, and to protect the COMPANY networks in Ukraine, I have decided to publish easy to implement and free instructions for protecting Windows environments against an invader. Read the whole thread and if you find it useful à Retweet!
I could tell you that you should remove
end-user admin rights, deploy AppLocker etc. but in reality those are not done
in a matter of days. So these instructions are meant to give fast gains and
real-life effect in defending against cyber-attacks.
At the end of the day, security is simple.
It’s more about correct ways of operating, concepts, than expensive products.
In this thread I’m going through what I would personally do if I was at war and
protections would have to upped to the next level in hours without
disconnecting the systems from the Internet.
The instructions are meant to prevent
losing your biggest treasure – the Directory Service. A few soldiers might be
lost but the directory service will not be compromised. Companies don’t get on
the news by having ransomware on one computer, but by someone controlling the
whole infrastructure and keeping your operations as hostage.
These instructions are simple and apply to
any company that uses a Directory Service (AD/AAD). These could be better by
taking time with the customer and tailoring it for them – but now I aim to
build instructions that work for most if not all.
You can always create better but remember
that “in security, don’t let perfect be the enemy of good”. Now we need to
DEPLOY things FAST so that innocent companies stay safe! There’s no time for
“This is only 99% secure” or “There is probably a way around this”.
We need to make things BETTER, NOW! We can tweak and harden later, when we have the basics deployed.
1. Tier0-isolation. The holy grail of every attacker is a Domain Admin account. So that DA’s can’t be stolen, we block them from being used anywhere else than where they are needed. Link the following policy to every computer except your DC’s.
Since you can’t use DA to manage anything but DC’s, you need to add the following setting to the policy, so that members of ComputerAdmins can manage the other computers.
3. Same for Azure. You can achieve
the same even if settings are not exactly the same. These pics show how I do it
and how I block limited users from accessing the portal.. https://techcommunity.microsoft.com/t5/intune-customer-success/new-settings-available-to-configure-local-user-group-membership/ba-p/3093207
You can later tweak and split your AD into more tiers, deploy PAWs etc. Now the Tier0 isolation is the one you MUST DO NOW!
2. Containing PowerShell. PS is used by almost all malware. It attacks, takes orders and sends precious information to the attacker. So, let’s block it by adding Outbound Firewall Rules to the policy as seen in the pic:
