Glory to Ukrain!

Because of the current state of cybersecurity, and to protect the COMPANY networks in Ukraine, I have decided to publish easy to implement and free instructions for protecting Windows environments against an invader. Read the whole thread and if you find it useful à Retweet!

I could tell you that you should remove end-user admin rights, deploy AppLocker etc. but in reality those are not done in a matter of days. So these instructions are meant to give fast gains and real-life effect in defending against cyber-attacks.

At the end of the day, security is simple. It’s more about correct ways of operating, concepts, than expensive products. In this thread I’m going through what I would personally do if I was at war and protections would have to upped to the next level in hours without disconnecting the systems from the Internet.

The instructions are meant to prevent losing your biggest treasure – the Directory Service. A few soldiers might be lost but the directory service will not be compromised. Companies don’t get on the news by having ransomware on one computer, but by someone controlling the whole infrastructure and keeping your operations as hostage.

These instructions are simple and apply to any company that uses a Directory Service (AD/AAD). These could be better by taking time with the customer and tailoring it for them – but now I aim to build instructions that work for most if not all.

You can always create better but remember that “in security, don’t let perfect be the enemy of good”. Now we need to DEPLOY things FAST so that innocent companies stay safe! There’s no time for “This is only 99% secure” or “There is probably a way around this”.

We need to make things BETTER, NOW! We can tweak and harden later, when we have the basics deployed.

1. Tier0-isolation. The holy grail of every attacker is a Domain Admin account. So that DA’s can’t be stolen, we block them from being used anywhere else than where they are needed. Link the following policy to every computer except your DC’s.

      Since you can’t use DA to manage anything but DC’s, you need to add the following setting to the policy, so that members of ComputerAdmins can manage the other computers.

3.     Same for Azure. You can achieve the same even if settings are not exactly the same. These pics show how I do it and how I block limited users from accessing the portal.. https://techcommunity.microsoft.com/t5/intune-customer-success/new-settings-available-to-configure-local-user-group-membership/ba-p/3093207

You can later tweak and split your AD into more tiers, deploy PAWs etc. Now the Tier0 isolation is the one you MUST DO NOW!

2. Containing PowerShell. PS is used by almost all malware. It attacks, takes orders and sends precious information to the attacker. So, let’s block it by adding Outbound Firewall Rules to the policy as seen in the pic:

3. UAC-settings in order. If you have computers that are logged in by admins, add this UAC setting to the policy. If you don’t, GREAT, your mitigating 80% of attacks!

4. Least Privilege. If you logon to your computer with an admin account at home or work, STOP RIGHT NOW! Your computer works better, longer and with less reinstallations. Even your SSD will last longer! 

Create yourself a separate Admin account and drop your current to a Limited user. If you have a fingerprint reader, register your index finger for your limited user and your middle finger for your admin. From now on you use your Admin-finger only when UAC requests elevation or to wave at Putin! 

5. Start to deploy the Privileged Access Workstation concept. Don’t surf the web and read email from a computer that can take down your network, like connecting with RDP to your DCs. Later you’ll do it cool with VMs but for now just operate safe. 

6. Use MFA everywhere. If you have servers that accept RDP, protect them with for example Cisco DUO. Do the same for the computers you use to manage your services. If you don’t need RDP, block it!

REMEMBER “In security, don’t let perfect be the enemy of good”. We can tweak, harden and play smart later – Let’s DO THIS NOW! 

I would recommend everyone to read Mikko Hyppönen’s book “Internet”, but it’s currently encrypted in Elvish: https://www.wsoy.fi/kirja/mikko-hypponen/internet/9789510464410

I originally first wrote this for the Finnish audience to protect my own country in the war times but the real aim was to publish this for the Ukranian companies, which I did earlier today. Against the norm, I finally translated this to English as the last language. My future content will be in one of these languages, let's see ;) 

Thanks for reading, stay safe – Glory to Ukraine!