Hi everyone.
I'm Chris.
Welcome back to my course on security.
Enterprise fundamentals and this lesson and as well in the next one I would like to discuss and talk
to you about some mitigation techniques to restrict some of the well known attack methods.
So in this first one we will talk about a restriction of privilege escalation.
So first of all what is privilege escalation privilege escalation is the process by which an attacker
acquires the ability to perform a greater variety of tasks on an organization's information systems
from those that they were able to perform when they gained an initial beachhead on the network.
An example of privilege escalation would be for the attacker to start with access to the credentials
of a standard user account and use a variety of techniques to end up with local administrator or greater
privileges.
The end goal of privilege escalation is to acquire a full administrative privilege and for example in
an Active Directory environment.
This would be the equivalent of the attacker gaining domain admin privileges restricting privilege escalation
is about limiting the ways in which an attacker can take a compromised unprivileged account.
Methods of reducing the probability of privilege escalation include the following.
So first of all is privilege access workstation the use of privilege access where station or shortly.
Be a W ball now privileged access workstation would be some of the let's see.
Features of the privileged access where station we will enumerate them and talk about each and one of
them.
First of all a privilege access workstation is a computer that is only used to perform administrative
tasks.
This computer has a locked down configuration compared to computers used for day to day activities on
the network.
So as I said some of the characteristics of the polls are the following.
Access is limited to staff that perform administrative tasks so polls are especially locked down computers
that should only be used for administrative tasks.
Both should be able to connect to sensitive servers on your organization's network but should not be
able to browse the internet or perform non administrative tasks such as responding to email and have
an email client install on them.
Administrative accounts used to manage sensitive servers should be configured so that they can only
be used on a privileged access workstation and not on a typical end user computer use for day to day
organizational tasks.
One of the other characteristics of the privileged access workstation is restrictions on software that
can run on the pole.
The software configuration of the ball is hardened Sue that only specifically authorized software it
can run on the ball.
This means that malware that might be deployed on the path to capture lets see the credentials of an
administrator or to elevate privileges will be unable to run because it will not be on the list of applications
or scripts that are specifically authorized for the ball.
Windows Defender devised guard and window defender application control are basically technologies that
you should deploy on pause to control code that can be executed on that computer.
Another characteristic is that they are protected by secure technologies.
Polls will be configured with Secure Boot bit locker and technologies including crew National Guard
which are technologies to harden the machine.
This greatly reduces the chance that malware can take control over the computer during the boot process
for example a credential guard is a technology that protects credentials stored on the computer by storing
them in a special virtualize container that is only accessible to authorised processes within the operating
system credential guard and minimizes the chance of a successful past the hash or pass the ticket attack.
Let's see and if we are still talking about privileged access where station I want to go into a little
greater detail and talk about some of the features of the balls so are the first one would be as we've
as we we discussed earlier they are specifically configured computers for administrative tasks so paused
should have vanilla built on them and applications installed that are only required to perform administrative
tasks and polls should be distributed to only admin stuff and to be used with the administrative account
or with the account that has administrative privileges.
UN system administrator or network administrator or any admin stuff in your organization should have
a separate computer for day to day non admin tasks.
For example like a computer with Outlook installed on it to respond to emails to browse the internet
and any other organizational tasks that may be required on a day to day basis
again the poll also puts the administrator.
The user who uses the portal into the security mindset when used because it's far more likely that when
you use your admin account on a dedicated workstation you have that security mindset in mind.
Lets see you are very careful about what tasks are you doing about what applications are you running
on the pole and things like that.
The latter one is that it allows the application of more stringent the application of more stringent
security policies.
Basically you would as a best practice let's say you would place all of the poor computer accounts in
a separate organizational unit an Active Directory environment and you could apply some strict security
policies on that to you and then the post would be hardened and locked down properly.
Another thing you could do is network segmentation so that admin access to servers is only from the
boss.
So basically you would could segment your network and the only entry point let's see to your server
is states the entire server state would be accessible only from an authorized computer.
So if you would try to I don't know RTP on a server from your to the workstation even using your admin
account you would not have access to to access that server now going gone on our list of methods to
reducing the probability of privilege escalation we discussed about privileged access where station
the next the next one sorry is just enough.
Administration or G8 just an effort.
Administration basically is a feature that allows organization to create special partial end points
that limit which partial command lets functions parameters and values can be used during a connection
to the endpoint.
So rather than having to use specially configured administrator account to perform administrative tasks
just enough administration allows for a standard user account to leverage a special virtual account
when connected to the power shall endpoint just enough administration minimizes the chance of privilege
escalation by allowing standard accounts to perform extremely limited privileged tasks on only when
connected to the specific partial endpoints the next one is just in time administration.
Just in time administration is basically a technology where administrative privileges are provided only
for a limited period of time when not granted administrative privileges accounts only have standard
user privileges.
It is also possible to have those limited the time privileges only granted subject to approval by another
person a line manager for example just in time administration also makes privilege escalation very difficult
because privileges are time limited subject to request and approval where necessary and can be of limited
scope.
So just in time administration can be combined with just enough administration to leverage up all of
these two technologies capabilities and by the way just in time administration is a feature which comes
built in starting from Windows Server 2016 and that is allowing them to add a user to to an active directory
group on a limited time basis so limited time membership to 18 groups
the next one is the restriction on administrative accounts.
So one way of limiting the possibility of privilege escalation is by restricting where administrative
accounts can be used for example only allow administrative accounts for sensitive servers to be used
on polls or those sensitive servers do not allow those accounts to be used to sign on to servers or
workstations that are sensitive.
You can also configure sensitive administrative accounts so that they can only be used at certain times
of the day.
For example in highly security environments administrative accounts can be further limited by implementing
Incheon security administrative environments or shortly.
E s a e forest and this model.
Only accounts with administrative privilege in the production forest our standard user accounts that
are stored basically in a different EDI forest which is called a privileged forest or a bastion forest.
The production forest has a one way trust relationship with a privilege forest and this means that accounts
from the production forest cannot interact with the privilege forest.
An attacker that compromises an account in the production forest cannot elevate privileges as that would
require the ability to create or modify accounts stored in the privileged forest which is impossible
because the privileged forest does not trust the production forest.
So basically it is a one way trust from production to the privileged forest.
Okay guys I will see you in the next lesson where we'll be discussing about our next method of mitigation
of reducing or mitigating the lateral movement attack.
I hope this has been informative for you.
Thank you for watching.