Hi everyone.
I'm Chris.
And welcome back to my course on Enterprise Security fundamentals.
In this lesson we are going to discuss another common attack method and that is lateral movement and
we are going to discuss about techniques used to restrict lateral movement.
First of all let's get an overview of what lateral movement is lateral movement occurs when an attacker
who has compromised one system is able to compromise another system on the network by using an existing
compromised system as a jump off point.
For example a standard user's workstation is compromised and the attacker runs a tool to extract locally
cached credentials.
One of these set of credentials let's see allows the attacker to gain access to a file server wants
the attacker gain access to a file server or the cache credentials stored on that server might give
them access to a domain controller let's say and that is how lateral movement works.
There are a variety of methods that you can use to restrict lateral movement.
Some of the techniques that can be used to guard against privilege escalation can also be used to reduce
the chances of an attacker to perform a lateral movement.
Techniques that you can use to restrict lateral movement include the following but are not limited to
the first one would be code integrity policies.
And when we talk about code integrity policies what they do is allow you to restrict which applications
and scripts get a run on a computer.
There are a variety of methods that you can use to enforce code in Windows environments including app
blocker policies on pre Windows 10 on preview Windows Server 2006 systems or Windows Defender application
guard and Windows Defender device guard on Windows 10 and Windows Server 2016 systems configured with
the appropriate hardware of course.
By restricting which code can and scripts can run you can restrict the tools that attackers can make
use of to perform a lateral movement.
So let's dig a little bit deeper into this code integrity policies.
So code integrity policies I I'm going to talk about here about code integrity policies that would say
most appropriate to be implemented on servers.
So the first one is to implement the older version as I said pre Windows 10 on premium notes 2016 server
which are up locker and software restriction policies the next one would be to implement Windows Defender
devised guard which is a new feature found in Windows 10 and Windows Server 2016 which allows you to
implement certain application policies that are white listed to run
the best practices would be to only allow on servers specifically what listed code to run.
And this includes both application and scripts.
Ah you go with deny everything and then you start white listing the applications the code and the scripts
that you need to run on your servers to be able to function properly in the environment.
There are policies you can implement to pre approve scripts for example and if the application or code
isn't pre-approved it isn't allowed to run.
Pure and simple and that basically reduces the chances of an attacker let's say running a credential
harvest tool on one of your servers because that wouldn't be on the pre-approved list of applications
allowed to run on that server and it won't just simply it won't run the next one is by implementing
code integrity policies whatever you have in your environment or whatever you might want to choose whether
it's up block or whether it's software restriction policies Windows Defender application guard or Windows
Defender devised guard.
This significantly improves the security posture of your servers for sure and by implementing this policies
on your servers and I'm talking about the servers here because as I highlighted here in the last bullet
it's simpler to configure this policies on servers because there are fewer scripts and applications
that need to be waitlisted compared to a workstation let's say where you would have a large variety
of applications and code that is required to run on a workstation are going back to our list of techniques
used to restrict the lateral movement.
The next one is network segmentation so you can restrict lateral movement by segmenting critical workloads
onto separate networks and villains and then controlling which traffic can cross those boundaries.
Network segmentation allows you to limit which hosts can communicate with sensitive servers.
For example you might to the blocked traffic from workstation on your organization's internal network
to the servers except on the specific ports required by the workstations.
Right.
So you could also configure segmentation through firewalls so that you allow a file server to communicate
with workstations on the ports are required by the file sharing protocol but not allow communication
between the file servers and workstation.
On any other port including let's say those used for administrative activities such as the ports used
by RTP or partial remote Eng or let's say SS each.
You can also segment the network so that sensitive servers can only communicate can only be allowed
to communicate using administrative protocols from a select set of computers that are logged down and
configured as privileged access workstations
The next technique is the following.
No.
Come on account for password.
Thus from my point of view should be a must in every organization.
So basically organizations should avoid common local accounts being created on systems.
This not only includes disabling the built in administrator which by the way is a best practice on all
workstations and servers but instead is using a unique alternative but also ensuring that a common account
isn't added to multiple systems with the same credentials of course.
For example a standard account created across all systems that have specific application installed that
would not be best practice at all.
Also organizations should avoid using a common password for separate accounts.
For example audits of the security configurations of some organizations have found that even though
they create separate customer accounts to be used on services on separate computers those custom accounts
are configured with a single common password.
A red team or an attacker who can determine that password will have an easier time performing lateral
movement than on an attacker or a red team in an environment where every password is complex and unique.
1 best practice would be to implement laps and that is local administrator password solution and lapse
can be used to ensure that the passwords of the local administrator accounts on all computers and servers
in an Active Directory environment have a unique password.
This allows organizations to avoid common trap of having like standard local administrator account password
across all computers in an organization.
The next one on our list is log on script sanitation and what log on script sanitation means is that
log on scripts can often include sensitive information with some log on scripts even including passwords
and clear text.
An attacker that gains access to a computer may have access to any scripts that run on that computer.
As those scripts may be accessible over the network using non privileged credentials log onto scripts
should not contain sensitive information such as account passwords where possible log on scripts should
be replaced by group policy or configuration management tools such as system Center Configuration Manager
or Microsoft Intuit.
The last technique on our list is apply software updates and patches.
Of course attackers will use any technique available to perform lateral movement within an organization
that is a fact.
This includes exploiting vulnerabilities in operating system and applications that have been patched
by the vendor but haven't yet been touched by the organization.
While exploit code exists for some vulnerabilities before those of all abilities are patched by the
vendors exploit code is more commonly available for vulnerabilities after those vulnerabilities are
patched by the vendor.
So this is partly because security researchers and attackers can reverse engineer a software update
to determine what vulnerability.
The software updates addresses and then of course are able to build a tool to exploit that vulnerability
rather than let's say having to discover the vulnerability through their own research.
So organizations should ensure that operating systems applications device drivers and firmware have
all the appropriate software updates applied in a timely manner as this will restrict the attackers
from using known exploits to perform lateral movement.
I will see you in the next lesson guys where we will talk about in a high level of detail about the
attack detection.
I hope this has been informative for you.
And thank you for watching.