Hello and welcome to
part two of our Valent accounts
discussion, so let's go ahead
and pick up where we left off.
So a lot of these things, if
you've been in the industry and
you work in a security type
field, will be nothing
new to you.
But it is worth reiterating
the importance of the simple
controls and overall
mitigating risk based on this
particular vector.
So enforce password policies
that require complex and unique
passwords across all
systems.
So if you've got network
infrastructure and let's
say you've got three or four
switches, a firewall, you've
got maybe you do need a router
and you've got a router in place and
some DVRs, let's just
say that you've got a sprawl
of different things that are out
there.
It would be convenient
to have one administrative account
that's created across all of those
systems with a very complex
password.
That's better than nothing.
Right. But
it would be ideal
to create a separate
administrative account, even if it's
admin is the same, create
a complex and unique password across
each of those systems, because if a
threat actor for some reason is able
to gain access to
a system, if they're able to figure
out the password or they're able to
intercept the password because
something was sent in, clear text or
whatever the case may be,
they would only have access to that
one system that can still cause
trouble.
But it's not the same as being able
to get into every every system
when possible, implement multi
factor authentication.
This is just a general statement
here. It's been found that this
greatly reduces the risk of account
compromised. There's a number of
case studies, as well as incidents
that have been reported over the
years where organizations
don't implement dual factors,
indication, and it's something that
they could do.
It's also
pertinent that if you're banking
with a certain organization, even
if you've got just a general,
you know, bill pay account for like
your phone or whatever the case may
be, if you have the opportunity
to implement multi factor
authentication, I would always
say that it's worth doing, even
though we've seen over the last year
that threat actors are finding ways
to bypass multifactor authentication
again, path of least resistance if
it takes that much longer to
compromise an account, because multi
factors in place if we
can avoid a
threat actor easily getting in or
maybe they decide to move on to an
easier target, then that helps
to reduce overall risk,
ensuring that default accounts are
noted and changed on all network and
user systems.
So I've done
again a number of network
assessments and things of that
nature. And when you walk into
an organization, one of the first
things that we do is a scan of the
network. You find out what assets
are out there, you find out what's
talking, talking back,
and then if you can get
a default web pages or
interfaces or things of that nature,
the first thing you do is go to
Google and say, hey,
I've got this network switch,
this Dell device, I've got this
Cisco device, I've got this wireless
device, I've got this controller,
I've got this DVR.
What's the default password?
And we find almost
in every instance
that some system has been
overlooked and default credentials
have been left in place.
And if that system were to be
changed, if it were to be
compromised, if it were to be
just wiped out and rebooted,
that can cause issues for an
organization and it can make it very
difficult to maybe
pinpoint where that device is at,
properly review privileges and
standard user accounts on a regular
basis. Now we get caught
up in the day to day mundane
activities, but in this case
it makes sense.
Again, we looked at organizations
having upwards of a thousand Stael
accounts.
It makes sense once a quarter
at a minimum to review
those accounts and disable those
and put them in the proper
you or organization unit and active
directory, if that's what you're
using and kind
of document where things are at.
That helps with just keeping
track of systems.
If you use some type of solution,
it makes it easier to see what is
legitimate activity and what is not.
And so let's go ahead and with that
look at detection activities,
because that's what we're starting
to touch on here.
So implement
a system that can alert on
suspicious behaviors
and provide you, of course,
with feedback.
And so that's important because
let's say that we're looking at
login activity in Europe
and in the US and
that activity is from the same user
at the same time.
Well, I mean, that
is what I would consider not
possible. I mean, as much as I'd
like to be.
Can't be in two places at once,
and so in this case,
implementing some form of account
monitoring, being able to review
account states on a regular basis,
being able to
track that activity back to legit
administrative either activity or
general user activity
is going to be beneficial in
detecting threat actors as
soon as possible and ensuring that
you could stop a compromise
potentially or at least reduce its
impact.
So with that, let's go ahead and do
a quick check on learnin.
So I've got a softball question
for you today.
True or false, a default account
is considered a valid account
based on what we reviewed today.
Based on Modder, a
default account is considered
in the category of valid account.
All right, so if you need
any more time, please go ahead and
pause the video.
So a default account is one
of the categories of account types
that would be considered valid
in the minor framework.
So this is true.
So if you missed that, just go back
and check out our definition area
and give them a look.
So let's go ahead and jump over to
the summary for today's discussion.
So we reviewed what
is or are valid accounts
and we talked about types of
accounts. So we talked about local
versus domain versus default.
We reviewed statistics.
And the association of those
statistics with the ballot account
areas that we talked about, Stanley
counts and compromises
and things of that nature that
happen with these account types,
we reviewed mitigation activities
and some best practices that you can
go through there.
Some of this reiterating things that
you already know.
But it's always worth mentioning
that sometimes it's best to go back
to the basics and implement the
simple things.
And then we reviewed some detection
activities at a high level, again,
being able to review account
activity and tie it back to
legitimate user activity,
being able to have geolocation
information,
seeing what systems
the users logged into, what times
is definitely a way that we can
kind of stop attackers in their
tracks and at least minimize
the amount of damage that they can
do. So with that in mind, I
want to thank you for your time
today, and I look forward to seeing
you again soon.