Autumn has come to Sweden. The leaves are turning yellow and red and falling one by one. Looking at the incidents this year, I can\u00b4t help seeing the same pattern among companies.<\/p>\n
They fall one after another, and nearly always for the same reasons. A remote access server without a second factor. Domain admins logging on to every server and workstation, leaving their credentials behind for anyone with Mimikatz to pick up. A service account with a password from 2012 that is member of Domain Admins. Backups reachable from the same network as everything else.<\/p>\n
None of this is new. I have written about most of it on this blog for years. The tier model, PAW, credential hygiene, immutable backups. It is not exotic and it is not expensive compared to an incident. But it requires discipline and it requires changing the way admins work, and that is where it stops.<\/p>\n
So before the winter comes, do an honest check. Can a stolen user password give someone access from internet? Where have your domain admins logged on in the last month? Which service accounts have more rights than they need? Can the backups be deleted by a domain admin?<\/p>\n
If you don\u00b4t like the answers, you know what to do.<\/p>\n
The leaves fall every autumn. Your company doesn\u00b4t have to.<\/p>\n","protected":false},"excerpt":{"rendered":"
Autumn has come to Sweden. The leaves are turning yellow and red and falling one by one. Looking at the incidents this year, I can\u00b4t help seeing the same pattern among companies. They fall one after another, and nearly always for the same reasons. A remote access server without a second factor. Domain admins logging […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4,13],"tags":[55,22,42],"class_list":["post-1221","post","type-post","status-publish","format-standard","hentry","category-security-architecture","category-technology","tag-active-directory","tag-credential-theft","tag-ransomware"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1221","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1221"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1221\/revisions"}],"predecessor-version":[{"id":1249,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1221\/revisions\/1249"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1221"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1221"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1221"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}