goltsev yuriy - Ломать - не строить!
TRANSCRIPT
![Page 1: Goltsev Yuriy - Ломать - не строить!](https://reader035.vdocument.in/reader035/viewer/2022071707/55cc95edbb61eb003d8b45cf/html5/thumbnails/1.jpg)
Ломать - не строить!Юрий Гольцев
@ygoltsev
![Page 2: Goltsev Yuriy - Ломать - не строить!](https://reader035.vdocument.in/reader035/viewer/2022071707/55cc95edbb61eb003d8b45cf/html5/thumbnails/2.jpg)
Intro
![Page 3: Goltsev Yuriy - Ломать - не строить!](https://reader035.vdocument.in/reader035/viewer/2022071707/55cc95edbb61eb003d8b45cf/html5/thumbnails/3.jpg)
Invest in your knowledge of practical information security
![Page 4: Goltsev Yuriy - Ломать - не строить!](https://reader035.vdocument.in/reader035/viewer/2022071707/55cc95edbb61eb003d8b45cf/html5/thumbnails/4.jpg)
Please, don’t order a penetration test until…
![Page 5: Goltsev Yuriy - Ломать - не строить!](https://reader035.vdocument.in/reader035/viewer/2022071707/55cc95edbb61eb003d8b45cf/html5/thumbnails/5.jpg)
My own TOP of security issues, related to internal networks:1. Weak password policy2. Default accounts3. Local accounts/unnecessary privileges4. Windows architecture5. WPAD configuration mismatch6. Antivirus software configuration mismatch7. No network segmentation8. No patch management
![Page 6: Goltsev Yuriy - Ломать - не строить!](https://reader035.vdocument.in/reader035/viewer/2022071707/55cc95edbb61eb003d8b45cf/html5/thumbnails/6.jpg)
Weak password policy
DescriptionEasy to bruteforce
Common TargetsDirectory Service (Active Directory/Lotus Domino/LDAP/Novell/etc)
RecommendationsImplement strong password policy, just follow next rules:- 8 chars (at least)-Lower, upper case-Alpha-Numeric
Check for common passwords once a day (at least)
- Special chars- Change every 60 days
![Page 7: Goltsev Yuriy - Ломать - не строить!](https://reader035.vdocument.in/reader035/viewer/2022071707/55cc95edbb61eb003d8b45cf/html5/thumbnails/7.jpg)
Default accounts
DescriptionEasy to bruteforce
Common TargetsDBs, network devices (routers/printers/etc)
Recommendations-Disable all unused accounts-Set strong password
![Page 8: Goltsev Yuriy - Ломать - не строить!](https://reader035.vdocument.in/reader035/viewer/2022071707/55cc95edbb61eb003d8b45cf/html5/thumbnails/8.jpg)
Local accounts/unnecessary privileges
DescriptionLocal administrator accounts/privileges – is bad
Common TargetsWindows hosts
Recommendations-Disable accounts of local administrators on Windows hosts-Do not use GP to manage accounts of local administrators on Windows hosts
![Page 9: Goltsev Yuriy - Ломать - не строить!](https://reader035.vdocument.in/reader035/viewer/2022071707/55cc95edbb61eb003d8b45cf/html5/thumbnails/9.jpg)
Windows architecture
DescriptionYou can’t prevent it, if you use it
Common TargetsWindows hosts
Recommendations-Follow principle of minimal privileges-Use privileged accounts for administration tasks only-Implement two factor authentication for privileged accounts-Implement patch management
![Page 10: Goltsev Yuriy - Ломать - не строить!](https://reader035.vdocument.in/reader035/viewer/2022071707/55cc95edbb61eb003d8b45cf/html5/thumbnails/10.jpg)
WPAD configuration mismatch
DescriptionVery useful for corporate users if implemented, and for attacker – if not
Common TargetsWindows hosts
RecommendationsDisable WPAD (Web Proxy Auto Discovery) feature if it is not implemented
![Page 11: Goltsev Yuriy - Ломать - не строить!](https://reader035.vdocument.in/reader035/viewer/2022071707/55cc95edbb61eb003d8b45cf/html5/thumbnails/11.jpg)
Antivirus software configuration mismatch
DescriptionAntivirus software can be disable with local admin privileges
Common TargetsWindows hosts
RecommendationsConfigure self defense feature of antivirus software
![Page 12: Goltsev Yuriy - Ломать - не строить!](https://reader035.vdocument.in/reader035/viewer/2022071707/55cc95edbb61eb003d8b45cf/html5/thumbnails/12.jpg)
No network segmentation
DescriptionNo restrictions and no data filtration on network level
Common TargetsNetwork topology
RecommendationsImplement data filtration – it is better to use white lists for access
![Page 13: Goltsev Yuriy - Ломать - не строить!](https://reader035.vdocument.in/reader035/viewer/2022071707/55cc95edbb61eb003d8b45cf/html5/thumbnails/13.jpg)
No patch management
DescriptionMS08-067 still can be found during penetration test
Common TargetsWindows/Unix hosts
RecommendationsImplement patch management
![Page 14: Goltsev Yuriy - Ломать - не строить!](https://reader035.vdocument.in/reader035/viewer/2022071707/55cc95edbb61eb003d8b45cf/html5/thumbnails/14.jpg)
Outro