Securing your estate: The First Step


Introduction

A commonly forgotten fact within the cybersecurity industry is that most organizations are not equipped nor have started to form any sort of security program. This is the case for many reasons because most organizations are SMBs so they don't and likely will never have funds to purchase people and technology and the fact that the cybersecurity industry is incredibly toxic for low expertise and or low capability teams as the well of knowledge we all rely on has been poisoned by vendors and 'thought leaders'.

With this in mind, I have created a small resource that will guide you through what you need to do to make a start. This resource won't reference vendors and I will try to avoid specific jargon.


Enumerate

The term 'You can't secure what you don't know' stands strong even to this day and should be your primary focus before you do anything else. Understanding what assets, you have both physically (computer hardware) and logically (applications, services, platforms) will enable you to make decisions like what risks you are exposed to and which are the most severe or where you need to apply security controls. I've included below considerations and advice you should use when tackling this problem.

Internal Assets

Your internal assets are either going to be local to your LAN or spread across the internet regardless they hold a lot of risk as they are primary interfacing points for your users within the business. The first step to enumerating internal assets is to gain an understanding of your network topology and identify choke points in which data from assets flow. For assets local to your LAN this will likely be switches and perimeter firewalls and for assets external to your LAN you will likely find SaaS applications, Corporate VPNs, Directory services (Azure Active Directory) and deployed security technology to be your choke points.

Once you have identified choke points within your network topology, begin documenting what data is available on the assets establishing connections. As an example directory services will likely provide NETBIOS names for your assets and which users are using those assets or where your organization uses a SaaS application you may be able to enumerate where geographically your users exist. Once your data sources are properly articulated you can begin to build an informal image of your estate and from this image you will want to break up your assets into groups, these groups will allow you to focus efforts in the future and reduce management overhead:

  • Critical or "Tier 0" assets. These assets are those that are critical to the function of the business or are used by the majority of your user base. These are often assets that hold financial functions, employee databases, directory servers and file servers.
  • Site Locations - Group assets by their physical location, not only will this enable you to easily identify where you need to deploy resources too but it will allow you to further categorize your assets.
  • Workstations and Servers. These groups are crucial to proper management as they fundamentally exist differently within your estate and therefore have different requirements.
  • Network Devices. Your Switches, Firewalls, Routers, Access Points etc are mostly 'hands-off' infrastructure and as such should be grouped separately.
  • VIP Assets. Unfortunately, certain users can cause more disruption than others when things go wrong so its important their assets are articulated and grouped away from the rest of the inventory. This allows you to make unique decisions when deploying patches or making general security decisions. 
As you progress with your asset inventory and management you can look to collect a plethora of information that will drastically reduce your mean time to resolution when troubleshooting issues. I've collected below a list of data points:

  • Operating system name and version
  • Previously installed operating system updates with date/time
  • Local users
  • Installed Applications
  • Security Software Status
  • Hardware information
  • Network interface information
  • Uptime
  • Critical services health
  • Connected peripherals
  • Storage information
  • Warranty information
When exploring data points to collect from an asset you will want to consider how often do you need that particular data point updated within your inventory. As an example, you will probably want your network adapter information kept much more up-to-date than warranty information. You can use this to reduce the overall noise or load on your infrastructure.

Inventorying your assets needs to be an active perpetual effort and you need to keep in mind its importance as such getting top-down investment from stakeholders is mandatory for any good asset management program. 

People

Unfortunately, it is imperative to understand who your users are, what their roles entail and subsequently what risks they may pose to your estate. This will typically require at least some collaboration with the Human Resources department to create a database of people's names, roles, risk categories and assets assigned to them. Fortunately however if the database doesn't already exist Human Resources will likely be significantly invested in helping you develop one so collaboration is key.

Access Controls

Once you have established your physical and non-physical assets and people you will want to start gaining an understanding of what has access where. This is where your previous work can really shine because with an asset inventory, you can start exploring where business processes exist. Like the prior points this again is a collaborative effort as you need to sit down with all your different teams and just list all the tasks they do. Once you have that list you can start to map out how those tasks correlate to access and then subsequently how you can audit that access. 

If your using Active Directory this is particularly easy as where it applies access controls and how is well documented. Regardless of the technology you just need to gain an understanding of what people have access to and document it accordingly. One way to begin documenting your access controls is to start from the perspective of your data. Begin categorizing all the different data types you have whether it is financial, production or client data and just list next to those data types who has access (there's a feedback loop here into your asset groups). This information is super important for decisions you will most definitely need to make in the future particularly when you begin to look to reduce the level of access people have.


Services

Every organization illicits services from other entities and it's important these are documented as they can often exist isolated from the general business ecosystem. A prime example of this is door maintenance and controls. Most organizations just let door maintenance technicians wander around, install new infrastructure (even little desktops) and in general introduce new risks that are not documented. One of the best ways to capture services your company uses is through the finances team as they should who they are paying money to categorise if they don't look to leverage your previous enumeration work around identities and access controls and question any accounts your not familiar with. This will typically open a huge can of worms because its not something people think about at all.

From my experience support contracts for technologies deployed in the business should be a primary focus here because the users and stakeholders view the third-party support teams as a trusted authority on matters and will happily let them remote onto devices to make changes or hand over credentials without thought. So ensure you enumerate all the support contracts that exist in the business, what work they have done in the past and how they are expected to provide support in the future.


 Networks

Gaining a strong understanding of your network topology with enable you to make informed decisions on a plethora of cybersecurity topics in the future. You will want to develop specific illustrations for these decisions:

  • Architectural overview of how your switches and routing devices direct the flow of traffic
  • Flow Diagram of how traffic from an endpoint reaches the internet
  • Flow Diagram of how traffic from servers reaches the internet
  • Flow Diagram of how traffic from servers reaches endpoints
  • Any North-South (External to Internal) topology (such as VPNs)

        


Quick Wins

  • • Identify and leverage bottlenecks in your network infrastructure to scan for assets across all your IP ranges

 

  • Utilize powershell and Windows Management Instrumentation to collect key data points at scale.

 

  • Integrate your asset management system into business processes such as asset deployment and procurement to avoid unknowns creeping up on you again.

 

  • Group and categorize assets based on defined criteria and use cases for easier management.

 

  • Explore the technology already deployed in your estate for opportunities to collect data.

I'm going to be slowly uploading my enumeration scripts to my GitHub here https://github.com/QueenSquishy. Lots of what I've written here is from many hours of work and problem solving things people said couldn't be done because of the complexity but those that have the motivation will find asset management and general enumeration work very rewarding.










Popular

Endpoint on Adrenaline : One

Image
Introduction   This blog series will capture how to maximise the protection of an endpoint using the various technologies in the Defender suite. The controls outlined in the series will each need to have their own considerations taken into account for a given environment but hopefully at a minimum it will be clear just how powerful of an offering Microsoft has.  Unfortunately due to the highly modular and distinct diversity in controls Microsoft offers things are often overlooked and misconfigured when tests are conducted. With this in mind, the shortest possible route to a solution for this is utilizing the recommendations, CSPM and Secure Score technology contained within Defender 365 and Defender for Cloud as it will automatically conduct posture assessments and inform you of things you have missed and may want to turn on (IE dont take these recommendations lightly) Lastly, I would recommend reading the book “Defender for Endpoint in depth” from packt as it showcases the co...
Read more

Brilliance in the Basics

Image
Introduction Tired of watching you and your friends get compromised, do exactly what's in this blog and start beating adversaries. Avoiding the memes adversaries win because of simple mistakes and neglect and we all already know what they are so I'm going to list them for you. Its all for free too. Enumerate To put it simply, there shouldn't be anything you don't know about your environment, you should know who all your users are, where all your electronic devices are and what they do, what applications you have and what versions they are. Enumeration is the jet fuel for making good defensive decisions. I wrote about how to enumerate your environment here  Securing your estate: The First Step (goblinloot.net) . Follow these steps and become the arbitrator of your own environment  Your perimeter is a bridge, not a wall Monitor your perimeter as best as you can but always assume it has already been defeated. Monitor endpoint system and process telemetry and southwest traf...
Read more

Investigate

Image
  Introduction This document details how an analyst should conduct investigations and triage in the normal duties of their job. It will describe concepts and logic that enable analysts to look at data, ask investigative questions, evaluate those questions and arrive at assertions about what they have found. An Alert For the most part, analysts begin their investigative work when an alert is generated. Alerts are fantastic because they are a statement that something has happened and something needs to be done about it. Typically alerts are filled with information that an analyst can then use in their investigation. Alerts are generated by detections and these detections can come in many shapes and sizes. Some just look for a particular action like someone unlocking their car door, others might have access to more context like someone who isn’t the owner of the car unlocking the door. Going even further some detections might look at how the car door was opened or at w...
Read more

Endpoint on Adrenaline 3

Image
Introduction Now that I have covered the advanced features obtained from Defender for Cloud and the complexities of Defender for Endpoint with the objective of delivering as much protection as possible to the endpoint, I will now explore how to expand on this greatly and open up even more use cases. Microsoft Sentinel This technology will allow us to unify and correlate data generated by other controls. I have decided to deploy Microsoft Sentinel into 4 primary categories : System Administrator - Asset Uptime, Application Inventory, Device configuration and Troubleshooting Network Engineers - Netflow and session traffic, violations and alerts for potential issues Threat Detection - Analytics and playbooks Threat hunting - Workbooks & Machine learning Using Microsoft Sentinel we can achieve a plethora of incredibly powerful use cases with Defender 365 endpoint data. Below is an illustration of how my SIEM works to enable analysts to prevent and detect threats Data Sources In order t...
Read more

Writing detections when stuck with EDR

Image
Introduction Making the leap to purchasing and maintaining an EDR solution can be huge for organisations so huge in fact that they never really progress from there when it comes to visibility on assets. This is an important consideration because organisations should aim to achieve some level of detection engineering but will likely never get to explore the associated complexities. So how can organisations effectively and easily write detections that actually help to protect them when they are only able to leverage an EDR tool. Understanding your tools limitations To most people EDR tools are incredibly verbose in the telemetry they capture from any given asset but unfortunately relative to overall telemetry available they actually only capture what the vendors think is the most pertinent. This is for obvious reasons because ingesting telemetry at the scale vendors do comes at a significant cost so they implement "cost-saving measures" like limiting the amount of any one given...
Read more

Endpoint on Adrenaline Two

Image
Introduction Continuing on from my last post that captured using Defender for Cloud to gain powerful additional features on top of defender for endpoint to protect your endpoints we are going to take a closer look at Defender for Endpoint itself and extend into some endpoint-specific use cases for Defender for Identity that tie directly back into Defender for Endpoint. Firstly a really important consideration when configuring Defender for Endpoint is that alot of the heavy lifting from a prevention standpoint actually happens in Defender Anti virus. This means that while im going to briefly cover some settings to make sure Defender Anti Virus isnt hindering Defender for Endpoint im going to reserve further Defender Anti Virus controls to the next part in this series. This also of course means that when your doing your own testing just installing the MSSense agent (What you get from the scripts, intune etc) is actually not Defender for Endpoint in its totality so you simply can not m...
Read more

Why you need to be purple!

Image
 It's Bad For those who have worked with me for longer periods, you would have heard me say at least once that I don't believe in the commonly prescribed structure of blue and red team operations as much as there are good intentions behind the separation of operations, human behaviour has prevailed and there exists a quite toxic environment between the two (wrongly opposing) sides. This is a direct contradiction to  our purpose in cybersecurity which is to harden environments and increase resiliency to cyber-attacks. We need to change While purple teaming was not created to replace blue and red operations I have adopted it to do exactly that. Too often I experience clashes between red team operators and defenders whether its online shouting contests or during client engagements behaviour that does not support the iterative improvement of cybersecurity is simply not welcome. Particularly SOC analysts will know this as they will have experienced their fair share of red team en...
Read more

Standardized Note Taking Format For Analysts

Image
  Introduction This post outlines a format for note-taking designed to aid analysts and ensure the knowledge they acquire over time is kept so that it can easily be consumed later. This format is designed to be technology agnostic so it can be applied to a note-taking tool or platform of the analyst’s choice. I designed this format because analysts often received what you could call unplanned information whereby at any given moment during their day they could learn something highly impactful to their role via any medium. This really exasperates the need for good note-taking practices for analysts. Illustrated above is the wireframe that analysts can implement into their note-taking platforms. Each section contains sub-sections that allow for different knowledge to remain segregated and more searchable. Meeting Notes Within any given week analysts can have countless meetings and so it is important to note down items from meetings for future review. Not every meeting needs to be ...
Read more

Investigate Two

Image
Introductions How you as an analyst handle true positives is life and death in the eyes of potential victims. Traditionally the industry elected to prioritize overzealousness and sending more than not to cover their failings, This however is no different to guesses and it is possible to arrive at strong data-backed decisions on events that could be the compromise of an estate True Positive True positives exist at the heart of all our jobs, they are what we wake up for in the morning and why we endlessly pursue understanding how to protect our clients. The strictest possible definition of true positive is where an outcome of a prediction or model is returned true. This broad definition is important because the assumption carried with a predication or model can change. As an example many security technologies aim to identify when an application often unwanted by an organization is present within a system, these are commonly dubbed PUPs. (Potentially Unwanted Programs). The general cons...
Read more