Red vs. Blue: Modern Active Directory Attacks, Detection, & Protection
|
|
|
- Andrew Porter
- 8 years ago
- Views:
Transcription
1 Red vs. Blue: Modern Active Directory Attacks, Detection, & Protection Sean Metcalf CTO, DAn Solutions sean dansolutions _._com
2 ABOUT Chief Technology Officer - DAn Solutions Microsoft Certified Master (MCM) Directory Services Security Researcher / Purple Team Security Info -> ADSecurity.org
3 AGENDA Red Team (Recon, Escalate, Persist) Blue Team (Detect, Mitigate, Prevent)
4 Perimeter Defenses Are Easily Bypassed
5 Assume Breach Means: Layered Defense
6 Kerberos TGT Ticket
7 Kerberos Overview
8 Red Team (Offense)
9 Attacker Goals Data Access Exfiltration Persistence Privilege escalation if needed
10 PowerShell Overview Dave Kennedy: Bash for Windows Available by default in supported Windows versions v2: Win 7 / Win 2k8R2 v3: Win 8 / Win 2012 v4: Win 8.1 / Win 2012R2 v5: Win 10 / Win 2016 PowerShell.exe only an entry point into PowerShell Leverages.Net Framework Provides access to WMI & COM Microsoft binary = whitelisted Download & run code in memory
11 PowerShell Weaponized PowerSploit Nishang Veil PowerView PowerUp Cobalt Strike Beacon
12 SPN Scanning Service Discovery SQL servers, instances, ports, etc. MSSQLSvc/adsmsSQLAP01.adsecurity.org:1433 Exchange Client Access Servers RDP exchangemdb/adsmsexcas01.adsecurity.org TERMSERV/adsmsEXCAS01.adsecurity.org WSMan/WinRM/PS Remoting WSMAN/adsmsEXCAS01.adsecurity.org Hyper-V Host Microsoft Virtual Console Service/adsmsHV01.adsecurity.org VMWare VCenter STS/adsmsVC01.adsecurity.org
13 SPN Scanning for MS SQL Servers with Discover-PSMSSQLServers
14 Getting Domain Admin in Active Directory Poor Service Account Passwords Passwords in SYSVOL Credential Theft Misconfiguration / Incorrect Perms Exploit Vulnerability
15 SPN Scanning for Service Accounts with Find-PSServiceAccounts SPN Directory:
16 Cracking Service Account Passwords (Kerberoast) Request/Save TGS service tickets & crack offline. Kerberoast python-based TGS password cracker. No elevated rights required. No traffic sent to target.
17 Kerberoast: Request TGS Service Ticket
18 Kerberoast: Save & Crack TGS Service Ticket
19 Group Policy Preferences Credential Storage The private key is publicly available on MSDN
20 Exploiting Group Policy Preferences \\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\
21 The GPP Credential Vulnerability Fix? 5/13/2014: MS (KB ) Install on all systems with RSAT Passwords are not removed from SYSVOL
22 Pivoting with Local Admin Using GPP Credentials Connect to other computers using ADSAdmin account Compromise Local Admin creds = Admin rights on all Always RID 500 doesn t matter if renamed. Mimikatz for more credentials!
23 Mimikatz: The Credential Multi-tool Dump credentials Windows protected memory (LSASS). * Active Directory Domain Controller database. * Dump Kerberos tickets for all users. * for current user. Credential Injection Password hash (pass-the-hash) Kerberos ticket (pass-the-ticket) Generate Silver and/or Golden tickets And so much more!
24 Dump Credentials with Mimikatz User Service Account
25 Kerberos Unconstrained Delegation
26 Kerberos Unconstrained Delegation
27 Discover Servers Configured with Delegation
28
29 Exploiting Kerberos Delegation
30 Dumping AD Domain Credentials Dump credentials on DC (local or remote). Run Mimikatz (WCE, etc) on DC. Invoke-Mimikatz on DC via PS Remoting. Get access to the NTDS.dit file & extract data. Copy AD database from remote DC. Grab AD database copy from backup. Get Virtual DC data.
31 Dump AD Credentials with Mimikatz
32 Dump LSASS Process Memory 32
33 Remotely Grab the DIT! 33
34 Instead of VSS, why not leverage NTDSUtil?
35 Finding NTDS.dit on the Network Are your DC backups properly secured? Domain Controller storage? Who administers the virtual server hosting virtual DCs? Are your VMWare/Hyper-V host admins considered Domain Admins? Hint: They should be. 35
36 Dump Password Hashes from NTDS.dit
37 MS14-068: (Microsoft) Kerberos Vulnerability MS (CVE ) Patch released 11/18/2014 Domain Controller Kerberos Service (KDC) didn t correctly validate the PAC checksum. Effectively re-write user ticket to be a Domain Admin. Own AD in 5 minutes
38 MS (PyKEK 12/5/2014)
39 MS Kekeo Exploit 39
40 MS Kekeo Exploit Packet Capture 40
41 User to Admin in 5 Minutes?
42 Forging Kerberos Golden/Silver Tickets Requires specific password hash. Forged TGT (Golden Ticket) bypasses all user restrictions. Create anywhere & use from any computer on the network. No elevated rights required to create/use. User password changes have no impact on forged ticket!
43 KRBTGT: The Kerberos Service Account
44 Golden Ticket (Forged TGT) Communication
45 Golden Ticket Limitation Admin rights limited to current domain. Doesn t work across trusts unless in EA domain.
46 Golden Ticket More Golden! Mimikatz now supports SID History in Golden Tickets
47 Silver Ticket (Forged TGS) Communication
48 Silver Ticket: Domain Controller Exploitation Attacker dumped AD & has all domain creds. Corp IT changed all user, admin, and service account passwords (and KRBTGT pw 2x). Attacker still has Domain Controller computer account password hashes. What is possible with these?
49 Silver Ticket: Domain Controller Exploitation
50 Silver Ticket: Domain Controller Exploitation
51 Silver Ticket: Domain Controller Exploitation
52 Silver Ticket: Domain Controller Exploitation
53 Silver Ticket: Domain Controller Exploitation
54 Blue Team (Defense)
55 GPP Honeypot XML Permission Denied Checks Place xml file in SYSVOL & set Everyone:Deny Audit Access Denied errors Credential Honeypot Place xml file in SYSVOL with false credentials. Configure GPP cred failed logon auditing. GPO doesn t exist, no legit reason for access.
56 PowerShell Attack Detection Log all PowerShell activity Interesting Activity: Invoke-Expression (and derivatives: iex ).Net Web Client download. BITS activity Scheduled Tasks PowerShell Remoting (WinRM)
57 Detecting Forged Kerberos Golden (TGT) & Silver (TGS) Tickets Normal, valid account logon event data structure: Security ID: DOMAIN\AccountID Account Name: AccountID Account Domain: DOMAIN Golden & Silver Ticket events may have one of these issues: The Account Domain field is blank when it should contain DOMAIN. The Account Domain field is DOMAIN FQDN when it should contain DOMAIN. The Account Domain field contains eo.oe.kiwi :)
58 PowerShell Security Recommendations Limit PowerShell Remoting (WinRM). Audit/block PowerShell script execution via AppLocker. PowerShell v3+: Enable PowerShell Module logging (via GPO). Leverage Metering for PowerShell usage trend analysis. JoeUser ran PowerShell on 10 computers today? Track PowerShell Remoting Usage Deploy PowerShell v5 and implement system-wide transcripts
59 PowerShell v5 Security Enhancements System-wide transcripts Script block logging Constrained PowerShell Antimalware Integration (Win 10)
60 PowerShell v5 Security: Script Block Logging
61 PowerShell v5 Security: System-Wide Transcripts
62 PowerShell v5 Security: Constrained PowerShell
63 PowerShell v5 Security: Antimalware Integration
64 Mitigation Level One (Low) Minimize the groups (& users) with DC admin/logon rights Separate user & admin accounts (JoeUser & AdminJoeUser) No user accounts in admin groups Set all admin accounts to sensitive & cannot be delegated Deploy Security Back-port patch (KB ) which adds local SIDs & enable regkey to prevent clear-text pw in LSASS. Set GPO to prevent local accounts from connecting over network to computers (easy with KB ). Use long, complex (>25 characters) passwords for SAs. Delete (or secure) GPP policies and files with creds. Patch server image (and servers) before running DCPromo Implement RDP Restricted Admin mode
65 Mitigation Level Two (Moderate) Microsoft LAPS (or similar) to randomize computer local admin account passwords. Service Accounts (SAs): Leverage (Group) Managed Service Accounts. Implement Fine-Grained Password Policies (DFL >2008). Limit SAs to systems of the same security level, not shared between workstations & servers (for example). Remove Windows 2003 from the network. Separate Admin workstations for administrators (locked-down & no internet). PowerShell logging
66 Mitigation Level Three ( It s Complicated ) Number of Domain Admins = 0 Complete separation of administration ADAs use SmartCard auth w/ rotating pw ADAs never logon to other security tiers. ADAs should only logon to a DC (or admin workstation or server). Time-based, temporary group membership. No Domain Admin service accounts running on non-dcs. Disable default local admin account & delete all other local accounts. Implement network segmentation. CMD Process logging & enhancement (KB ). New Admin Model
67 Next Generation Attack Detection Microsoft Advanced Threat Analytics (ATA, formerly Aorato) Monitors all network traffic to Domain Controllers Baselines normal activity for each user (computers, resources, etc) Alerts on suspicious activity by user Natively detects recon & attack activity without writing rules 67
68 Microsoft Advanced Threat Analytics (ATA) ATA Detection Capability: Credential theft & use: Pass the hash, Pass the ticket, Over-Pass the hash, etc MS exploits Golden Ticket usage DNS Reconnaissance Password brute forcing Domain Controller Skeleton Key Malware
69 Microsoft Advanced Threat Analytics (ATA)
70 ATA Detection: Suspicious Activity
71 ATA Detection: Credential Theft Pass the Hash
72 ATA Detection: Credential Theft Pass the Ticket
73 ATA Detection: Credential Theft OverPass the Hash
74 ATA Detection: MS Exploit
75 ATA Detection: Golden Ticket
76 ATA Detection: Skeleton Key
77 Credential Theft Protection (Future)
78 Additional Mitigations Monitor scheduled tasks on sensitive systems (DCs, etc) Block internet access to DCs & servers. Monitor security event logs on all servers for known forged Kerberos & backup events. Include computer account password changes as part of domain-wide password change scenario (set to 1 day) Change the KRBTGT account password (twice) every year & when an AD admin leaves. Incorporate Threat Intelligence in your process and model defenses against real, current threats.
79 Summary Attackers will get code running on a target network. The extent of attacker access is based on defensive posture. Advanced attacks with forged tickets can be detected. Protect AD Admins or a full domain compromise is likely! My research into AD attack, defense, & detection is ongoing. This is only the beginning
80 Thanks! Alva Skip Duckwall Benjamin Delpy Chris Campbell Joe Bialek Matt Graeber Rob Fuller Will The Microsoft ATA Product Team (Tal, Michael, & Idan) Many others in the security community! My wife & family for putting up with me being on the computer every night!
81 Contact sean dansolutions. com Blog: Github:
82
Red vs. Blue: Modern Active Directory Attacks, Detection, & Protection
Red vs. Blue: Modern Active Directory Attacks, Detection, & Protection Sean Metcalf (@PyroTek3) CTO, DAn Solutions sean [@] dansolutions _._com DAnSolutions.com ADSecurity.org ABOUT Chief Technology Officer
Agenda. Red Team Difference to a Pen Test Common RT Techniques Blue Team
Red Teaming Agenda Red Team Difference to a Pen Test Common RT Techniques Blue Team Disclaimer Red Teaming is a contentious term with no set definition Conceptions vary and can be situated on a scale from
Red vs. Blue: Modern Active Directory Attacks, Detection, and Protection Whitepaper
Red vs. Blue: Modern Active Directory Attacks, Detection, and Protection Whitepaper Author: Sean Metcalf CTO Dan Solutions, Inc. sean@dansolutions.com www.dansolutions.com ADSecurity.org Contents Introduction...
Michael Mayer-Gishyan NSA IT Consulting e.u. @mike_srv02 mmg@nsa.co.at http://nsa.co.at. From Zero to Hero. Domain Admin in einem Tag
Michael Mayer-Gishyan NSA IT Consulting e.u. @mike_srv02 mmg@nsa.co.at http://nsa.co.at From Zero to Hero Domain Admin in einem Tag Agenda Vita Introduction to NTLM and Kerberos Pass-the-Hash Techniques
Pass-the-Hash II: Admin s Revenge. Skip Duckwall & Chris Campbell
Pass-the-Hash II: Admin s Revenge Skip Duckwall & Chris Campbell Do you know who I am? Skip Co-presented PTH talk last year at BH, Derbycon http://passing-the-hash.blogspot.com @passingthehash on twitter
Who DIT It? Detecting and Mitigating Privilege Escalation Attacks on the Active Directory Data Store
Who DIT It? Detecting and Mitigating Privilege Escalation Attacks on the Active Directory Data Store Mike Middleton Justin Prosco Mandiant, A FireEye Company Mike Middleton Principal Consultant Joined
Penetration Testing Report Client: Business Solutions June 15 th 2015
Penetration Testing Report Client: Business Solutions June 15 th 2015 Acumen Innovations 80 S.W 8 th St Suite 2000 Miami, FL 33130 United States of America Tel: 1-888-995-7803 Email: info@acumen-innovations.com
Internal Penetration Test
Internal Penetration Test Agenda Time Agenda Item 10:00 10:15 Introduction 10:15 12:15 Seminar: Web Application Penetration Test 12:15 12:30 Break 12:30 13:30 Seminar: Social Engineering Test 13:30 15:00
TAKING SECURITY TESTING TO THE NEXT LEVEL 5 MAY 2014 STAN HEGT
+ = TAKING SECURITY TESTING TO THE NEXT LEVEL 5 MAY 2014 STAN HEGT HAVE YOU EVER ENCOUNTERED AN ADVERSARY THAT RAN NESSUS FROM A MEETING ROOM? PENETRATION TESTING vs RED TEAMING Penetration Testing Red
RSA Security Anatomy of an Attack Lessons learned
RSA Security Anatomy of an Attack Lessons learned Malcolm Dundas Account Executive John Hurley Senior Technology Consultant 1 Agenda Advanced Enterprise/ Threats The RSA Breach A chronology of the attack
Protecting Your Organisation from Targeted Cyber Intrusion
Protecting Your Organisation from Targeted Cyber Intrusion How the 35 mitigations against targeted cyber intrusion published by Defence Signals Directorate can be implemented on the Microsoft technology
Windows Attack - Gain Enterprise Admin Privileges in 5 Minutes
Windows Attack - Gain Enterprise Admin Privileges in 5 Minutes Compass Security AG, Daniel Stirnimann Compass Security AG Glärnischstrasse 7 Postfach 1628 CH-8640 Rapperswil Tel +41 55-214 41 60 Fax +41
Microsoft. Jump Start. M11: Implementing Active Directory Domain Services
Microsoft Jump Start M11: Implementing Active Directory Domain Services Rick Claus Technical Evangelist Microsoft Ed Liberman Technical Trainer Train Signal Jump Start Target Agenda Day One Day 1 Day 2
WATCHING THE WATCHDOG: PROTECTING KERBEROS AUTHENTICATION WITH NETWORK MONITORING
WATCHING THE WATCHDOG: PROTECTING KERBEROS AUTHENTICATION WITH NETWORK MONITORING Authors: Tal Be ery, Sr. Security Research Manager, Microsoft Michael Cherny, Sr. Security Researcher, Microsoft November
Penetration Test Report
Penetration Test Report MegaCorp One August 10 th, 2013 Offensive Security Services, LLC 19706 One Norman Blvd. Suite B #253 Cornelius, NC 28031 United States of America Tel: 1-402-608-1337 Fax: 1-704-625-3787
How to Efficiently Protect Active Directory from Credential Theft & Large Scale Compromise
How to Efficiently Protect Active Directory from Credential Theft & Large Scale Compromise An Approach Based on Real-World Expertise Friedwart Kuhn, fkuhn@ernw.de Digital unterschrieben von Friedwart Kuhn
mimikatz 2.0 Benjamin DELPY `gentilkiwi`
mimikatz 2.0 Benjamin DELPY `gentilkiwi` Our little story `whoami`, why am I doing this? mimikatz 2.0 & sekurlsa Focus on Windows 8.1 et 2012r2 Kerberos & strong authentication Questions / Answers And
Managing Local Administrator Passwords with LAPS 10/14/2015 PENN STATE SECURITY CONFERENCE
Managing Local Administrator Passwords with LAPS 2015 PENN STATE SECURITY CONFERENCE DAN BARR DRB45@PSU.EDU SYSTEMS ADMINISTRATOR, APPLIED RESEARCH LABORATORY The Shared Password Threat Shared passwords
NASA Consolidated Active Directory Overview ( August 20, 2012 ) Les Chafin Infrastructure Engineering HPES
NASA Consolidated Active Directory Overview ( August 20, 2012 ) Les Chafin Infrastructure Engineering HPES Introduction Les Chafin; Infrastructure Engineering Manager» HPES NASA ACES Responsible for:»
Why You Need to Detect More Than PtH. Matt Hathaway, Senior Product Manager, Rapid7 Jeff Myers, Lead Software Engineer, Rapid7
Why You Need to Detect More Than PtH Matt Hathaway, Senior Product Manager, Rapid7 Jeff Myers, Lead Software Engineer, Rapid7 Who We Are! Matt Hathaway Senior Product Manager for Rapid7 UserInsight Former
Information Assurance Directorate
National Security Agency/Central Security Service Information Assurance Directorate Reducing the Effectiveness of Pass-the-Hash November 19, 2013 Revision 1 A product of the Network Components and Applications
WHY ATTACKER TOOLSETS DO WHAT THEY DO
WHY ATTACKER TOOLSETS DO WHAT THEY DO (or.. Reasons they just keep working ) Matt McCormack OVER THE LAST YEAR 50+ engagements Good chunk of different verticals, industries, etc. Varying qualities and
Secret Server Qualys Integration Guide
Secret Server Qualys Integration Guide Table of Contents Secret Server and Qualys Cloud Platform... 2 Authenticated vs. Unauthenticated Scanning... 2 What are the Advantages?... 2 Integrating Secret Server
PowerShell for Penetration Testers
Training: PowerShell for Penetration Testers Dates of the training: March 14-15,2016 in Heidelberg, Germany Book Now using the code: TR16HMTRAINING and save an additional 10% of the current valid rate!
Penetration Testing with Kali Linux
Penetration Testing with Kali Linux PWK Copyright 2014 Offensive Security Ltd. All rights reserved. Page 1 of 11 All rights reserved to Offensive Security, 2014 No part of this publication, in whole or
User Guide. Version R91. English
AuthAnvil User Guide Version R91 English August 25, 2015 Agreement The purchase and use of all Software and Services is subject to the Agreement as defined in Kaseya s Click-Accept EULATOS as updated from
WordPress Security Scan Configuration
WordPress Security Scan Configuration To configure the - WordPress Security Scan - plugin in your WordPress driven Blog, login to WordPress as administrator, by simply entering the url_of_your_website/wp-admin
MS 6419 Configuring, Managing and Maintaining Windows Server 2008-based Servers
MS 6419 Configuring, Managing and Maintaining Windows Server 2008-based Servers Description: Days: 5 Prerequisites: This five-day instructor-led course provides students with the knowledge and skills that
Virtualization System Security
Virtualization System Security Bryan Williams, IBM X-Force Advanced Research Tom Cross, Manager, IBM X-Force Security Strategy 2009 IBM Corporation Overview Vulnerability disclosure analysis Vulnerability
How to monitor AD security with MOM
How to monitor AD security with MOM A article about monitor Active Directory security with Microsoft Operations Manager 2005 Anders Bengtsson, MCSE http://www.momresources.org November 2006 (1) Table of
Click Studios. Passwordstate. Password Discovery, Reset and Validation. Requirements
Passwordstate Password Discovery, Reset and Validation Requirements This document and the information controlled therein is the property of Click Studios. It must not be reproduced in whole/part, or otherwise
CS 356 Lecture 25 and 26 Operating System Security. Spring 2013
CS 356 Lecture 25 and 26 Operating System Security Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control
Top 20 Critical Security Controls
Top 20 Critical Security Controls July 2015 Contents Compliance Guide 01 02 03 04 Introduction 1 How Rapid7 Can Help 2 Rapid7 Solutions for the Critical Controls 3 About Rapid7 11 01 INTRODUCTION The Need
Compliance Guide ISO 27002. Compliance Guide. September 2015. Contents. Introduction 1. Detailed Controls Mapping 2.
ISO 27002 Compliance Guide September 2015 Contents Compliance Guide 01 02 03 Introduction 1 Detailed Controls Mapping 2 About Rapid7 7 01 INTRODUCTION If you re looking for a comprehensive, global framework
Least Privilege in the Data Center
Least Privilege in the Data Center avecto.com avecto.com 1 Introduction Removing excess administrator privileges is considered to be one of the most essential risk mitigation strategies for organizations
Contents. Supported Platforms. Event Viewer. User Identification Using the Domain Controller Security Log. SonicOS
SonicOS User Identification Using the Domain Controller Security Log Contents Supported Platforms... 1 Event Viewer... 1 Configuring Group Policy to Enable Logon Audit... 2 Events in Security Log... 4
SECURITY TRENDS & VULNERABILITIES REVIEW 2015
SECURITY TRENDS & VULNERABILITIES REVIEW 2015 Contents 1. Introduction...3 2. Executive summary...4 3. Inputs...6 4. Statistics as of 2014. Comparative study of results obtained in 2013...7 4.1. Overall
Security Threat Kill Chain What log data would you need to identify an APT and perform forensic analysis?
Security Threat Kill Chain What log data would you need to identify an APT and perform forensic analysis? This paper presents a scenario in which an attacker attempts to hack into the internal network
Critical Security Controls
Critical Security Controls Session 2: The Critical Controls v1.0 Chris Beal Chief Security Architect MCNC chris.beal@mcnc.org @mcncsecurity on Twitter The Critical Security Controls The Critical Security
Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services
Course 6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Course Details Course Outline Module 1: Introducing Active Directory Domain Services This module provides
Agenda. 3 2012, Palo Alto Networks. Confidential and Proprietary.
Agenda Evolution of the cyber threat How the cyber threat develops Why traditional systems are failing Need move to application controls Need for automation 3 2012, Palo Alto Networks. Confidential and
Locking down a Hitachi ID Suite server
Locking down a Hitachi ID Suite server 2016 Hitachi ID Systems, Inc. All rights reserved. Organizations deploying Hitachi ID Identity and Access Management Suite need to understand how to secure its runtime
Post-Access Cyber Defense
Post-Access Cyber Defense Dr. Vipin Swarup Chief Scientist, Cyber Security The MITRE Corporation November 2015 Approved for Public Release; Distribution Unlimited. 15-3647. 2 Cyber Security Technical Center
MS-6425C - Configuring Windows Server 2008 Active Directory Domain Services
MS-6425C - Configuring Windows Server 2008 Active Directory Domain Services Table of Contents Introduction Audience At Clinic Completion Prerequisites Microsoft Certified Professional Exams Student Materials
Department of Information Technology Active Directory Audit Final Report. August 2008. promoting efficient & effective local government
Department of Information Technology Active Directory Audit Final Report August 2008 promoting efficient & effective local government Executive Summary Active Directory (AD) is a directory service by Microsoft
Managing Your Microsoft Windows Server Fleet with AWS Directory Service. May 2015
Managing Your Microsoft Windows Server Fleet with AWS Directory Service May 2015 2015, Amazon Web Services, Inc. or its affiliates. All rights reserved. Notices This document is provided for informational
The Trivial Cisco IP Phones Compromise
Security analysis of the implications of deploying Cisco Systems SIP-based IP Phones model 7960 Ofir Arkin Founder The Sys-Security Group ofir@sys-security.com http://www.sys-security.com September 2002
ExecuTrain Course Outline Configuring & Troubleshooting Windows Server 2008 Active Directory Domain Services MOC 6425C 5 Days
ExecuTrain Course Outline Configuring & Troubleshooting Windows Server 2008 Active Directory Domain Services MOC 6425C 5 Days Introduction This five-day instructor-led course provides in-depth training
All Information is derived from Mandiant consulting in a non-classified environment.
Disclaimer: All Information is derived from Mandiant consulting in a non-classified environment. Case Studies are representative of industry trends and have been derived from multiple client engagements.
Websense Support Webinar: Questions and Answers
Websense Support Webinar: Questions and Answers Configuring Websense Web Security v7 with Your Directory Service Can updating to Native Mode from Active Directory (AD) Mixed Mode affect transparent user
6425C - Windows Server 2008 R2 Active Directory Domain Services
Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Introduction This five-day instructor-led course provides in-depth training on configuring Active Directory Domain Services
Course 6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services
Course 6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Length: 5 Days Published: June 02, 2011 Language(s): English Audience(s): IT Professionals Level: 200
Top 10 Security Hardening Settings for Windows Servers and Active Directory
SESSION ID: CRWD-R04 Top 10 Security Hardening Settings for Windows Servers and Active Directory Derek Melber Technical Evangelist ADSolutions ManageEngine @derekmelber Agenda Traditional security hardening
Securing SharePoint 101. Rob Rachwald Imperva
Securing SharePoint 101 Rob Rachwald Imperva Major SharePoint Deployment Types Internal Portal Uses include SharePoint as a file repository Only accessible by internal users Company Intranet External Portal
Configuring and Troubleshooting Windows 2008 Active Directory Domain Services
About this Course Configuring and Troubleshooting Windows This five-day instructor-led course provides in-depth training on implementing, configuring, managing and troubleshooting Active Directory Domain
Configuring and Troubleshooting Windows Server 2008 Active Directory Domain MOC 6425
Configuring and Troubleshooting Windows Server 2008 Active Directory Domain MOC 6425 Course Outline Module 1: Introducing Active Directory Domain Services This module provides an overview of Active Directory
Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services
Active Directory About this Course This five-day instructor-led course provides in-depth training on implementing, configuring, managing and troubleshooting (AD DS) in and R2 environments. It covers core
5 Steps to Advanced Threat Protection
5 Steps to Advanced Threat Protection Agenda Endpoint Protection Gap Profile of Advanced Threats Consensus Audit Guidelines 5 Steps to Advanced Threat Protection Resources 20 Years of Chasing Malicious
Host Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1
Host Hardening Presented by Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Background National Institute of Standards and Technology Draft Guide to General Server Security SP800-123 Server A
Five Steps to Improve Internal Network Security. Chattanooga ISSA
Five Steps to Improve Internal Network Security Chattanooga ISSA 1 Find Me AverageSecurityGuy.info @averagesecguy stephen@averagesecurityguy.info github.com/averagesecurityguy ChattSec.org 2 Why? The methodical
Network Architecture & Active Directory Considerations for the PI System. Bryan Owen - OSIsoft Joel Langill - SCADAhacker
Network Architecture & Active Directory Considerations for the PI System By: Bryan Owen - OSIsoft Joel Langill - SCADAhacker Agenda Moore s Law Network Architecture Domain Services in a DMZ 2 HD Moore
Privileged. Account Management. Accounts Discovery, Password Protection & Management. Overview. Privileged. Accounts Discovery
Overview Password Manager Pro offers a complete solution to control, manage, monitor and audit the entire life-cycle of privileged access. In a single package it offers three solutions - privileged account
SANS Institute First Five Quick Wins
#1 QUICK WIN- APPLICATION WHITELISTING SANS Critical Controls: #2: Inventory of Authorized and Unauthorized Software 1) Deploy application whitelisting technology that allows systems to run software only
Active Directory & SQL Server
Active Directory & SQL Server How AD can affect your SQL Servers Ryan Adams Blog - http://ryanjadams.com Twitter - @ryanjadams Email ryan@ryanjadams.com DNS Group Policy Security Groups Password Policies
Course 6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services
www.etidaho.com (208) 327-0768 Course 6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services 5 Days About this Course This five-day instructor-led course provides in-depth
Addressing the United States CIO Office s Cybersecurity Sprint Directives
RFP Response Addressing the United States CIO Office s Cybersecurity Sprint Directives How BeyondTrust Helps Government Agencies Address Privileged Account Management and Improve Security July 2015 Addressing
Larry Wilson Version 1.0 November, 2013. University Cyber-security Program Critical Asset Mapping
Larry Wilson Version 1.0 November, 2013 University Cyber-security Program Critical Asset Mapping Part 3 - Cyber-Security Controls Mapping Cyber-security Controls mapped to Critical Asset Groups CSC Control
Hosts HARDENING WINDOWS NETWORKS TRAINING
BROADVIEW NETWORKS Hosts HARDENING WINDOWS NETWORKS TRAINING COURSE OVERVIEW A hands-on security course that teaches students how to harden, monitor and protect Microsoft Windows based networks. A hardening
Alert (TA14-212A) Backoff Point-of-Sale Malware
Alert (TA14-212A) Backoff Point-of-Sale Malware Original release date: July 31, 2014 Systems Affected Point-of-Sale Systems Overview This advisory was prepared in collaboration with the National Cybersecurity
Configuring, Managing and Maintaining Windows Server 2008-based Servers
Course 6419B: Configuring, Managing and Maintaining Windows Server 2008-based Servers OVERVIEW About this Course This five-day instructor-led course provides students with the knowledge and skills that
How we see malware introduced Phishing Targeted Phishing Water hole Download (software (+ free ), music, films, serialz)
How we see malware introduced Phishing Targeted Phishing Water hole Download (software (+ free ), music, films, serialz) Domain.Local DC Client DomainAdmin Attack Operator Advise Protect Detect Respond
Kaseya Server Instal ation User Guide June 6, 2008
Kaseya Server Installation User Guide June 6, 2008 About Kaseya Kaseya is a global provider of IT automation software for IT Solution Providers and Public and Private Sector IT organizations. Kaseya's
DRIVE-BY DOWNLOAD WHAT IS DRIVE-BY DOWNLOAD? A Typical Attack Scenario
DRIVE-BY DOWNLOAD WHAT IS DRIVE-BY DOWNLOAD? Drive-by Downloads are a common technique used by attackers to silently install malware on a victim s computer. Once a target website has been weaponized with
Microsoft. Official Course. Introduction to Active Directory Domain Services. Module 2
Microsoft Official Course Module 2 Introduction to Active Directory Domain Services Module Overview Overview of AD DS Overview of Domain Controllers Installing a Domain Controller Lesson 1: Overview of
Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services
Course Code: M6425 Vendor: Microsoft Course Overview Duration: 5 RRP: 2,025 Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Overview This five-day instructor-led course
Top Five Data Security Trends Impacting Franchise Operators. Payment System Risk September 29, 2009
Top Five Data Security Trends Impacting Franchise Operators Payment System Risk September 29, 2009 Top Five Data Security Trends Agenda Data Security Environment Compromise Overview and Attack Methods
Course 6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services
Course 6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Five Days, Instructor-Led About this course This five-day instructor-led course provides in-depth training
Course 6419B: Configuring, Managing and Maintaining Windows Server 2008-based Servers
Course 6419B: Configuring, Managing and Maintaining Windows Server 2008-based Servers Length: Delivery Method: 5 Days Instructor-led (classroom) About this Course This five-day instructor-led course provides
Malwarebytes Enterprise Edition Best Practices Guide Version 1.3 21 March 2014
Malwarebytes Enterprise Edition Best Practices Guide Version 1.3 21 March 2014 Notices Malwarebytes products and related documentation are provided under a license agreement containing restrictions on
Microsoft Baseline Security Analyzer (MBSA)
Microsoft Baseline Security Analyzer Microsoft Baseline Security Analyzer (MBSA) is a software tool released by Microsoft to determine security state by assessing missing security updates and lesssecure
RSA Security Analytics
RSA Security Analytics Event Source Log Configuration Guide Microsoft Windows using Eventing Collection Last Modified: Thursday, July 30, 2015 Event Source Product Information: Vendor: Microsoft Event
GFI White Paper PCI-DSS compliance and GFI Software products
White Paper PCI-DSS compliance and Software products The Payment Card Industry Data Standard () compliance is a set of specific security standards developed by the payment brands* to help promote the adoption
Configuring Windows Server 2008 Active Directory
Configuring Windows Server 2008 Active Directory Course Number: 70-640 Certification Exam This course is preparation for the Microsoft Technical Specialist (TS) exam, Exam 70-640: TS: Windows Server 2008
70-640 R4: Configuring Windows Server 2008 Active Directory
70-640 R4: Configuring Windows Server 2008 Active Directory Course Introduction Course Introduction Chapter 01 - Installing the Active Directory Role Lesson: What is IDA? What is Active Directory Identity
50331D Windows 7, Enterprise Desktop Support Technician (Windows 10 Curriculum)
This course can be purchased by authorized Microsoft Learning Centers at the Courseware Marketplace web-site. Microsoft Certified Trainers (MCTs) can get a free copy at the same website. About the Course
EITC Lessons Learned: Building Our Internal Security Intelligence Capability
EITC Lessons Learned: Building Our Internal Security Intelligence Capability SESSION ID: SEC-W08 Tamer El Refaey Senior Director, Security Monitoring and Operations Emirates Integrated Telecommunications
Microsoft Auditing Events for Windows 2000/2003 Active Directory. By Ed Ziots Version 1.6 9/20/2005
Microsoft Auditing Events for Windows 2000/2003 Active Directory. By Ed Ziots Version 1.6 9/20/2005 Revision 1.3: Cleaned up resources and added additional detail into each auditing table. Revision 1.4:
Industrial Security for Process Automation
Industrial Security for Process Automation SPACe 2012 Siemens Process Automation Conference Why is Industrial Security so important? Industrial security is all about protecting automation systems and critical
CHAPTER 3 : INCIDENT RESPONSE FIVE KEY RECOMMENDATIONS GLOBAL THREAT INTELLIGENCE REPORT 2015 :: COPYRIGHT 2015 NTT INNOVATION INSTITUTE 1 LLC
: INCIDENT RESPONSE FIVE KEY RECOMMENDATIONS 1 FIVE KEY RECOMMENDATIONS During 2014, NTT Group supported response efforts for a variety of incidents. Review of these engagements revealed some observations
Database Auditing: Best Practices. Rob Barnes, CISA Director of Security, Risk and Compliance Operations rbarnes@appsecinc.com
Database Auditing: Best Practices Rob Barnes, CISA Director of Security, Risk and Compliance Operations rbarnes@appsecinc.com Verizon 2009 Data Breach Investigations Report: 285 million records were compromised
05 June 2015 A-000061-MW TLP: GREEN
05 June 2015 Alert Number A-000061-MW Please contact the FBI with any questions related to this FLASH Report at either your local Cyber Task Force or FBI CYWATCH. Email: cywatch@ic.fbi.gov Phone: 1-855-292-3937
6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services
6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Course Details Course Code: Duration: Notes: 6425C 5 days This course syllabus should be used to determine whether
How We're Getting Creamed
ed Attacks How We're Getting Creamed By Ed Skoudis June 9, 2011 ed Attacks - 2011 Ed Skoudis 1 $ cut -f5 -d: /etc/passwd grep -i skoudis Ed Skoudis Started infosec career at Bellcore in 1996 working for
Seven Things To Consider When Evaluating Privileged Account Security Solutions
Seven Things To Consider When Evaluating Privileged Account Security Solutions Contents Introduction 1 Seven questions to ask every privileged account security provider 4 1. Is the solution really secure?
Assume Breach: An Inside Look at Cloud Service Provider Security
SESSION ID: EXP-W01 Assume Breach: An Inside Look at Cloud Service Provider Security Mark Russinovich CTO, Microsoft Azure Microsoft @markrussinovich 1 Microsoft Cloud Security Overview Protect Detect
Computer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 24 Windows and Windows Vista Security First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Windows and Windows Vista Security
Enabling single sign-on for Cognos 8/10 with Active Directory
Enabling single sign-on for Cognos 8/10 with Active Directory Overview QueryVision Note: Overview This document pulls together information from a number of QueryVision and IBM/Cognos material that are
Exam Questions 70-243
Exam Questions 70-243 Administering and Deploying System Center 2012 Configuration Manager http://www.2passeasy.com/dumps/70-243/ 1. Your company uses System Center 2012 Configuration Manager with Microsoft
STEALTHbits Technologies, Inc. StealthAUDIT v5.1 System Requirements and Installation Notes
STEALTHbits Technologies, Inc. StealthAUDIT v5.1 System Requirements and Installation Notes June 2011 Table of Contents Overview... 3 Installation Overview... 3 Hosting System Requirements... 4 Recommended
SANS Top 20 Critical Controls for Effective Cyber Defense
WHITEPAPER SANS Top 20 Critical Controls for Cyber Defense SANS Top 20 Critical Controls for Effective Cyber Defense JANUARY 2014 SANS Top 20 Critical Controls for Effective Cyber Defense Summary In a