Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

12/26/2018
09:00 AM
Kelly Sheridan
Kelly Sheridan
Slideshows
Connect Directly
Twitter
LinkedIn
RSS
E-Mail

6 Ways to Anger Attackers on Your Network

Because you can't hack back without breaking the law, these tactics will frustrate, deceive, and annoy intruders instead.
2 of 7

Security 101

Robert Portvliet, technical fellow at Cylance, thinks about what has frustrated him most as a pen tester: companies that do their homework and expose minimal attack surface, "[making] it difficult for an attacker each step of the way," he explains.

Some techniques, he says, are as simple as properly hardening systems: Prevent PowerShell execution, for example, and don't give adversaries the ability to install new packages. Don't give people more privileges than they really need. Use architecture such as Microsoft Red Forest, which protects the transfer of credentials so attacks like LLMNR poisoning aren't as effective.

Proper network segmentation also helps. "You can't attack what you can't reach," Portvliet explains. For example, if two departments aren't required to communicate, segment their networks and disallow interaction. "It's about removing that easy win," he says.

He recommends companies approach their environments from an attacker's perspective. Assume each compromise point, come in from the outside, and phish a workstation. If someone can get into your network, he shouldn't be able to become a local admin. Go through the process of a potential compromise and ensure the right defenses are in place for each step.

What you want to do is break multiple parts of the attacker kill chain. "What I've found in pen testing is if you do the basic stuff and you do it well, it makes the pen test much more difficult," Portvliet says. "All the tried-and-true methods no longer bear fruit."

(Image: Tonsnoei stock.adobe.com)

2 of 7
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
Dr.T
100%
0%
Dr.T,
User Rank: Ninja
12/27/2018 | 11:14:54 AM
Hack back
Legal trouble aside, getting into a back-and-forth with attackers is dangerous, Straight cautions. This would let happen within the country, as outside of country then they would not care as they do not think rules applied to them.
<<   <   Page 2 / 2
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: He hits the gong anytime he sees someone click on an email link.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-29070
PUBLISHED: 2020-11-25
osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters.
CVE-2020-26212
PUBLISHED: 2020-11-25
GLPI stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.3, any authenticated user has read-only permissions to the planning of ever...
CVE-2020-26243
PUBLISHED: 2020-11-25
Nanopb is a small code-size Protocol Buffers implementation. In Nanopb before versions 0.4.4 and 0.3.9.7, decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being decoded...
CVE-2020-25650
PUBLISHED: 2020-11-25
A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with access to the UNIX domain socket path `/run/spice-vdagentd/spice-vdagent-sock` could use this flaw to perform a memory denial of service fo...
CVE-2020-29071
PUBLISHED: 2020-11-25
An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. The issue arises from the insecure rendering of HTML files uploaded to the platform as attachments, when the -htmlview URL is directly accessed. The impact ranges from executing commands as root on the server to retrieving se...