Trust Center

Office 365 Security and Compliance Center

FINRA Attestation Letter Process

1. Install a GUI
2. Install RDP
3. Configure networking to allow connection over RDP

• • • Tests on your endpoints to uncover the Open Web Application Security Project (OWASP) top 10 vulnerabilities
    • Fuzz testing of your endpoints
    • Port scanning of your endpoints It should be obvious, but just to be clear: DON’T use your Kali machine to attack anybody else’s stuff. You would most definitely find yourself in a legal pickle if you decided to attack resources that didn’t belong to you (or one of your customers) without explicit permission in writing. Please, just don’t run the risk. Practice using the 600+ tools available in the Kali Linux distro and learn how to better secure your environment.

Specifying Your Environment

Rapid Cyberattack Assessment Affected Nodes spreadsheet

Rapid Cyberattack Assessment Key Recommendations document

Excel Resubmission Report spreadsheet

Rapid CyberAttack Assessment Management Presentation PowerPoint deck

Every Question Tells a Story

Survey Mode or Full Assessment?

• Survey mode simply asks a set of questions that relate to your environment and then provide you with some guidance on what you should look at to start protecting against ransomware.
• Full mode includes the survey questions, but it also runs a technical assessment against the machines in your environment to identify specific vulnerabilities.

The Story-Telling Questions

1. Create separate accounts for privileged activities (vs. standard accounts for email/browsing, etc.): Many organizations have learned this lesson and are good about creating separate sets of credentials for administrative activities and a lower-privileged account for everyday IT worker stuff like checking email, creating documents and surfing the web.
2. Enforce multi-factor authentication on all privileged accounts: I’m happy to say I’m seeing many more organizations using multifactor authentication for highly-privileged accounts, whether it’s a token, or a phone-based tool like Microsoft Authenticator, or whatever. This is great to see, and I encourage every organization to start looking into MFA. In fact, Office 365 and Azure have MFA capabilities built right in – you just need to turn them on.
3. All privileged users are prevented from using email and browsing the internet: The key word here is I would venture to say that most organizations advise their admins not to use their admin accounts for browsing the web or checking email. But what if you are fixing a problem with a server and Microsoft has a hotfix that you need to download. Can’t you just this once…..? The answer is “no”.  Admin accounts should be prevented from browsing the internet. Period. Nothing good can come of browsing the wild and wooly internet with an admin account. It’s like walking in a seedy part of the city at night with $100 bills hanging out of your pocket.
4. Restrict Tier 0 privileged accounts to only logon on Tier 0 servers and trusted workstations (such as PAWs): This is one of the most critical parts of securing administrative access. A core principle for securing administrative access is understanding that if admin A is logged into Workstation A, and he then makes an RDP connection to Server B, then the workstation is a “security dependency” of the server. Put simply, the security of Server B depends upon the security of Workstation A.

 

Preparing the Environment

Conditions

1. Assess your entire environment in 500 machine chunks. Run the tool against a specific OU or group of OU’s that total no more than 500 machines. You can also just create lists (maybe exported from a spreadsheet) and use that as input for the tool. This method will definitely take a little bit of time and it won’t give you a single, comprehensive report view, either.
2. Take sample machines from a number of different departments and run the tool against them. With this method, you would take (as an example) 50 machines from HR, 50 machines from Finance, 50 machines from Sales, etc…and run the tool against them. It doesn’t capture data on every single machine in the environment, but the tool is designed to give you an idea of where your exposures lie, and that would most likely be revealed in even a random sampling of machines. You can reasonably assume that any vulnerabilities identified in that subset of machines likely exists elsewhere in the environment as well.

Hardware and Software

1. Server-class or high-end workstation running Windows 7/8/10 or Windows Server 2008 R2/2012/2012 R2/2016.
2. It’s preferable to have a machine with 16 GB+ of RAM, a 2 GHz+ processor and at least 5 GB disk space.
3. The machine should be joined to the Active Directory domain you will be assessing.
4. Microsoft .NET Framework 4.0 must be installed
5. Optionally, you may want Word, PowerPoint and Excel installed to view the reports. But you can also just export the reports and view them on a machine that has Office installed already.

Account Rights

Network Access

• Remote Registry
• Windows Management Instrumentation (WMI)
• Default admin shares (C$, D$, IPC$)

1. Use an existing Group Policy object or create a new one using the Group Policy Management Tool.
2. Expand the Computer Configuration/Policies/Windows Settings/Security Settings/Windows Firewall with Advanced Security/Windows Firewall with Advanced Security/Inbound Rules
3. Check the Predefined:radio button and select Windows Management Instrumentation from the drop-down list. Click 
4. Check the WMI rules for the Domain Profile. Click Next
5. Check the Allow the Connectionradio button and click Finish to exit and save the new rule.
6. Make sure the Group Policy Object is applied to the relevant computers using the Group Policy Management Tool

1. Open the Group Policy editor and the GPO you want to edit.
2. Expand Computer Configuration > Policies > Windows Settings > Security Settings > System Services
3. Find the Remote Registry item and change the Service startup mode to Automatic
4. Reboot the clients to apply the policy

What Do I Need to Do This?

Use a PowerShell script to connect to Microsoft Graph and Look for Identity Risk Events

• $ClientID
• $ClientSecret
• $tenantdomain

$ClientID       = "Application ID value from the Registered App properties page "       # Should be a ~36 hex character string; insert your info here
$ClientSecret   = "Password value from the Keys page" # Should be a ~44 character string; insert your info here
$tenantdomain   = "Tenant name"   # For example, contoso.onmicrosoft.com

$loginURL       = "https://login.microsoft.com"
$resource       = "https://graph.microsoft.com"
$body      = @{grant_type="client_credentials";resource=$resource;client_id=$ClientID;client_secret=$ClientSecret}
$oauth     = Invoke-RestMethod -Method Post -Uri $loginURL/$tenantdomain/oauth2/token?api-version=1.0 -Body $body
Write-Output $oauth
if ($oauth.access_token -ne $null) {
   $headerParams = @{'Authorization'="$($oauth.token_type) $($oauth.access_token)"}
   $url = "https://graph.microsoft.com/beta/identityRiskEvents"
   Write-Output $url
   $myReport = (Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url)
   foreach ($event in ($myReport.Content | ConvertFrom-Json).value) {
       Write-Output $event
   }
} else {
   Write-Host "ERROR: No Access Token"
}

What Information Does It Provide?

• Impossible travel to atypical locations (Did you log in from New York and then 5 minutes later try to log in from an IP address in Indonesia?)
• Sign-in events from unfamiliar locations (Is the location you are signing in from outside of your typical login patterns?)
• Sign-ins from an infected device (Is the device where the login was attempted communicating with a botnet server?)
• Sign-ins from IP addresses with suspicious activity (Maybe an IP address where a number of login attempts are taking place for lots of different accounts, which could indicate a brute force password attack)

Have fun with Microsoft Graph!

What Do I Need?

Launching a Spear Phishing Attack

Okay. But seriously…would you really have clicked on that URL?

The Value of Attack Simulations

The Attacks

Spear Phishing

Brute Force Password (a.k.a., Dictionary Attack)

Password Spray Attack

Launching a Password Spray Attack

Launching a Brute Force Password (Dictionary Attack)

Stay tuned!