More info on http://techdays.be.

1. Technical Cyber Defense
Strategies Explained
Marcus Murray & Hasain Alshakarti
Truesec Security Team, MVP-Enterprise Security
x2

2. Marcus Murray Hasain Alshakarti

3. WARNING!
Session format
=
DISCUSSION!

4. Soo.. What does it take to be hack-proof?

5. Let´s start with the big picture!

6. We all know what a network looks like..
Web Srv Mail Srv
DC File Srv Mail Srv
Client Client

7. Internet Strategy Client
Front-end
Web Srv Mail Srv
Back-end
DC SqlSrv FileSrv
Client Client
Admin User

8. Traditional internal Strategy Client
Admin
Front-end
Web Srv Mail Srv
Back-end
DC SqlSrv FileSrv
Client Client
Admin User

9. Demo – Hacking SQL..
SqlSrv

10. Traditional Internet strategy World access
Trusted access
Admin access
Client network
Client
(Internet)
World
Cloud Front-end Internet Front-end
Accessible
Client
Client network
Client
Cloud back-end Internet back-end (Managed)
Client Client
Internal back-end Internal Front-end
FileSrv

11. Apply Internet strategy internally World access
Trusted access
Admin access
Client network Client network
Client
(Internet) (Managed)
World
Cloud Front-end Internet Front-end Secure Access Layer
Accessible
Client
Cloud back-end Internet back-end Internal Front-end
Internal back-end

12. Let´s add som future.. (today for some..) World access
Trusted access
Admin access
Client network Client network
Client
(Internet) (Managed)
World
Cloud Front-end Internet Front-end Secure Access Layer
Accessible
Client
Cloud back-end Internet back-end Internal Front-end
Fabric controllers. Fabric controllers Internal back-end

13. Implementing Secure networking - DEMO
• Ipsec domain isolation
• Direct Access
• Ipsec server isolation

14. Domain Isolation - Demo World access
Trusted access
Client Admin access
Client network Client
(Managed)
File Srv
Internal
Sql Srv

15. Direct access - Demo World access
Trusted access
Client Admin access
Client network
(Managed) Client
World
Secure Access Layer DA Srv
Accessible
File Srv
Internal
Sql Srv

16. Server isolation - Demo World access
Trusted access
Client Admin access
Client network
(Managed) Client
World
Secure Access Layer DA Srv
Accessible
File Srv
Internal Front-end
Sql Srv
Internal back-end

17. So, if the clients are on the ”internet” all the time..
• Physical access Client
• Firewall
User
• Patching
• Non-admin
• Malware protection
• Secure transport
Web Srv

18. Physical access protection
• Bitlocker
• Protect from DMA access!
– http://support.microsoft.com/k
b/2516445

19. Local Firewall
• Is there ANY reason why the Client
client firewall must allow
inbound traffic at any time? User
Client
User
Web Srv

20. Patching, of course, but what about the 0-days?
• Non-Admin Client
• Early mitigations
User
• Patching strategy
Client
User
Web Srv

21. Malware protection
• Macro settings
• Antivirus? Yes or No?
• Remember applocker?
Client
User

22. Secure transports….
• Weak protocols… Client
– Clear text
– NTLM configurations User
Client
• Direct access!
• IPSEC! User
Web Srv

23. So, what about BYOD? World access
Trusted access
Admin access
Client network Client network
Client
(Internet) (Managed)
World
Cloud Front-end Internet Front-end Secure Access Layer
Accessible
Client
Cloud back-end Internet back-end Internal Front-end
Internal back-end
• Application classification
• Data classification

24. ..and… adminclients
• Should an adminuser/computer be Client
on the ”internet”?
• Should an admin user read email? Admin
• Safe admin access
– Non compromized computer
– Trusted communication channel
– Robust exposure of admin interface
• Robust services DC
• Limited number of administrators
– Authentication
– Authorization

25. And let´s talk about server services.
• Robust service Client
– Authentication
– Authorization User
• Firewall
• Patching
• privs
• depencencies
• Admin exposure Web Srv

26. Web server attack
Web Srv

27. Marcus Murray Hasain Alshakarti

28. Thank you for listening! 