Hi Welcome to this INE Video lesson
on Device Hardening and Microsoft Defender
for Identities.
The agenda is very short.
We'll start on a high level of device hardening,
since this is not a course on device hardening,
we just want to outline the importance
of doing this action.
And then we'll move into discussing Microsoft Defender
for identity, which is a tool that you can install locally
in your active Directory.
And that tool has the ability to detect suspicious activity,
that may point to compromised identities
or any other reconnaissance attacks that
are towards the identities in our active directory.
Now Device hardening is a very crucial action
that we need to perform in our environment.
For all of the different concepts
that we have discussed in this, in this course,
to actually be operational and to provide the security that
is required or that to expect from them [INAUDIBLE]
To harden our devices what we really try to do
is we are limiting all the unused features
services and everything else can just disable on the endpoints,
that you don't require to limit the attacks surfaced to them.
We're trying to really reduce what can execute--
especially what is coming from the internet that can execute.
So that our employees are not an easy target.
So to speak.
What we want to also achieve with device hardening
is to limit the network boundaries
and by doing so we can try to prevent lateral movement
in the environment.
So even attacker had compromised--
or has credentials, that may have access to remote machine.
If we have some method boundaries
they might not be able to reach them,
to reach the other machine to use those credentials on them.
We should also look into implementing the Disk
encryption that can prevent--
stolen devices from our environment,
from providing access to attackers to our environment.
Or giving attackers information about our environment. .
Because if we have the physical device without Disk encryption,
it is trivial to log into that device
as administrative privileges.
So all the data which is local, will most likely
be compromised.
And depending on what VPN solution
you have towards your network, if you have one of course.
That log-in may allow an attacker
to get into our network by stealing device.
So device encryption is important to prevent this
from occurring and depending on how it's implemented.
It may or may not allow for certain access
to data or to at least query who is--
the account in a machine.
But by having this encryption you can really
limit big parts of the risks, that can--
that's not having this encryption
will bring to the environment.
But also want to do is to, install, or to implement,
enforce application white listing.
Which will only allow software that we are aware of
or that we want to allow execution, execution
of in our environment.
And finally we need to focus on logging,
monitoring and then alerting of suspicious activity.
We need to not just enable default,
when window slacks have to go a step further
and ensure that we have tools such a Sismon
or any other logging capability that you
can introduce in an environment because they'll capture locks.
That will really aid us into identifying attacks,
at very early stage executing.
One way to introduce or to perform
hardening is by following some of the guidelines that
are out there and the most famous known guidelines
are those from CIS and from Microsoft, which are
the Microsoft security baseline
CIS is a complete set it comes--
of course, you can purchase it pre-defined
or you can just get the free version
which is a PDF with, all the settings and the recommended
values.
And that PDF is more than 1,000 pages so it's quite massive,
it's quite descriptive.
And I urge you to go in and look into this
if you haven't done so yet.
Now let's move into Microsoft Defender for identity.
The tool is a cloud based solution,
which attempts to identify any relation
toward suspicious activity with produced identities
send to detect threats to warn them.
It can identify reconnaissance tools
in our environment such as, someone executing
Chuck hunt which is sent to extracting
data of Active Directory.
It can also identify other threats in the environment,
because it's creating profiles for the users.
So if suddenly an administrative account
logs into a server, that, that has not logged into,
in the past one year this tool has the ability
to detect that and notify us that, something weird is
happening, something that is not aware of.
And it could be suspicious so maybe it's
something we want to look into.
And because it's looking to quite a few things
by creating this profile.
It can identify attacks in the entire cyber kill chain
from the entire, from the initial reconnaissance
in the network to using closed identities to laterally
move between devices, or to extract credentials.
So tools sorry, attacks such as DC sync
will also be on the radar of this tool,
it will have the ability to detect them.
And the tool itself it's--
a simple installation tool that you to install locally
on your environment you can do it
on a domain [INAUDIBLE] controller,
or on a separate server.
And what it does is it collects all the data
and send it to Azure.
So Azure is a central management for this tool where
you can see all the alerts and everything, configuration
wise for the tool itself.
But I want to do this, I want to go to Azure
and I want to show you the different attacks
that this tool can detect.
I have not connected to Azure.
To access this tool you need to go to portal.atp.azure.com
And I have connected to the tool,
and what you can see in here is where my sensor is installed,
but I can see that it's installed on a machine called
this is zero one.
What I want to do is I'll go into the exclusion list just
to show you what exclusions you can do off
and that will also list the different attacks
that this tool can detect.
So if you look into here, we'll see that it can detect overpass
the hash, NTLM authentication tampering,
It can detect DC sync attacks, it can recall or can also
detects some type of reconnaissances
in the environment remote codes execution DNS,
and a large number of different attacks.
As well as golden tickets.
And these are the attacks that we're discussing also
in the beginning of the course.
So having this tool in the network
will be really beneficial, just to listen and try
to see if it can correlate anything that is suspicious,
that points to-- any of our previous accounts
being compromised.