What is SMBv1 and Why You Should Disable it
Eternally Affected
What is SMB?
Server Message Block (SMB) is a protocol used primarily for
sharing files, printer services, and communication between computers on a
network. The history of SMB is long, so I’ll try to keep this short and to the
point.
SMBv1
Back in the 1980s and 1990s IBM and Microsoft were working on implementations of SMB to improve and build upon the protocol. Microsoft actually pushed to rename SMB to Common Internet File System (CIFS) and added a bunch of…
Improve the Efficiency and Automation of AD Object Rollback and Recovery in StealthRECOVER 1.5
Why is Active Directory (AD) so Important to Protect?
The health
and operational integrity of AD has a direct impact on the overall security of
your organization. The capability to rollback and recover from unwanted changes
is a critical requirement for you to maintain the security and performance of
your network.
In fact – it’s never been more important.
90% of organizations use AD as their central hub of authentication and authorization. It literally holds the keys to the kingdom …
Improve AD Security – Block Unauthorized Activities & Strengthen Passwords with StealthINTERCEPT 7.0
Nearly
everyone uses Microsoft’s Active Directory (AD), over 90% in fact[1],
to manage user accounts and provide authentication and access to the majority
of organizational resources. Microsoft tells us that 95 million AD accounts are
under attack every day[2].
The latest Verizon Data Breach Investigations Report informs that 56% of
breaches in 2018 took a month or longer to discover[3].
Being under constant attack, and taking months to discover it, is a recipe for
disaster.
Many organizat…
ProTip – The Power of Character Substitution Checks in StealthINTERCEPT Enterprise Password Enforcer
I have had the benefit of visiting a number of customers to understand how they use our products. Specifically, how they use the breach password dictionary in StealthINTERCEPT Enterprise Password Enforcer. Many actively manage their breach password database to prevent breached passwords from use. In reviewing these password databases, I noticed many contained entries with multiple variations of a single word. Essentially, they were manually adding character substitution or “leetspeak.”
F…
Cleaning Up Unused Service Accounts Series – Part 1: Overview of the Process
What is a Service Account?
In this blog post, I won’t go too much into the details of service accounts but will class a service account as a user, Managed Service Account or a Group Managed Service Account which is used to run a process whether it be a Service, Task, IIS App Pools or used inside of an application.
The Problem?
A lot of organisations will have hundreds and maybe even thousands of service accounts that may be in use across their Active Directory environment. It can be …
What is Kerberos Delegation? An Overview of Kerberos Delegation
Kerberos Delegation and Usage
Kerberos delegation has been around for a long time (Windows Server 2000 to be exact), but more often than not, when speaking to engineers who manage or work with Active Directory, they’re not familiar with all the various implementations of Kerberos delegation, their uses, and some ways they can be abused. What I find funny, is that most people confuse Kerberos delegation with delegated permissions.
The practical usage of Kerberos delegation is to enable a…
Cybersecurity Predictions for 2020
It’s that time of the year again! As we roll into 2020 we’re
proud to present our 4th edition of “STEALTHbits’ Experts
Cybersecurity Predictions.”
We asked eight of our top industry voices here at STEALTHbits their thoughts on what’s to come in the world of cybersecurity in the next 365 days! Read on and come back at the start of 2021 to see how we did.
Ransomware Will Continue To Wreak Havoc Using the Same Old Tricks
Ransomware attacks will continue to impact organizations causing s…
How to Harden your SharePoint Online Environment by Disabling Legacy Authentication
Allowing legacy authentication to your SharePoint online tenant unnecessarily exposes it to a number of attacks and exploits that you can easily avoid by simply disabling legacy authentication to your tenant. Microsoft has made it clear that all roads lead to the cloud, and with that Azure Active Directory has become an even more critical piece as the identity provider to O365. Microsoft has introduced a number of security-focused features into its cloud platform over the last couple of years…
How to Identify Phishing Scams and Protect Against Them
Phishing scams are a very common technique used by identity
thieves to trick you into giving them your sensitive personal or financial
information. Thieves will often impersonate actual companies like credit card
companies, banks or online resources such as PayPal or Dropbox. It is a
challenge to recognize what is real and what isn’t but there are a few things
you can do to make yourself/your organization less susceptible to this type of
scam.
Traditional Approach
Before we discuss a no…
Key Requirements of the NY SHIELD Act and How to be Compliant
As more and more attacks are occurring each year with a record 4.1 billion records breached in just the first half of 2019, according to Forbes– data security regulation is becoming more of a priority. Just as we suspected with the signing of the GDPR regulation in the EU, similar regulation has sprung up in the U.S with the CCPA on the west coast in California and most recently spreading to the east coast in New York with the signing of the ‘Stop Hacks and Improve Electronic Data Security’ o…
