3

I know someone who works at a medium-sized company (between 1000 and 10,000 employees) and is somewhat chagrined that several intranet Windows web servers (SharePoint, internal apps, etc.) continue to authenticate Windows domain users using basic and NTLM auth over insecure HTTP connections.

He recently talked to a department head about the problem, explained the primary threat model (MITM credential stealing via any compromised device, even printers), and got push-back: "If someone we don't trust is in our network, we have a much bigger problem."

Also, the department head thinks very highly of his employees and would bristle at the suggestion that employees themselves ought to be part of the threat model.

What approach would you suggest taking when discussing the issue with this executive?

(Using a throwaway account to avoid any inferred connection to the above company.)

  • 3
    Hire a pentester and watch the jaws drop at the report presentation meeting. – DKNUCKLES Jan 23 '18 at 20:22
  • The reality is that if you have a company with 10000 employees, you cannot have a single secure network, you have a lot of small networks connected together. – Lie Ryan Jan 24 '18 at 2:11
  • Don't use his employees as an example. Use a contracted janitor, someone else's vendor, unescorted guests in the building, etc. Make the example without using people who, if they were an attacker, would result in that department head answering very uncomfortable questions to the people HE reports to; i.e. avoid tripping his most sensitive defensive CYA instincts (which, to be fair, he probably needs in some form or other to stay employed long-term). – Anti-weakpasswords Jan 24 '18 at 3:57
  • Happy to revert my downvote if I'm wrong here - but isn't this site for specific security issues? This question isn't even conceptual, it's about managing people and feelings. It's a valid question, I just think it's on the wrong site. – user81147 Jan 24 '18 at 12:19
  • 1
    @JᴀʏMᴇᴇ This is a specific security issue. That it involves people and feelings does not make it off-topic; in fact, most security issues center around people (their feelings, beliefs, practices, etc.). schneier.com/blog/archives/2005/12/the_human_side.html – Throwaway_03 Jan 24 '18 at 18:34
3

Insider threat is always a possibility, but managers are always going to react defensively when they (and by extension, their team) are brought under scrutiny. Especially when you confront them with direct evidence of an underling's misdeeds.

Don't bring employees into it. Rephrase it in terms of compromised credentials-- "it's not about what Jenny in accounting might do, it's about what someone who steals her credentials will absolutely do."

...even if Jenny truly is a menace to the company.

If someone we don't trust is in our network, we have a much bigger problem.

It's about threat mitigation. Just because an attacker has gained a foothold doesn't mean they've already started to enumerate or spread or pwned your entire infrastructure. For all you know he's contained on one machine, where he's stuck trying to guess at server locations and credentials to the next. This is a small and simple problem to remediate.

But with credentials floating around in the clear, if he starts eavesdropping on network traffic, he can obtain new sets of credentials to masquerade as and new locations to breach. The scope of his infiltration expands quickly, as do the number of places for him to maintain persistence in your network. Only now has that "bigger problem" materialized.

2

Quite simply, it's the people that you trust the most that can screw you the hardest. Yes, if you have someone you don't trust in your network, you have a huge problem. Many small companies, however, have this implicit trust model and get burned by it as they grow and find out that some people, despite our best belief in them, do things they aren't supposed to that really hurt the company.

Good security looks at the most likely players - your internal employees are the biggest threat overall. They're already on your network, and by definition trusted. So their potential for damage is high. Remember, you're only one disgruntled employee from disaster. Here is an article on Forbes; you can also check out NIST and other security publications (such as ISSA or ISACA) for more info. Webmasters SE has a good answer to this.

I'd start by not sounding accusatory toward the staff. Read up on best practices. Get facts from ISSA and from ISACA and NIST about why to secure your internal web servers. Look up STIG Viewer for practices and reasons. Be ready to explain the benefits. You want to show this exec that the reason you want to do this is because it's the right thing to do, and other companies do it for very good reasons. Also, executives see things in terms of cost/benefit ratio. If it's cheaper to do nothing, and the risk is low, then they'll invariably choose doing nothing. This is where Management needs to educate the executive about the level of risk and how to mitigate that risk.

0

Practical demonstrations or as mentioned above a third party pentest:

  • Map your network with bloodhound to show the fastest path to your DC
  • Demonstrate mimikatz on a workstation extracting credentials
  • The provide an example on how an external could breach an employee workstation or employee (DDE + Macros, external endpoints without MFA, brute force)

Highlight that the security industry works under assumed breach in this day and age. By the sounds of it this company already is and just don't know it.

Perhaps a cost breack down of a breach vs the cost of fixing these insecure practices, an exec after all is about the numbers.

  • There are 2 kinds of companies: those that are under attack, and those that don't know they are under attack. – baldPrussian Jan 24 '18 at 0:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.