Convince an executive to mandate HTTPS use on Intranet web servers

Question

I know someone who works at a medium-sized company (between 1000 and 10,000 employees) and is somewhat chagrined that several intranet Windows web servers (SharePoint, internal apps, etc.) continue to authenticate Windows domain users using basic and NTLM auth over insecure HTTP connections.

He recently talked to a department head about the problem, explained the primary threat model (MITM credential stealing via any compromised device, even printers), and got push-back: "If someone we don't trust is in our network, we have a much bigger problem."

Also, the department head thinks very highly of his employees and would bristle at the suggestion that employees themselves ought to be part of the threat model.

What approach would you suggest taking when discussing the issue with this executive?

(Using a throwaway account to avoid any inferred connection to the above company.)

Answer 1

Insider threat is always a possibility, but managers are always going to react defensively when they (and by extension, their team) are brought under scrutiny. Especially when you confront them with direct evidence of an underling's misdeeds.

Don't bring employees into it. Rephrase it in terms of compromised credentials-- "it's not about what Jenny in accounting might do, it's about what someone who steals her credentials will absolutely do."

...even if Jenny truly is a menace to the company.

If someone we don't trust is in our network, we have a much bigger problem.

It's about threat mitigation. Just because an attacker has gained a foothold doesn't mean they've already started to enumerate or spread or pwned your entire infrastructure. For all you know he's contained on one machine, where he's stuck trying to guess at server locations and credentials to the next. This is a small and simple problem to remediate.

But with credentials floating around in the clear, if he starts eavesdropping on network traffic, he can obtain new sets of credentials to masquerade as and new locations to breach. The scope of his infiltration expands quickly, as do the number of places for him to maintain persistence in your network. Only now has that "bigger problem" materialized.

Answer 2

Quite simply, it's the people that you trust the most that can screw you the hardest. Yes, if you have someone you don't trust in your network, you have a huge problem. Many small companies, however, have this implicit trust model and get burned by it as they grow and find out that some people, despite our best belief in them, do things they aren't supposed to that really hurt the company.

Good security looks at the most likely players - your internal employees are the biggest threat overall. They're already on your network, and by definition trusted. So their potential for damage is high. Remember, you're only one disgruntled employee from disaster. Here is an article on Forbes; you can also check out NIST and other security publications (such as ISSA or ISACA) for more info. Webmasters SE has a good answer to this.

I'd start by not sounding accusatory toward the staff. Read up on best practices. Get facts from ISSA and from ISACA and NIST about why to secure your internal web servers. Look up STIG Viewer for practices and reasons. Be ready to explain the benefits. You want to show this exec that the reason you want to do this is because it's the right thing to do, and other companies do it for very good reasons. Also, executives see things in terms of cost/benefit ratio. If it's cheaper to do nothing, and the risk is low, then they'll invariably choose doing nothing. This is where Management needs to educate the executive about the level of risk and how to mitigate that risk.

Answer 3

Practical demonstrations or as mentioned above a third party pentest:

• Map your network with bloodhound to show the fastest path to your DC
• Demonstrate mimikatz on a workstation extracting credentials
• The provide an example on how an external could breach an employee workstation or employee (DDE + Macros, external endpoints without MFA, brute force)

Highlight that the security industry works under assumed breach in this day and age. By the sounds of it this company already is and just don't know it.

Perhaps a cost breack down of a breach vs the cost of fixing these insecure practices, an exec after all is about the numbers.