One of the risks being simulated for organizations are stolen laptops.
Was wondering if anyone had a methodology/list of items to check when assessing the security of Windows laptops.
Here is my list so far:
- Check that disk encryption (using TPM) is in use
- Trying to steal credentials from locked machine by abusing USB permissions Bash Bunny (quickcreds)
- Spoofing various services that Windows relies on in enterprise environments (Responder)
- Port scanning for open/vulnerable services
- Vuln scan for cases where running unpatched version of Windows
What are some other things that can be tried that can add value to the test?