If your control for ransomware is backups, what dependencies does your backups have?
Watch more videos on my YouTube channel.
Archive for November, 2016
Stuck in Traffic – Controls for Rogue SVGs
Posted byCreating an attack path for criminals distributing malware over FaceBook with SVGs, and assigning controls along the path.
Watch more videos on my YouTube channel.
Stuck in Traffic – Roadmaps and Backlogs
Posted byAfter the security gap assessment, there’s a backlog of items to fix and improve. These all go on the roadmap. However, we need to think of the roadmap as a flexible document that’s updated as our situation changes.
Watch more videos on my YouTube channel.
Prevent ransomware threats to cloud apps with backup, security tools
Posted byRansomware — a form of cyberattack that interrupts access to an organization’s data until that organization pays a ransom fee — has grown from a rare occurrence in IT to a substantial and growing threat for enterprises. Ransomware encrypts files with a key only the attacker has, making it impossible for target organizations to crack it.
Ransomware has blossomed to the point where it now represents about one-third of the incidents handled by Creative Breakthrough Inc. (CBI), a managed services provider focused on IT security and risk assessments, based in Detroit.
“This is a reflection of the criminalization of hackers that we have seen over the past several years,” said J. Wolfgang Goerlich, director of security strategy at the company, adding that, just because your workloads are in the cloud, “doesn’t mean you are in the clear.”
Read the rest here: http://searchcloudcomputing.techtarget.com/tip/Prevent-ransomware-threats-to-cloud-apps-with-backup-security-tools
Stuck in Traffic – Delivering Malware via SVG
Posted byWebsite whitelisting is a great control. But it means the attacker will move to Websites on the list, like Facebook. Add to that, using SVG images to deliver malware. Suddenly, we have a failure in the Balloon Tower defense in depth.
Watch more videos on my YouTube channel.
Stuck in Traffic – Email Attachments
Posted byWe’ve come a long way since the days of dial-up email, like Juno. Email is now equally a vector for communications and accidental disclosures. Here are some ways to add protections.
Watch more videos on my YouTube channel.
Stuck in Traffic – Resetting Passwords and Bypassing Encryption in Linux
Posted byLinux is broken. Everyone panic! Or, not. Two stories, two security principles, and a gentle reminder for risk management, in today’s video.
Watch more videos on my YouTube channel.
Stuck in Traffic – Breaches that Aren’t
Posted byToday, we look at the impact of things that didn’t actually happen. Just because it was not a breach, doesn’t mean there was not an impact.
Watch more videos on my YouTube channel.
Stuck in Traffic – Threshold Model of Collective Behavior
Posted byApplying the threshold model of collective behavior to security culture. It can be hard to get a large group of people to change. An easier starting point is to change the first couple people.
Watch more videos on my YouTube channel.
Viewing cached credentials and clearing cached credentials in Windows 10
Posted byThis article applies to Windows 10 Anniversary Update (Version 1607). For previous versions of Windows, please see the earlier article.
What are cached credentials?
Windows 10 caches and stores usernames and passwords for Active Directory domains, other computers, apps like Outlook, websites, and FTP sites. This makes it easier to authenticate as you don’t have to type in the username and password every single time. But it does pose a risk of those credentials getting misused.
Where are Windows 10 credentials stored?
Active Directory credentials. Domain credentials (usernames and passwords are stored on the local computer’s registry as salted hashes. This is under HKEY_LOCAL_MACHINE\Security\Cache, found in the %systemroot%\System32\config\SECURITY file.
Generic credentials. You can view Website and Windows credentials by launching the Credential Manager (credwiz.exe).
Internet credentials. You can view Internet usernames and passwords in the Internet Control Panel (inetcpl.cpl). Run inetcpl.cpl, go to Content, scroll to Autocomplete, click Settings, and click on Manage Passwords.
When do Windows 10 cached domain credentials expire?
Unfortunately, Windows domain credentials don’t expire in the cache. Within Active Directory, expiration is set on the user object. But if the credential is still valid in Active Directory, the cached copy will still work.
It is possible to control how many credentials are cached using the group policy: Interactive logon: Number of previous logons to cache (in case domain controller is not available)
Designing CyberSecurity | Weekly Blog Series
Designing and architecting security? Join our weekly conversation on what hackers can learn from artists and designers.
- Driving security forward with architecture principles
- Starting with empathy
- Making security about Ray-Bans not safety goggles
- Future-proofing security controls
How to reset Windows 10 credentials? How to remove Windows 10 credentials?
Active Directory credentials. Open the registry to HKEY_LOCAL_MACHINE\Security\Cache, grant your user account read/write access. Close and reopen the registry to have the access control take effect. Zeroing out the NL$x binary value will clear the cached credential.
Generic credentials. Open the Credential Manager (credwiz.exe to view Website and Windows credentials. Select and remove the passwords you wish to clear.
Internet credentials. Open the Internet Control Panel (inetcpl.cpl), go to Content, scroll to Autocomplete, click Settings, and click on Manage Passwords. Select and remove the passwords you wish to clear.
Outlook email. To view and clear Outlook passwords on Windows 10, first use the Credential Manager instructions above. Then, download the SaveCredentials.exe tool and follow the directions here.
Windows Live Essentials. To view and clear Windows Live Essentials passwords on Windows, first use the Credential Manager instructions above. Find the SSO_POP_Device. This credential provides Single Sign-On (SSO) access for the Post Office Protocol (POP) when accessing a variety of Microsoft email platforms (@hotmail.com, @msn.com, @outlook.com, etc).
Why bother clearing Windows 10 credentials?
The main reason people follow this article is to troubleshoot cached Windows credentials, Active Directory credentials, domain issues, or problems with apps like Internet Explorer and Outlook. Removing the passwords from Windows allows it to reset and fix authentication issues.
The other reason? Well, security. A common tactic from penetration testers to red teamers to criminals is to gain access to cached credentials. From there, they may be replayed to connect to IT systems, or cracked and reused as part of a larger attack. To prevent this, minimize the data stored on your computer and minimize the likelihood of it being stolen or copied.