Moving from Checkbox Compliance to True Data Security

Moving from Checkbox Compliance to True Data Security

Organizations are shifting their focus to a core set of principles around protecting their credentials and data, but they struggle with a starting point. In this 6-part ‘Checkbox Compliance to True Data Security’ blog series, we will provide a foundational blueprint. The series will cover an overview of Data Access Governance (DAG) and introduce the 5 phases that will help shape a true data security program. In an interview with Dark Reading, Brian Christensen, head of global audit for Protiviti…

Read More Read More

Top 15 Data Security Sessions at the RSA Conference 2018

Top 15 Data Security Sessions at the RSA Conference 2018

With more than 40,000 security professionals converging on the Moscone Center in San Francisco, we will be taking over the City by the Bay for the week of RSA (April 16-20). In this blog post, I just wanted to give some helpful tips from a Bay Area native and also recommend some Data Security sessions that look interesting from the agenda. Of course, there is always our session at 3:10 p.m. PDT on Wednesday, April 18 in the South Briefing…

Read More Read More

File System Attacks – Insider Threat Podcast #9

File System Attacks – Insider Threat Podcast #9

In the ninth edition of the Insider Threat Podcast, Jonathan Sander and I did a little role reversal. I played Zorak to Jonathan’s Space Ghost and was asking the questions – the topic this week is File System attacks. A topic that we have noticed not many struggles with, but one that we increasingly see as an attack vector. Jonathan has been researching these attacks recently and has been blogging about them in length. So we sat down to talk…

Read More Read More

Attack Step 3: Persistence with NTFS Extended Attributes – File System Attacks

Attack Step 3: Persistence with NTFS Extended Attributes – File System Attacks

What Does Persistence Mean on a File System? In our first file system attack, we found places where we’re likely to get good data with the credentials we’ve been able to steal. Our second attack let us focus in on only the data that is worth the time to steal so we can lessen the chances of getting caught – or at least get the best stuff before we do. The final stage in these attacks is typically persistence. Finding…

Read More Read More

Attack Step 2: Targeting Interesting Data – File System Attacks

Attack Step 2: Targeting Interesting Data – File System Attacks

Sifting Through The Sands In the last post, we looked at how to find file shares where data we may want to steal lives. We used both Python based and PowerShell based approaches to this. Now we’re going to take the next step and find actual files of interest. Even the smallest organization can have many thousands of files. The bad guys would drown in all that data if they didn’t have ways to narrow down what they’re looking for….

Read More Read More

STEALTHbits at Microsoft Ignite 2017 – Insider Threat Podcast #8

STEALTHbits at Microsoft Ignite 2017 – Insider Threat Podcast #8

In our eight edition of the Insider Threat Podcast, we spoke with the most senior member of the STEALTHbits team, Adam Laub. Adam had just been to the Microsoft Ignite conference and brought us some insight into what the pulse of the show was. We brought our new focus on Threat Protection to the show in a big way. People’s reactions were very positive. We had more people stopping by and spending time with us than ever before. Of course,…

Read More Read More

Attack Step 1: Finding Where Data Lives – File System Attacks

Attack Step 1: Finding Where Data Lives – File System Attacks

Finding Where Interesting Information May Live We’re going to make some assumptions at the start of this attack. We will assume we already have full access to any credentials we need. Why? Because we’ve already shown you how you can grab any credential you might need all the way up to the highest level of administrative rights. The question you now need to ask is this: what can you do with those rights? Credentials are the means, but data is…

Read More Read More

File System Attacks

File System Attacks

Credentials Are the Means to Attack Data If you’ve been reading the attack blog series until now, you’ve seen we have focused on attacks against Active Directory – like attacking core AD infrastructure, leveraging AD service accounts to attack, attacking AD with misconfigured permissions, and our series on Mimikatz attacks. Of course, AD is the hub for so much access to data in any organization that it may feel like those attacks actually compromise everything else. Today we’re kicking off…

Read More Read More

Start a Free StealthAUDIT® Trial!

No risk. No obligation.