Use Strong Passwords

• Require all accounts with password logins (e.g., service account, admin accounts, and domain admin accounts.) to have strong, unique passwords. Passwords should not be reused across multiple accounts or stored on the system where an adversary may have access.
• Note: devices with local administrative accounts should implement a password policy that requires strong, unique passwords for each individual administrative account.

Implement Multi-Factor Authentication

• Require multi-factor authentication for all services to the extent possible, particularly for webmail, virtual private networks, and accounts that access critical systems.
  • Yes, MFA can be a pain for users who just want things to be convenient, but that’s where you have to be disciplined as an organization and instill a culture of security awareness. You have to model this behavior throughout your org, and insist on it for every one of your employees.

Patch and Update Systems

• Keep all operating systems and software up to date. Timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats. The vast majority of ransomware attacks exploit outdated software with security vulnerabilities to gain access to system-wide resources. If you keep your software up to date, those vulnerabilities are far less likely to present themselves to attackers.

Limit Access to Resources over the Network

• Remove unnecessary access to administrative shares, especially ADMIN$ and C$. If ADMIN$ and C$ are deemed operationally necessary, restrict privileges to only the necessary service or user accounts and perform continuous monitoring for anomalous activity.
  • The more you can limit the total number of accounts with admin privileges, the better for your operational security. If an employee does expose your IT stack through a phishing link, etc., if they’re not admin, they have much less access to critical systems. As such… the fewer admin accounts, the less likely your entire system is compromised during a breach.
• Use a host-based firewall to only allow connections to administrative shares via SMB from a limited set of administrator machines.

Implement Network Segmentation and Traversal Monitoring

Adversaries use system and network discovery techniques for network and system visibility and mapping. To limit an adversary from learning the organization’s enterprise environment, limit common system and network discovery techniques by taking the following actions:

• Segment networks to prevent the spread of ransomware. Network segmentation can help prevent the spread of ransomware by controlling traffic flows between—and access to—various subnetworks and by restricting adversary lateral movement.
• Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a networking monitoring tool. To aid in detecting the ransomware, implement a tool that logs and reports all network traffic, including lateral movement activity on a network. Endpoint detection and response (EDR) tools are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each host.

These strategies are pretty advanced if you’re a small or medium-sized business without a dedicated CTO. That’s where a managed service provider like Leverage comes in — we can set these things up for you to ensure your system safety without cramping your operations or workflows.

Use Admin Disabling Tools to Support Identity and Privileged Access Management

There has been an observed increase in ransomware attacks during non-business hours, especially holidays and weekends. CISA, the FBI, and NSA recommend organizations do the following:

• Implement time-based access for accounts set at the admin-level and higher. For example, the Just-in-Time (JIT) access method provisions privileged access when needed and can support enforcement of the principle of least privilege (as well as the Zero Trust model). This is a process where a network-wide policy is set in place to automatically disable admin accounts at the AD level when the account is not in direct need. When the account is needed, individual users submit their requests through an automated process that enables access to a system, but only for a set timeframe to support task completion.
• Disable command-line and scripting activities and permissions. Privilege escalation and lateral movement often depend on software utilities that run from the command line. If threat actors are not able to run these tools, they will have difficulty escalating privileges and/or moving laterally.

Again — this is super important at a system-wide level, but can be relatively complex to set up and execute. Consider working with a managed service provider to help you set up, monitor and police these implementations.