0-Trust

In the past several blogs I introduced the work I've been doing associated with the Azure Secured Workstation. I note that this solution IS an ideal 0-trust protection model that any organization looking to protecting key roles and service administrators from compromise is a must. And as this Zdnet's article identifies attacking a weak link is still the most prevalent means to get into your network.

In the article the Robin Hood ransomware was deployed using a targeted attack, and the installation a malicious driver. In this case the vulnerability in the Gigibyte driver makes the job of the hacker much simpler, but it's clear that if the targeted user (most likely an administrator) was using an isolated identity to manage their network, malware described in the article would fail to extend its foot hold in an organizations network.

What should you do.

First and foremost - create a new identity domain/forest. This can be pretty simple thanks to cloud computing. A quick AAD domain can be set up, and populated with your organizations administrators.

Disable mail, and messaging - Don't allow for your new identity domain to be mail enabled.

Move services - Look across your organization. Identify the high risk high value roles and move the authentication to use the new identity domain. In a db that's a matter of adding the user to your admin role, and resetting your local admin roles to a complex and unused account (which you write down and lock in a vault). This effort can be a bit more complex and time consuming, but you will benefit from having the ability to manage your services and reduce your risk profile considerably. You can also consider capabilities like Yubi key for authentication which is highly secure, and provides great isolation.

Consider a 0-trust workstation - Isolate your admins with a custom built laptop to manage critical services. This can be done by following my guidance here.