On June 27, 2017 a number of organisations across Europe began reporting significant system outages caused by a ransomware strain referred to as Petya. The ransomware is very similar to older Petya ransomware attacks from previous years, but the infection and propagation method is new, leading to it being referred to as NotPetya. Due to the sudden and significant impact of the attack, it was immediately likened to the WannaCry outbreak causing concerns globally.
Firms across the globe have been hit by a variant of the Petya or Petwrap strain of ransomware impacting Windows servers, PCs, and laptops. Initial reports suggest this latest attack struck The Ukraine initially but it has quickly spread to many other countries including Russia, Spain, France, the UK, The Netherlands, and the US. Currently the attackers are asking for $300 worth of Bitcoins to retrieve access to data, however, there are reports that a business in South Korea has paid $1m to get access.
Many, if not all organizations that I work with have been on a PAM journey of some description – some successful, some not so much, but all have had considerable investment along the way. In this blog, I want to explore the value-add of PAM, its principles, and ultimately the security posture delivered by the approach.
In this blog post, I want to share some of my experiences on how company culture can kill a security project, especially when removing admin rights.
In the era of next-gen technology, it's the often-forgotten basics that provide the best foundations. By reducing the attack surface and building secure defensible endpoints you'll be in a far better position to stop cyber attacks and keep your data safe.
Recently, the Avecto team travelled to the Middle East for a four-country roadshow, hopping from KSA to UAE, Jordan and finally Lebanon. We travelled with the esteemed Microsoft MVP, Sami Laiho and our partners in the region Crestan, in a bid to spread the message of the importance of back to basics security and for Sami to showcase the simplicity of breaking Windows without the right security foundations in place.
The challenge of finding the right balance between giving too many admin rights vs. too little admin rights is often talked about from the end user perspective, however the same challenge applies to those managing the IT department itself and this is a part of the journey that is often overlooked.
Last week saw the launch of the latest Microsoft Vulnerabilities Report, Avecto’s leading research project into the security bulletins issued by the software giant over the past 12 months. Now in its third year, the report has consistently provided intriguing insight into today’s threat landscape, the common attack vectors and the products within the Microsoft portfolio that cause IT departments the most sleepless nights.
“We’ve done it!” – The majority of your users have admin rights removed, meaning your environment is far more secure than it was before and you’ve successfully mitigated 85% of critical vulnerabilities in Windows. But are you as secure as you think? A surprisingly common pitfall that we come across in the support team are those who, either intentionally or unwittingly, elevate everything. Everything.
Here in the Avecto Support Team we come across various issues with customers that wish to allow their users to perform elevated tasks in Windows once their Administrator rights have been removed; this can vary from changing Windows settings or allowing a legacy app to run with admin rights for compatibility reasons, to installing complex application suites.