Insider Threat Podcast

In our thirteenth edition of the Insider Threat Podcast, we were joined by my STEALTHbits teammates, Adam Laub, the Senior Vice President of Product Marketing, and Gabriel Gumbs, VP of Product Strategy. We discussed our 2017 Cybersecurity Recap & 2018 Predictions Report, and tried to focus on the prediction part of things since we are at the start of the new year. After a quick look over the shoulder at the trends we spotted in 2017, we move right through to the predictions. Adam, Gabe, and I each had our own take. Probably most surprising is where Adam wanted to focus versus the rest of us. It’s always fun to play futurist for a little while, especially when you’re thinking about rich, complex topics like these.

In our eleventh edition of the Insider Threat Podcast, we were joined by my STEALTHbits teammates, Adam Laub, the Senior Vice President of Product Marketing and Dan McLaughlin, Technical Product Manager. Dan & Adam are the dynamic duo that helped usher out our release of StealthDEFEND version 1. StealthDEFEND is our new real-time threat analytics and alerting component of STEALTHbits’ Data Access Governance suite. We discussed ransomware, unsupervised machine learning, and more.

Click here to learn more about StealthDEFEND.

In our twelfth edition of the Insider Threat Podcast, we were joined by my STEALTHbits teammate, Adam Laub, the Senior Vice President of Product Marketing. In a reversal of the typical flow of things, Adam had questions for me. With the release of StealthAUDIT 8.1 fast approaching, he wanted to know how some of the headline features fit into the view of the world from an insider threat perspective. 8.1 is a minor release, and, as is usual with a minor release, most of what is in it is there because customers asked for it. There is a lot of insider threat relevant features because so many of you tell us so often how much you want to reduce those threats. So Adam and I had plenty to discuss.

In our tenth edition of the Insider Threat Podcast, we were joined by NetApp Senior Technical Marketing Engineer, Justin Parisi. Justin is making the rounds ahead of the NetApp ONTAP version 9.3 release this week. Of course, we wanted to get the conversation focused on insider threats and other security topics. We managed to do just that.

The ninth edition of the Insider Threat Podcast, Jonathan Sander and Gabriel Gumb did a little role reversal while talking about File System attacks.

Adam Laub is the Senior Vice President of Product Marketing at STEALTHbits Technologies talks with host Jonathan Sander about his time at Microsoft Ignite 2017 last week. They discuss threat protection, our Capture the Flag (CTF) game based on Active Directory, the Red Desktop/Blue Desktop demonstrations, and more.

File System Attack Series: https://blog.stealthbits.com/attack-step-1-finding-where-data-lives-file-system-attacks

Correction – Upcoming Webinar is on Oct. 12:

10+ Up-To-Date Ways to Harden Windows Against Modern Active Directory Attacks:

https://www.ultimatewindowssecurity.com/webinars/register.aspx?id=1464

In our seventh edition of the Insider Threat Podcast, once again we spoke with our resident white hat hacker, Jeff Warren. We’ve just partnered with Randy Franklin Smith at Ultimate Windows Security to deliver some of Randy’s “real training for free” on detecting and mitigating Active Directory (AD) attacks from our ongoing blog series. I’ve worked with Randy for years and we have a good relationship, but Jeff and he have been having a lot of fun geeking out with these AD Attacks.

In our fifth edition of the Insider Threat Podcast, we caught up with Gabriel Gumbs who has just spent the week at Black Hat 2017. Gabriel is the STEALTHbits VP of Product Strategy and his mission was to meet with some of our customers and partners at the show as well as bring back any interesting exploits and vulnerabilities that were on display for us to chew on. He certainly found a few. There were, of course, the usual set of topic that have been mainstays for years. Security for cloud and leveraging analytics and emerging machine learning methods to help us do our hunting more effectively. There was a bigger focus on IoT (Internet of Things) than in years past. Given the waves of IoT botnets that were roaming the web in packs the last 18 months, that is no surprise.

IoT botnets were not the bots we were looking for, though. We were much more interested in the Active Directory based botnet that researchers from Threat Intelligence presented. This AD botnet represents a big shift in the way the bad guys may view AD going forward. AD has typically been a target. It is an end – you get data like passwords and PII from its records. This new attack turns AD into a means. It becomes a means to gain persistence and movement across segmented networks. Done well, this trick isn’t something that will affect AD in any real way. That means it will not be apparent unless you’re looking for it pretty specifically.

The AD botnet was only one of three big stage sessions dedicated to AD security. All of them brought new twists to how bad guys can attack AD as part of a greater mission to steal enterprise data. In the podcast we run down all three and look forward to Gabe writing a detailed series of blog posts talking about each one, what it means, and how STEALTHbits can help prevent and defend your Active Directory from all of them.

Click here to listen to the podcast.

To be notified of Insider Threat Podcast episodes, sign up here

In our fourth edition of the Insider Threat podcast, we have our favorite guest Jeff Warren on to discuss the latest in the AD attack series of blog posts. These attacks are always fascinating, but this one must be the most interesting yet. These attack vectors are simultaneously obscure and powerful. Most attackers aren’t sophisticated enough to leverage AD permissions in these ways, but those that are rank as the most dangerous. We started with a simple definition of what these AD permissions attacks really are. In essence, it’s about taking advantage of the sometimes complex and always well-hidden ways AD gives you to set permissions on AD objects. This is not using AD groups to grant permissions to files. This is the permission you would set on that AD group within AD itself. If you know how to take advantage of these permissions, you can find ways to reset administrator account passwords (and thereby own them), take over sensitive groups, and even have AD itself become an ally in keeping your foothold strong as an attacker.

If that last one sounds a bit fantastic, then you really need to go read about the AdminSDHolder attack in the blog series. Briefly, it takes a mechanism designed to enhance the security of sensitive groups in AD (e.g. Enterprise Admins) and subverts it to keep granting permissions on those groups to attackers even after they have been ousted from them. It is nasty stuff. It really cuts to the heart of why these permissions attacks are so effective when used correctly. The permissions are what should protect your AD objects. When attackers poison that well, what’s meant to protect becomes the real threat. Something like AdminSDHolder is also quite obscure, and, as Jeff tells us in the podcast, much of what is out there online about it is either out of date or not very helpful. Of course, that’s why we’re doing all this. We want to share it all with you so you can make the best defenses you can. But it is also about us trying to ensure we’re doing the right things by finding and mastering every last vector of attack we can find that is fodder for us to build the ultimate AD protection.

Click here to listen to the podcast.

To read the full blog series accompanying the podcast, please click here.

To be notified of Insider Threat Podcast episodes, sign up here.