Defense at every stage

admin
2015-07-10T16:39:57+00:00

Another tweet struck me for it's common sense and truth:

To me, this is defense-in-depth defined. I will also point out that the "two effective security technologies that stand the test of time" (firewalls and two-factor authentication) can be make these stages harder for attackers:

Implementing two-factor authentication for remote access will make intrusion much more difficult.

Implementing two-factor authentication for privileged accounts will make escalation much more difficult.

Implementing two-factor authentication at your outbound proxy will make exfiltration much more difficult.

We have seen a big increase in the use of two-factor authentication for remote access (thanks to regulations like PCI, often). I think we're about to see a big increase in two-factor authentication for privileged access management both for systems administrators and third-party access. We have recommended using pam_radius to implement two-factor authentication for Sudo for a long, long time. Now with more tools for privileged access management available we will see this in the Windows world. It's well past time. In addition to thwarting escalation, such a setup would make detection easier and therefore movement and persistence more difficult as well.

I don't think we will see too much 2FA for out-bound access except for organizations with high-value IP. Organizations should be able to implement it quickly - in case they think there has been an intrusion.

You don't want to create new identity silos when doing this. Make sure that your authentications run through your directory even if you have to setup a RADIUS server to make it happen. (With the possible exception of vendors that you don't want in your active directory.)

The hardest part is most likely not the implementation, but convincing users and management that it's worthwhile to avoid being the next OPM.