Recommended best practices for mitigating this threat include rigorous credential as well as privileged-access management, equally good equally remote-access control, as well as audits of legitimate remote-access logs. While these measures aim to foreclose the initial assault vectors as well as the spread of malicious activity, in that location is no unmarried proven threat response.
Using a defense-in-depth strategy is probable to increment the odds of successfully disrupting adversarial objectives long plenty to allow network defenders to unwrap as well as response earlier the successful completion of a threat actor’s objectives.
Any scheme that uses an MSP to furnish services should monitor the MSP’s interactions inside their organization’s corporation networks, such equally occupation concern human relationship use, privileges, as well as access to confidential or proprietary information. Organizations should also ensure that they receive got the might to review their safety as well as monitor their information hosted on MSP networks.
APT TTPs as well as Corresponding Mitigations
The next tabular array displays the TTPs employed past times APT actors as well as pairs them amongst mitigations that network defenders tin implement.
Table 1: APT TTPs as well as Mitigations
| APT TTPs | Mitigations |
|---|---|
| Preparation | |
| Protect:
Detect:
|
| Engagement | |
| Protect:
Detect:
Respond as well as Recover:
|
| Presence | |
Execution as well as Internal Reconnaissance:
Lateral Movement:
Credential Access:
| Protect:
Detect:
Respond as well as Recover:
|
| Effect | |
| Protect:
Detect:
|
Detailed Mitigation Guidance
Manage Credentials as well as Control Privileged Access
Compromising the credentials of legitimate users automatically provides a threat histrion access to the network resources available to those users as well as helps that threat histrion displace to a greater extent than covertly through the network. Adopting as well as enforcing a strong-password policy tin cut a threat actor’s might to compromise legitimate accounts; transitioning to multifactor authentication solutions increases the difficulty fifty-fifty further. Additionally, monitoring user occupation concern human relationship logins—whether failed or successful—and deploying tools as well as services to unwrap illicit work of credentials tin assist network defenders seat potentially malicious activity.
Threat actors regularly target privileged accounts because they non entirely grant increased access to high-value assets inwards the network, exactly also to a greater extent than easily enable lateral movement, as well as oft furnish mechanisms for the actors to shroud their activities. Privileged access tin endure controlled past times ensuring that entirely those users requiring elevated privileges are granted those accesses and, inwards accordance amongst the regulation of to the lowest degree privilege, past times restricting the work of those privileged accounts to instances where elevated privileges are required for specific tasks. It is also of import to carefully care as well as monitor local-administrator as well as MSP accounts because they inherently component amongst elevated privileges as well as are oft ignored after initial configuration.
A fundamental way to command privileged accounts is to segregate as well as command administrator (admin) privileges. All administrative credentials should endure tightly controlled, restricted to a function, or fifty-fifty express to a specific sum of time. For example, entirely dedicated workstation administrator accounts should endure able to administer workstations. Server accounts, such equally general, Structured Query Language, or e-mail admins, should non receive got administrative access to workstations. The entirely house domain administrator (DA) or corporation administrator (EA) credentials should always endure used is on a domain controller. Both EA as well as DA accounts should endure removed from the local-administrators grouping on all other devices. On UNIX devices, sudo (or root) access should endure tightly restricted inwards the same manner. Employing a multifactor authentication solution for admin accounts adds or thus other layer of safety as well as tin significantly cut the touching of a password compromise because the threat histrion needs the other factor—that is, a smartcard or a token—for authentication.
Additionally, administrators should disable unencrypted remote-administrative protocols as well as services, which are oft enabled past times default. Protocols required for operations must endure authorized, as well as the close secure version must endure implemented. All other protocols must endure disabled, especially unencrypted remote-administrative protocols used to care network infrastructure devices, such equally Telnet, Hypertext Transfer Protocol, File Transfer Protocol, Trivial File Transfer Protocol, as well as Simple Network Management Protocol versions 1 as well as 2.
Control Remote Access as well as Audit Remote Logins
- Control legitimate remote access past times trusted service providers. Similar to other administrative accounts, MSP accounts should endure given the to the lowest degree privileges needed to operate. In addition, it is recommended that MSP accounts either endure express to piece of work hours, when they tin endure monitored, or disabled until piece of work needs to endure done. MSP accounts should also endure held to the same or higher levels of safety for credential use, such equally multifactor authentication or to a greater extent than complex passwords dependent area to shorter expiration timeframes.
- Establish a baseline on the network. Network administrators should piece of work amongst network owners or MSPs to constitute what normal baseline deportment as well as traffic facial expression similar on the network. It is also advisable to utter over what accesses are needed when the network is non beingness actively managed. This volition allow local network personnel to know what acceptable cross-network or MSP traffic looks similar inwards price of ports, protocols, as well as credential use.
- Monitor scheme trial logs for anomalous activity. Network logs should endure captured to assist unwrap as well as seat anomalous as well as potentially malicious activity. In add-on to the application whitelisting logs, administrators should ensure that other critical trial logs are beingness captured as well as stored, such equally service installation, occupation concern human relationship usage, pass-the-hash detection, as well as RDP detection logs. Event logs tin assist seat the work of tools similar Mimikatz as well as the anomalous work of legitimate credentials or hashes. Baselining is critical for effective trial log analysis, especially inwards the cases of MSP occupation concern human relationship behavior.
- Control Microsoft RDP. Adversaries amongst valid credentials tin work RDP to displace laterally as well as access information on other, to a greater extent than sensitive systems. These techniques tin assist protect against the malicious work of RDP:
- Assess the demand to receive got RDP enabled on systems and, if required, boundary connections to specific, trusted hosts.
- Verify that cloud environments adhere to best practices, equally defined past times the cloud service provider. After the cloud environs setup is complete, ensure that RDP ports are non enabled unless required for a occupation concern purpose.
- Place whatever scheme amongst an opened upwards RDP port behind a firewall as well as require users to communicate via a VPN through a firewall.
- Perform regular checks to ensure RDP port 3389 is non opened upwards to the populace internet. Enforce strong-password as well as account-lockout policies to defend against beast forcefulness attacks.
- Enable the restricted-administrator alternative available inwards Windows 8.1 as well as Server 2012 R2 to ensure that reusable credentials are neither sent inwards plaintext during authentication nor cached.
- Restrict Secure Shell (SSH) trusts. It is of import that SSH trusts endure carefully managed as well as secured because improperly configured as well as overly permissive trusts tin furnish adversaries amongst initial access opportunities as well as the way for lateral displace inside a network. Access lists should endure configured to boundary which users are able to log inwards via SSH, as well as rootage login via SSH should endure disabled. Additionally, the scheme should endure configured to entirely allow connections from specific workstations, preferably administrative workstations used entirely for the purpose of administering systems.
Report Unauthorized Network Access
Contact DHS or your local FBI business office immediately. To study an intrusion as well as asking resources for incident response or technical assistance, contact NCCIC at (NCCICCustomerService@hq.dhs.gov or 888-282-0870), FBI through a local land office, or the FBI’s Cyber Division (CyWatch@fbi.gov or 855-292-3937).
