Escalating privileges ....


Before I pointed at this talk which refers to this web page full of notes (look under files) which further points at other talks regarding security holes on windows machines using (mostly) items already on a standard windows install.

This one is entertaining but hard to understand because the one of the speakers talks very softly and the other loudly.

This one is facsinating, but ... the ....pauses....of.....the....speaker....drive...me....to....sleep.
I found it funny that the word insomnia is at the bottom of his slides.
Regardless he is clearly talented and knows what he's talking about and worth noting.

Most of this is a distraction from the basics.
As noted by my SANS instructor: "if you don't know what is on your network, and you don't know your patching level, [targeted] attacks are not what you need to worry about."

HOWEVER, having at least a passing knowledge of how these attacks work will help when you are doing the next base-unit build out and inventory.  (did I mention you need to inventory and baseline your base-build so you know where your starting?)

suggested basics reading

Just some links I found that are useful for basic reading/watching/listening:

I have not yet found a good list of security basics for the IT department of small and medium sized organizations.
I'm looking, as I want my list to be based of research not gut.
I was at last years ShmooCon and there was an EXCELLENT talk on good inexpensive basic security.  I had a five minute talk with the speakers trying to work out a way to extend their talk into a full blown conference.  I was over-reaching.  Just now, a full year later, I'm bringing this to your attention.


WATCH THIS FIRST it is that shmoocon talk posted on youtube.
The first 36 minutes focuses almost exclusively on AppLocker, a very useful and important tool in the IT toolbox.
Next up is client side firewalls.  A much maligned and seriously overlooked option that makes a BIG difference in how things work.  That is most of what they cover, but listen to the words and concepts.  They are talking about the basics, not the fancy expensive stuff.  Listen to minute 47 and 48.  Aaron states "make it too expensive to attack you and they will go elsewhere". 
These two succeed in putting good basic security into their environment.
The rest of us should follow suit.

The SANS reading room, basics section.

An older writeup by someone working in the pharmaceutical world. Not great but does have some good ideas.

CSO Online basics series, some of which is very good and much of it is .... not so good. read carefully.

Mississippi Government page on basic online security which is mostly a group of links, much of which is worth reading.

Secure Messaging - an EFF review

Very Interesting. This is NOT in the basics. However it is worth noting. Many if not most of us use chat/messaging of some sort every day. We often consider those conversations private. Unfortunately they are often no more private than a discussion in a crowded bar or party. It will take some effort for others to listen in, but its far from private. The EFF has done a high level basic overview of a great many messaging services and programs available today. Then they put their findings into a chart (HERE). Go look, read carefully, tell me what you think. The interesting notes I picked up on in my first read through were: 1) Gchat sucks for security 2) The various i-Apps are surprisingly not as bad 3) Adium and Pidgin, old standbys for me from my last job, really are very good, of course the server back end needs to be secure as well..... using them with google chat will not give you the same results. Take-away: for most of us out there, there is not a lot of choice. Your average person does not run their own XMPP server. They want their data accessible from one tool, and they want to use the same service their friends use. For those of us tasked with running secure environments, you have to think about where you will spend your resources. Your time is not limitless and unless you really lucky, neither is your budget. Read it over, think on how it affects you, and in all likelihood, go back to what you were doing before.

RTFM....The BOOK

I said before that Read The F*****G Manual was an important part of the basics. Well two people in the industry with far more chops than me took that to heart and wrote it down. Ben Clark wrote and published the Red Team Field Manual. (amazon link: http://www.amazon.com/Rtfm-Red-Team-Field-Manual/dp/1494295504/ref=sr_1_1?ie=UTF8&qid=1415380905&sr=8-1&keywords=rtfm ) This is not a basics book. This is a book of references and tricks used by pen-testers and useful to anyone deep enough into security to be testing their environment in the same way. Again, I highly recommend the book, but not as a basic or beginner item. Don Murdoch wrote and published the Blue Team Handbook (amazon link: http://www.amazon.com/Blue-Team-Handbook-condensed-Responder/dp/1500734756/ref=sr_1_1?s=books&ie=UTF8&qid=1415381049&sr=1-1&keywords=blue+team+handbook ) This is a more useful book to the average sys-admin because it is geared more as a how-to than as a straight up reference. It augments your basic security understanding specifically as pertains to incident response. It in no way replaces a good basic foundation. Caveat: I have not yet read either book. All my knowledge on them comes from listening to interviews with both authors. I intend to read the Blue team book and get/use the RTFM and I will update this post when I do.