Reduzindo riscos através do controle de usuários privilegiados, auditoria e vulnerabilidades

Transcrição

1 Reduzindo riscos através do controle de usuários privilegiados, auditoria e vulnerabilidades Bruno Caseiro, CISSP, GWAPT, CEH, MCSE Sr. Security Sales Engineer BeyondTrust Software 0

2 Agenda Sobre a Beyondtrust Exemplos de falhas de segurança do passado e do presente O que podemos fazer para reduzir a superfície de ataque? 1 1

3 BeyondInsight IT Risk Management Platform: Capabilities Reporting & Analytics Central Data Warehouse Asset Discovery Asset Profiling Asset Smart Groups User Management Workflow & Notification Third-Party Integration Vulnerability Management External Risk Management Vulnerability Management Regulatory Compliance Reporting Configuration Compliance Assessment Integrated Patch Management Endpoint Protection Agents Privilege & Access Management Internal Risk Management Privileged Password Management Shared Account Password Management Privileged Session Management Privileged Threat Analytics User Activity and Entitlement Auditing AD Bridge for UNIX/Linux and Mac Automated AD Recovery & Protection IT Security: Optimize Controls IT Risk: Calculate Risk Management: Compliance & Audit: Prioritize Investments Produce Reports IT Operations: Prioritize Mitigation 2 2

4 Algumas brechas de segurança mundialmente conhecidas BeyondTrust Software 3

5 MALICIOUS & ACCIDENTAL INSIDERS Excessive privileges Unmanaged passwords Accounts hijacked by attackers 4 4

6 High Profile Breaches in JPMorgan 5 5

7 High Profile Breaches in ShellShock 6 6

8 High Profile Breaches in Anthem 7 7

9 Source: 2014 BeyondTrust Survey of 265 IT decision makers. 8 8

10 Como alguém geralmente pode ter acesso aos seus sistemas (servidores, switches, estações)? Através da utilização de contas, geralmente privilegiadas (usuário / senha) Exploração de uma vulnerabilidade; Instalação de malwares (trojans, spyware, etc) 9 9

11 O que podemos fazer para reduzir a superfície de ataque? BeyondTrust Software 10

12 Controlar o acesso à contas privilegiadas Solução: Powerbroker Password Safe BeyondTrust Software 11

13 PowerBroker Password Safe Manager (Web Interface) 2 B PowerBroker Safe Administrator or Auditor (Web or CLI Interface) 1 C User (Web Interface) Password Request Password (Retrieved via SSH, HTTPS) 3 Password Request Password (Retrieved via API, PBPSRUN) Application or Script 4 Login w/ Password Login w/ Password Routers / Switches Firewalls Windows Servers Unix/Linux Servers SSH/Telnet Devices IBM iseries Servers IBM ZSeries Servers AD/LDAP Directories Databases 13 13

14 Gerenciamento de sessões / proxy de acesso 14 14

15 Reprodução de sessões (auditoria) 15 15

16 Idade das senhas (identifique contas inativas) 16 16

17 Relatório com as contas de serviço 17 17

18 Como reduzir a superfície de ataque Solução: PowerBroker for Windows / Unix BeyondTrust Software 19

19 Superfície de ataque Overview Como você prefere proteger suas estações e servidores? Usuários privilegiados administradores Usuários comuns 20 20

20 Reduzindo a superfície de ataque PowerBroker for Windows 21 21

21 Superfície de ataque para Malware Usuário Privilegiado 22 22

22 Superfície de ataque para Malware Usuários comuns 23 23

23 Identificar todos usuários privilegiados 25 25

24 Quais aplicações só funcionam com admin rights? 26 26

25 Eleve somente às aplicações necessárias e legítimas para seu negócio 27 27

26 Dê acesso privilegiado à certas aplicações, sem revelar a senha privilegiada (menos senhas, maior a segurança) Função Run As (sem que os usuários saibam a senha); Casos de uso: Microsoft SQL Studio, AD Users and Computers, etc

27 Application Control / Whitelisting

28 Monitore o que os usuários fazem durante o acesso às aplicações críticas 30 30

29 Malware Analysis 31 31

30 Auditoria para: File Servers, Active Directory, Exchange, Event Viewer; Databases: Oracle, MSSQL, and DB BeyondTrust Software 32

31 Monitore alterações no Active Directory User, Group, OU, Printer (deleted, changed, created, etc) Who? When? Where? What? 33 33

32 Proteja objetos críticos no AD Specify that in the domain admins group, only the user cassio can make changes. Even other domain admins will not be able to change that

33 Auditoria para servidores de arquivo Who accessed the file salary.xls in the last 30/60/90 days? Who is really accessing/changing your critical data? me if someone delete or change the file secrets.doc 35 35

34 Auditoria para Microsoft Exchange An message has disappeared. When it happened, who deleted? Who is reading your CEO messages? Only him? Really? Would you like to receive an alert when if it occurs? 37 37

35 Auditoria para MSSQL, Oracle, and DB2 What changes occurred in the last 24 hours? Is there someone looking at sensitive tables like salary, credit cards, etc? Would you like to receive an alert if a suspicious activity occurs? 38 38

36 Descubra suas vulnerabilidades, priorize e elimine (automaticamente)!retina CS Vulnerability Management / Patch management BeyondTrust Software 39

37 40 BeyondInsight Retina CS Audit Vulnerabilities across all your IT environment

38 Que tipo de vulnerabilidades você deve priorizar? 41 41

39 Patch Management - Patches for Microsoft (Windows, MSSQL, Office, etc); - Java; - Adobe; - Winrar; - Firefox, Chrome, etc 42 42

40 Risk Matrix Reduction 43 43

41 PowerBroker Privileged Account Management: Validated by the industry BeyondTrust is a representative vendor for all five key feature solution categories. 1 Deploying the BeyondTrust PAM platform provides an integrated, onestop approach to PAM one of only a small band of PAM providers offering end-to-end coverage. 2 BeyondTrust is a pure-player in the Global Privileged Identity Management market and holds a significant position in the market. 3 "Frost & Sullivan endorses PowerBroker Password Safe. 4 "Leverage a solution like BeyondTrust s PowerBroker for Windows to transparently remove administrator privileges. 5 BeyondTrust is a Major Player in Privileged Access Management. 6 BeyondTrust is a vendor you can rely on BeyondTrust PowerBroker Auditor suite is an impressive set of flexible and tightly integrated auditing tools for Windows environments. 7 1 Gartner, Market Guide for Privileged Account Management, June 17, Ovum, SWOT Assessment: BeyondTrust The BeyondInsight and PowerBroker Platform, November 5, TechNavio, Global Privileged Identity Management Market , Frost & Sullivan, PowerBroker Password Safe a Frost & Sullivan Product Review, Forrester, Introducing Forrester s Targeted Hierarchy of Needs, May 15, IDC, IDC MarketScape: Worldwide Privileged Access Management 2014 Vendor Assessment, March Kuppinger Cole, Executive View: BeyondTrust PowerBroker Auditor Suite, March

42 Obrigado! Bruno Caseiro BeyondTrust Software 45

43 Desafio! Quantos usuários possuem direitos de administrador em seu ambiente? Quantas contas de serviço existem em seu ambiente? Quem está acessando as 5 principais pastas de sua empresa? Se você criar um usuário HACKER e colocá-lo dentro do grupo Domain Admins no Active Directory, em quanto tempo isso será notado? Há quanto tempo as senhas abaixo não são trocadas? Domain administrator on Windows; Administrator account in your MS-Windows workstations; Root in your Linux and Unix systems; Admin password for your networking devices (switches, firewall, etc); SA password for your MS-SQL or Sysadmin for your Oracle Quantas vulnerabilidades podem ser exploradas em seu ambiente? Facilmente exploradas por ferramentas exploits disponíveis na Internet 46 46

44 Recommendations: The SANS 20 Critical Security Controls v Inventory of Authorized & Unauthorized Devices 2. Inventory of Authorized & Unauthorized Software 3. Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers 4. Continuous Vulnerability Assessment and Remediation 5. Malware Defenses 6. Application Software Security Asset Risk Management 7. Wireless Device Control 8. Data Recovery Capability 9. Security Skills Assessment and Appropriate Training to Fill Gaps 1. Limitation and Control of Network Ports, Protocols, and Services 2. Controlled Use of Administrative Privileges 3. Boundary Defense 4. Maintenance, Monitoring, and Analysis of Audit Logs 5. Controlled Access Based on the Need to Know 6. Account Monitoring and Control 7. Data Loss Prevention User Risk Management 8. Incident Response and Management 9. Secure Network Engineering 10. Penetration Tests and Red Team Exercises 10. Secure Configurations for Network Devices such as Firewalls, Routers, and Switches 47 47

45 W A R N I N G You are about to install some malware. Malware is bad. By reading this warning through to the end and still clicking yes you are failing the Windows Darwin Test. Don t be that guy, if you are reading this message still then wise up and for the love of your family photos on your hard drive click the No button. Yes No 48 48