Category: Security

What is Cross-Site Scripting (XSS) & How to Defend Against It

What is XSS?

XSS is a type of injection which if successful, allows an attacker to run scripts on the victim’s machine. A web-app is vulnerable, if it uses unsanitized user input.

There are three main XSS types:

  • Stored XSS: This is the most dangerous type of XSS. This is where a malicious string originates from the website’s database.
  • Reflected XSS: This payload is part of the victims request to the website. The website includes this payload in response back to the user.
  • DOM-Based XSS: DOM (Document Object Model) is a programming interface for HTML and XML documents. It represents the page so that programs can change the document structure, style and content.

How to defend against the Broken Access Control?

Using frameworks that automatically escape XSS by design.
Escape mistrusted HTTP request data.
Apply context-sensitive encoding when modifying the browser document on the client side.
Enable a CSP (Content Security Policy).

 

What is Security Misconfiguration & How to Defend Against It

What Security Misconfiguration is?

Security misconfigurations are when security could have been configured properly but was not, and can happen at any level of an application stack. Automated scanners are useful for detecting the misconfigurations.Often this Vulnerability give attackers unauthorized access to system data, sometimes can end up in a complete system compromise.

Security misconfigurations often include:

  • Poorly configured permissions.
  • Having unnecessary features enabled.
  • Out of date web applications
  • Insufficient firewall protection
  • Default configurations (default accounts and default passwords).
  • Overly detailed error messages.
  • Unencrypted files

How to defend against the Security Misconfigurations?

  • Remove any unnecessary features.
  • Regularly patch your systems and use up to date softwares.
  • Use strong and complex passwords
  • Use strong ACL (Access Control List) and other permissions.
  • Design the error messages (such as the error 404 page).
  • Use strong encryption protocols
  • Verify the effectiveness of the configurations and settings in all environments.

What is Broken Access Control & How to Defend Against It

What is Broken Access Control?

Broken Access Control is exploitation of access control, which is a primary skill of an attacker. The broken access control allows attackers to bypass authorization which can allow them to view sensitive data or perform tasks as if they were a privileged user. Access control weaknesses are common because of the lack in detection and the lack in effective functional testing by the developers. The attack if executed successfully, it does not have a limitation on the impact since based on the access that has been bypassed, the attacker might be able to read or modify the data.

How to defend against the Broken Access Control?

  • With the exception of public resources, deny by default.
  • Implement unified access control model and re-use it.
  • Model access controls should enforce record ownership.
  • Implement unique application business limit requirements as per the domain models.
  • Disable web server directory listing.
  • Deny access to backups and other sensitive data.
  • Implement Logging and detection.
  • JWT (JSON web tokens) should be cancelled on the server after logout.
  • Developers and QA (Quality Assurance) staff should include functional access control unit and integration tests.

 

What is XXE (XML External Entities) & How to Defend Against It

What is XXE?

XXE is where an attackers can exploit a vulnerable XML processor (file that reads and processes the XML), if the attacker can upload a payload in the form of XML document, can cause problems (such as it can allow the attacker to communicate to the system that the server is connected to and read data that is not for the users, cause the DOS (Denial Of Service) attack or may make changes in the configuration to allow port scanning or port opening which can then give them the option for RCE (Remote Code Execution))

Types of XXE attacks:

1) In-band XXE attack:
The in-band XXE attack allows the attacker to receive a response to the XXE payload.
2) out-of-band XXE attacks (also called blind XXE):
The blind XXE attack does not receives an immediate response from the web application.

How to defend against the XXE?

  • Developer training.
  • Use less complex data formats.
  • Patch or upgrade all XML processors and libraries.
  • Disable XXE processing in all XML parsers.
  • Whitelist server-side input validation, filtering, or sanitization.
  • Verify that XML file upload functionality validates incoming XML data.
  • Use virtual patching, API security gateways, WAF (Web Application Firewalls) to detect, monitor, and block XXE attacks.

 

What is Sensitive Data Exposure & How to Defend Against It

What is Sensitive Data Exposure?

Sensitive Data Exposure is when a web application reveals the sensitive data (often user information). this often happens when the web-app is either using weak encryption or no encryption at all and involve attacks such as MITM (Man In The Middle) attack, which means that the attacker intercepts the connection between the user and the server or forces the user connection through a they have access to. Sometimes the sensitive data is available on the web-server itself. If this vulnerability is exploited, it reveals the sensitive data (aften PII (Personally identifiable information)), which then often require response as defined by the Laws or regulations.

How to defend against the Sensitive Data Exposure?

  • Classify your data, whether it is sensitive or not.
  • Apply controls as per the classification.
  • Don’t store sensitive data unnecessarily.
  • Encrypt all sensitive data at rest.
  • use up-to-date and strong algorithms, protocols, and keys.
  • Encrypt all data in transit with secure protocols such as SSL/TLS with PFS (perfect forward secrecy) ciphers, cipher prioritization by the server. Enforce encryption using directives like HSTS (HTTP Strict Transport Security) and using HTTPS.
  • Disable caching for response that contain sensitive data.
  • Store passwords using strong adaptive and salted hashing function.
  • Verify the effectiveness of configuration and settings.

What is Broken Authentication & How to Defend Against It

What is Broken Authentication?

Authentication and session management are the core of modern web applications. While authentication is used to allow the verify a user and let them login to their accounts, Cookies are used as a tool for session management. A user will login using their credentials (Most common form of authentication), and then the user is assigned a cookie. A cookie is used to keep track, since the web protocol HTTP & HTTPS protocols are state-less (which means that the servers will not remember whether a client has or has not used the application before, and how many time).

Common fault in the authentication which causes it to break are:

  • Brute force: Brute force attacks means that an attacker guesses the username and passwords in multiple login attempts.
  • Weak passwords: Weak passwords means to have common or easy to guess password (Such as “password” or “admin”).
  • Weak session Cookies: Weak session cookies means if the session cookies used have predictable values in them, the attacker can set custom session cookies and access user accounts.

How to defend against the Broken Authentication Attacks?

  • Use a strong password policy to avoid password guessing.
  • Use a user account lock out strategy to avoid the brute force attack.
  • Use MFA to stop the terminate the single point of failure in the authentication system.

What are Brute-force Attacks & How to Defend Against Them

What are Brute-force Attacks?

A brute-force attack means to figure out a password by trying possible combination of letters, numbers, and symbols unless you find a combination that works. Depending on the password’s length and complexity, the process can take a long time, and you get unnecessary traffic. To speed up the process, an attacker ussually uses an attack known as dictionary attack, where they use the dictionary words or some midified version of those words. The attackers can also automate this process by using a tool like “Hydra”, “Hashcat”, or their custom scripts. Attacks like these are fairly easy to detect but if defended against them they could result in a catastrophe (For example if an admin account is compromised, or even if a standard user account is also compromised it can allow the hacker to laterally move in the network).

How to defend against Brute-force Attacks?

Strong passwords:

This means to make sure that users are using strong passwords: long unpredictable passwords, avoid reusing passwords, and change passwords regularly.

Account lock-out:

Account lock out means, after a defined number of incorrect login attempts the account will automatically get locked (For example the account can get lock for 30 seconds after the second attempt, 1 min and the 3rd and 4th attempt, and after the 5th attempt it, locks out and needs manual unlocking by an administrator).
The problems with account lockouts are:

  • An attacker can cause a denial of service (DoS) by locking out large numbers of accounts.
  • Because you cannot lock out an account that does not exist, only valid account names will lock. An attacker could use this fact to harvest usernames from the site, depending on the error responses.
  • An attacker can cause a diversion by locking out many accounts and flooding the help desk with support calls.
  • An attacker can continuously lock out the same account, even seconds after an administrator unlocks it, effectively disabling the account.
  • Account lockout is ineffective against slow attacks that try only a few passwords every hour.
  • Account lockout is ineffective against attacks that try one password against a large list of usernames.
  • Account lockout is ineffective if the attacker is using a username/password combo list and guesses correctly on the first couple of attempts.
  • Powerful accounts such as administrator accounts often bypass lockout policy, but these are the most desirable accounts to attack. Some systems lock out administrator accounts only on network-based logins.
  • Even once you lock out an account, the attack may continue, consuming valuable human and computer resources.

Device based lock-out:

This means locking out authentication attempts from known and unknown browsers or devices separately based on the information collected (via the cookies, locations or IP addresses).

Using CAPTCHAS:

CAPTCHAS are helpful to stop those automated attacks which means that the attacker will need to login manually which can take a long time, and the team has time to work on the recovery measures once alarmed.

How to find out if there has been a brute-force attempt?

  • Many failed logins from the same IP address
  • Logins with multiple usernames from the same IP address
  • Logins for a single account coming from many different IP addresses
  • Excessive usage and bandwidth consumption from a single use
  • Failed login attempts from alphabetically sequential usernames or passwords

What are SQL Injections & How to Defend Against Them

What is a SQL injection?

A SQL Injection is where an end user can input and run SQL Query in from the web application front end. A successful SQL exploit can modify and read the data, and also it can perform the DBMS (Database Management System) administration operations. The SQL Injection can be considered as a high impact severity since it can do any thing possible (from reading the data in the database to managing the complete DB), the limitation is based on the attackers skills and knowledge.

How to defend against SQL Injection?

Use of Parameterized Statements:

A parameterized statement means to pre-compile a SQL statement so you only need to provide the parameters in the statement for it to be executed.

Whitelist Input Validation:

Whitelist validation means to only accept the input that is known to be good. This can be done by validating with the expected type, length or size, numeric range, or other format standards before accepting the input for further processing.

Escaping All User Supplied Input:

Each DBMS supports one or more character escaping schemes specific to certain kinds of queries.

Assign Least Privilege:

Assign the Least Privilege required to every database account, so that users have enough permission to do their job, but no more.

How to setup event log forwarding in Windows and collect event logs from remote computers into a central server.

  1. in the command prompt run “winrm quickconfig” and the press y when prompted to enable the WinRM service & the firewall exception. (On the end user machine)

2. Open “Computer Management” > “System Tools” > “Local Users & Groups” > “Groups”. Then select “Event Log Readers”. Click “Add”, Choose the required object types by selecting “Object Types” (for this example I will be adding my ADDC machine). After that enter the Machine or account name and then select “OK”. Then click “Apply” and “OK”. (On the end user machine)

3. Open the “Event Viewer” (On the server)

4. Go to “Subscription” & click “Yes” (On the server)

5. Right click on “Subscriptions” and the select “Create Subscription”.(On the server)

6. Here provide a “Name” & “Description” for the Subscription. Then Select the destination for the log in the “Destination Log” field. (On the server)

7. Go to “Select Computers” and then “Add Domain Computers”. (On the server)

8. Enter the “Computer Name” & click “OK”. (On the server)

9. Select the Computer and click on “Test”. once the test is succeeded then click “OK”. (On the server)

10. Go to “Select Events”, select the Required “Event Level” and the “Event Logs” and then click “OK”. (On the server)

11. Go to “Advanced”, Select the “Account”, “Event Delivery Optimization”, Protocol and the Port Number (I will be using the machine acc., Normal Delivery optimization, HTTP Protocol and Port 5985 for this example). Then select “OK”. (On the server)

12. Right click the subscription and to go “Runtime Status”, Make sure the machine status is “Active”, and wait for 15 min. After 15 mins, the logs should start coming in the chosen tab (Forwarded Events in this example). (On the server)

MS-500 – Module 1: User and Group Management

Module 1: User and Group Management

This module explains how to manage user accounts and groups in Microsoft 365. It introduces you to the Zero Trust concept as well as authentication. The module sets the foundation for the remainder of the course.

Lessons

1. Identity and Access Management concepts
What is Identity and Access Management (IAM)?
    The goal of IAM is to “To centralize identity and access management for an organization & grant access to the right asset/information to the right user in the right context".

IAM is an authentication and authorization system put in place to manage
        1. how individuals are identified in a system
        2. user or groups access to the company information or services 
        3. roles and their access. 

Authentication is about verifying the user identity
Authorization is about defining and managing the roles and access privileges of individual network users and the circumstances in which users are granted (or denied) those privileges.
2. The Zero Trust model
What is Zero Trust?
     Zero Trust is a security focused concept which means that the systems will not automatically trust anything either from inside or outside the organization, instead the system must verify anything and everything that tries to connect with it.
3. Plan your identity and authentication solution
Cloud Identity

    With the cloud identity approach Azure Active Directory (AAD) becomes the       source of identity for the organization, and user accounts only exist in the cloud. The AAD identities are used by Office 365 services Such as Exchange Online, and can also be used to sign on to third party services that support federation with AAD such as Dropbox.

    Cloud identity works well for organizations with no on-prem AD since the users will only have to remember their one set of credentials (Since the AAD Credentials will be used everywhere). Cloud identity is less suitable for organizations that use a legacy on-premises Active Directory, because users will need to have two sets of credentials to remember (one for authentication to on-premises resources, while the other one for cloud services), and also increases the administrative work.

Directory Synchronization

    With the directory synchronization approach the on-prem AD is used as the source of identity. The Objects and their attributes are synced to the AAD from the on-prem AD using a directory synchronization tool such as the AD Connect. Since the objects and their attributes are synchronized the administrative work also remains less.  

    The directory synchronization tool can also synchronize the password hashes from on-prem AD to AAD so that the user can log on to cloud services with the same credentials. Without the Password sync, the users will have to remember two sets of credentials (just like before (Cloud Identity)). Another advantage of the password sync is that Office 365 authentication is not dependent on the on-prem AD. 


Directory Synchronization with Federated Identity

    With this approach, directory synchronization is used, however instead of using AAD, the authentication requests, will be passed to an on-prem AD Federation Services (AD FS). The ADFS is responsible for authenticating the user and providing an authentication token for the user to then access the cloud services. This also removes the need to synchronize password hashes to AAD, which makes it an attractive option for organizations that want a single source of identity without passwords (even hashes) being synced to an external service.

    Even though this can provide the experience closest to the SSO and at the same time provides much more control for enforcing organizational security policies, it means that we need to deploy, manage and maintain the ADFS infrastructure.
4. User accounts and roles
What is a user account? 
    A user account is an identity created for a person on a computer or in an AD. User accounts can also be created for machine entities, such as service accounts for running programs, system accounts for storing system files and processes, and root and administrator accounts for system administration.

Azure types of user accounts: 
    1. Administrator: A standard user account with some additional privileges.
    2. Standard user account: A standard user account.
    3. Guest account: A guest invited by someone in the organization

what are different types of roles and what do they mean?
    There are two types of roles available in Azure: 
        Azure AD roles: are used to manage Azure AD resources in a Azure directory such as Global Administrator and User Administrator
        Azure RBAC (Role Based Access control) roles: are roles that manage the access to the azure resources such as Owner, Contributor or Reader 

what is a role definition?
    A role definition is a collection of permissions that can be performed, such as read, write, and delete in a JSON file type. It's typically just called a role.

What is a scope?
    A scope is the set of resources that the access applies to. In Azure, you can specify a scope at four levels: management group, subscription, resource group, or resource. 

How are the user accounts assigned a role and access limit of that role?
    1. A service principal (user account, group or any other identity)
    2. a role definition is selected
    3. A scope is selected
5. Password Management
SSPR: Azure self-service password reset (SSPR) gives users the ability to change or reset their password, them-selves with out an administrator. If a user's account is locked or they forget their password, they can follow prompts to unblock themselves.

Smart Lockout: Smart lockout helps lock out bad actors that try to guess your users' passwords or use brute-force methods to get in. Smart lockout can recognize sign-ins that come from valid users and treat them differently than ones of attackers and other unknown sources.

Lab : Initialize your tenant – users and groups

  • Set up your Microsoft 365 tenant
  • Manage users and groups
How to create a user in AAD (Azure Active Directory) using Azure Portal          :    https://youtu.be/mEvTCiyG77w

How to make an assigned security group in AAD in Azure Portal
:    https://youtu.be/M3U8NLigOds

How to make a Dynamic Security Group in AAD in Azure Portal
:    https://youtu.be/BBfjOAxpxNE

Lab : Password management

  • Configure Self-service password reset (SSPR) for user accounts in Azure AD
  • Deploy Azure AD Smart Lockout
How to enable SSPR & MFA in AAD
:    https://youtu.be/mN-m8iAH2dQ
How to setup Account lock out settings in AAD in Azure Portal
:    https://youtu.be/xU4rgt5hsho

After completing this module, students will be able to:

  • Create and manage user accounts.
  • Describe and use Microsoft 365 admin roles.
  • Plan for password policies and authentication.
  • Describe the concepts of Zero Trust security.
  • Explain the Zero Trust model.