What are SQL Injections & How to Defend Against Them

What is a SQL injection?

A SQL Injection is where an end user can input and run SQL Query in from the web application front end. A successful SQL exploit can modify and read the data, and also it can perform the DBMS (Database Management System) administration operations. The SQL Injection can be considered as a high impact severity since it can do any thing possible (from reading the data in the database to managing the complete DB), the limitation is based on the attackers skills and knowledge.

How to defend against SQL Injection?

Use of Parameterized Statements:

A parameterized statement means to pre-compile a SQL statement so you only need to provide the parameters in the statement for it to be executed.

Whitelist Input Validation:

Whitelist validation means to only accept the input that is known to be good. This can be done by validating with the expected type, length or size, numeric range, or other format standards before accepting the input for further processing.

Escaping All User Supplied Input:

Each DBMS supports one or more character escaping schemes specific to certain kinds of queries.

Assign Least Privilege:

Assign the Least Privilege required to every database account, so that users have enough permission to do their job, but no more.

How to setup event log forwarding in Windows and collect event logs from remote computers into a central server.

  1. in the command prompt run “winrm quickconfig” and the press y when prompted to enable the WinRM service & the firewall exception. (On the end user machine)

2. Open “Computer Management” > “System Tools” > “Local Users & Groups” > “Groups”. Then select “Event Log Readers”. Click “Add”, Choose the required object types by selecting “Object Types” (for this example I will be adding my ADDC machine). After that enter the Machine or account name and then select “OK”. Then click “Apply” and “OK”. (On the end user machine)

3. Open the “Event Viewer” (On the server)

4. Go to “Subscription” & click “Yes” (On the server)

5. Right click on “Subscriptions” and the select “Create Subscription”.(On the server)

6. Here provide a “Name” & “Description” for the Subscription. Then Select the destination for the log in the “Destination Log” field. (On the server)

7. Go to “Select Computers” and then “Add Domain Computers”. (On the server)

8. Enter the “Computer Name” & click “OK”. (On the server)

9. Select the Computer and click on “Test”. once the test is succeeded then click “OK”. (On the server)

10. Go to “Select Events”, select the Required “Event Level” and the “Event Logs” and then click “OK”. (On the server)

11. Go to “Advanced”, Select the “Account”, “Event Delivery Optimization”, Protocol and the Port Number (I will be using the machine acc., Normal Delivery optimization, HTTP Protocol and Port 5985 for this example). Then select “OK”. (On the server)

12. Right click the subscription and to go “Runtime Status”, Make sure the machine status is “Active”, and wait for 15 min. After 15 mins, the logs should start coming in the chosen tab (Forwarded Events in this example). (On the server)

MS-500 – Module 1: User and Group Management

Module 1: User and Group Management

This module explains how to manage user accounts and groups in Microsoft 365. It introduces you to the Zero Trust concept as well as authentication. The module sets the foundation for the remainder of the course.

Lessons

1. Identity and Access Management concepts
What is Identity and Access Management (IAM)?
    The goal of IAM is to “To centralize identity and access management for an organization & grant access to the right asset/information to the right user in the right context".

IAM is an authentication and authorization system put in place to manage
        1. how individuals are identified in a system
        2. user or groups access to the company information or services 
        3. roles and their access. 

Authentication is about verifying the user identity
Authorization is about defining and managing the roles and access privileges of individual network users and the circumstances in which users are granted (or denied) those privileges.
2. The Zero Trust model
What is Zero Trust?
     Zero Trust is a security focused concept which means that the systems will not automatically trust anything either from inside or outside the organization, instead the system must verify anything and everything that tries to connect with it.
3. Plan your identity and authentication solution
Cloud Identity

    With the cloud identity approach Azure Active Directory (AAD) becomes the       source of identity for the organization, and user accounts only exist in the cloud. The AAD identities are used by Office 365 services Such as Exchange Online, and can also be used to sign on to third party services that support federation with AAD such as Dropbox.

    Cloud identity works well for organizations with no on-prem AD since the users will only have to remember their one set of credentials (Since the AAD Credentials will be used everywhere). Cloud identity is less suitable for organizations that use a legacy on-premises Active Directory, because users will need to have two sets of credentials to remember (one for authentication to on-premises resources, while the other one for cloud services), and also increases the administrative work.

Directory Synchronization

    With the directory synchronization approach the on-prem AD is used as the source of identity. The Objects and their attributes are synced to the AAD from the on-prem AD using a directory synchronization tool such as the AD Connect. Since the objects and their attributes are synchronized the administrative work also remains less.  

    The directory synchronization tool can also synchronize the password hashes from on-prem AD to AAD so that the user can log on to cloud services with the same credentials. Without the Password sync, the users will have to remember two sets of credentials (just like before (Cloud Identity)). Another advantage of the password sync is that Office 365 authentication is not dependent on the on-prem AD. 


Directory Synchronization with Federated Identity

    With this approach, directory synchronization is used, however instead of using AAD, the authentication requests, will be passed to an on-prem AD Federation Services (AD FS). The ADFS is responsible for authenticating the user and providing an authentication token for the user to then access the cloud services. This also removes the need to synchronize password hashes to AAD, which makes it an attractive option for organizations that want a single source of identity without passwords (even hashes) being synced to an external service.

    Even though this can provide the experience closest to the SSO and at the same time provides much more control for enforcing organizational security policies, it means that we need to deploy, manage and maintain the ADFS infrastructure.
4. User accounts and roles
What is a user account? 
    A user account is an identity created for a person on a computer or in an AD. User accounts can also be created for machine entities, such as service accounts for running programs, system accounts for storing system files and processes, and root and administrator accounts for system administration.

Azure types of user accounts: 
    1. Administrator: A standard user account with some additional privileges.
    2. Standard user account: A standard user account.
    3. Guest account: A guest invited by someone in the organization

what are different types of roles and what do they mean?
    There are two types of roles available in Azure: 
        Azure AD roles: are used to manage Azure AD resources in a Azure directory such as Global Administrator and User Administrator
        Azure RBAC (Role Based Access control) roles: are roles that manage the access to the azure resources such as Owner, Contributor or Reader 

what is a role definition?
    A role definition is a collection of permissions that can be performed, such as read, write, and delete in a JSON file type. It's typically just called a role.

What is a scope?
    A scope is the set of resources that the access applies to. In Azure, you can specify a scope at four levels: management group, subscription, resource group, or resource. 

How are the user accounts assigned a role and access limit of that role?
    1. A service principal (user account, group or any other identity)
    2. a role definition is selected
    3. A scope is selected
5. Password Management
SSPR: Azure self-service password reset (SSPR) gives users the ability to change or reset their password, them-selves with out an administrator. If a user's account is locked or they forget their password, they can follow prompts to unblock themselves.

Smart Lockout: Smart lockout helps lock out bad actors that try to guess your users' passwords or use brute-force methods to get in. Smart lockout can recognize sign-ins that come from valid users and treat them differently than ones of attackers and other unknown sources.

Lab : Initialize your tenant – users and groups

  • Set up your Microsoft 365 tenant
  • Manage users and groups
How to create a user in AAD (Azure Active Directory) using Azure Portal          :    https://youtu.be/mEvTCiyG77w

How to make an assigned security group in AAD in Azure Portal
:    https://youtu.be/M3U8NLigOds

How to make a Dynamic Security Group in AAD in Azure Portal
:    https://youtu.be/BBfjOAxpxNE

Lab : Password management

  • Configure Self-service password reset (SSPR) for user accounts in Azure AD
  • Deploy Azure AD Smart Lockout
How to enable SSPR & MFA in AAD
:    https://youtu.be/mN-m8iAH2dQ
How to setup Account lock out settings in AAD in Azure Portal
:    https://youtu.be/xU4rgt5hsho

After completing this module, students will be able to:

  • Create and manage user accounts.
  • Describe and use Microsoft 365 admin roles.
  • Plan for password policies and authentication.
  • Describe the concepts of Zero Trust security.
  • Explain the Zero Trust model.

MS-500: Microsoft 365 Security Administration – Introduction & Overview

Role Outline

The Microsoft 365 Security administrator plan and implement security strategies, to ensures that the solutions comply with the policies and regulations of the organization. This role proactively secures Microsoft 365 enterprise environments.

Continue reading “MS-500: Microsoft 365 Security Administration – Introduction & Overview” →