How not to get hacked: Microsoft

Powered by SC Magazine
 

Microsoft pushed security to the front of its Tech.Ed agenda on the Gold Coast this week, holding a developer and technical support session aimed explaining the easiest routes to hack attack on any IT network.

Microsoft pushed security to the front of its Tech.Ed agenda on the Gold Coast this week, holding a developer and technical support session aimed explaining the easiest routes to hack attack on any IT network.

Jesper Johanssen, enterprise security architect in the security, business and technology unit at Microsoft, told Tech.Ed attendees there were 10 easy ways to get any IT network hacked. First of all, don't patch anything. Then, run unhardened applications and services.

"All the interesting attacks these days happen through the applications," he said.

Johanssen said many vendors were more or less on top of any potential for operating system attack but few had much clue about how to best harden applications. "That's critically important," he said.

Companies should also avoid using an administrator account everywhere on the network. "That's a wonderful way for the bad guys to get it. You should be using least privilege. Different administrator access for everything."

Johanssen claims special insight into the way a hacker's mind operates. One of his previous tasks at Microsoft was going around figuring out how to attack Microsoft's networks.

He said organisations should avoid opening up lots of holes in their firewalls if they really wanted to be secure. However, in most cases that was simply unavoidable because companies often need to use the internet and allow traffic through.

"Opening port 80 -- that's the same as turning off your firewall really," he said. "Firewalls are pretty meaningless today because they're layer four, they block ports. Whereas the interesting things happen in layer nine or elsewhere."

He was less than positive about SSL VPN for the same reason. Organisations should install IPSec, which worked quite differently. "SSL VPN? That's not VPN. It's a giant hole in your firewall," Johanssen said.

Further, many organisations let all the clients and servers communicate, which he said was generally unnecessary. "That's what I call a Kum Bay Ah network --all the Windows machines getting together to sing 'Kum Bay Ah'."

Far better to only permit clients to talk to servers and vice versa if an organisation wanted to reduce the risk of getting hacked, he said.

Companies should restrict users from downloading applications from the internet but should also cut down the internal traffic. Outbound traffic should also be restricted, Johanssen said.

Meanwhile, passwords -- or, even better, passphrase -- should be unique for each user and each password-protected part of the network. Even if users wrote them down, it was far better that they used a set of unique passwords, Johanssen said.

Another trick was not to use high-level service accounts in many places. That invited risk because once that service account was cracked, it gave lots of further possibilities to the hacker, he said.

Last of all, never assume everything is OK, he said. "You live a lot longer in this business if you have a healthy level of paranoia," Johanssen said.

Attention to those issues was more likely to keep out attackers than buying "cheap" software from certain of Microsoft's "rivals", Johanssen said.

Fleur Doidge travelled to Tech.Ed on the Gold Coast as a guest of Microsoft.

 
 
 
Top Stories
Soft drinks and SoftLayer: A solution for hard times?
Coca-Cola Amatil's CIO Barry Simpson shares his story of cost-cutting, outsourcing and why his software developers to ride around in delivery trucks.
 
Optus considers breaking net neutrality in Australia
May charge Netflix, OTT providers for premium service.
 
AGL restructure sees CIO depart
Owen Coppage to leave after ten years.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Small business win in a budget with 'fair' savings: Abbott
Apr 17, 2015
Tony Abbott has reaffirmed that the government’s aim is “always to get taxes ...
Xero now includes an inventory function built-in
Mar 26, 2015
Xero has added inventory and other major new features to the latest release of its cloud ...
Apple reveals its new MacBook
Mar 13, 2015
Replacing the MacBook Air as Apple's thinnest laptop, the new MacBook comes packed with features.
Xero has released a new version of its app for the iPad
Mar 6, 2015
iPad-wielding Xero users can now take advantage of a new version of the iOS app for the cloud ...
Microsoft is offering Azure for Disaster Recovery to Australian SMBs
Feb 10, 2015
If you haven't talked to your IT provider about disaster recovery, it might be worth discussing ...
Latest Comments
Polls
Do you support the Government's data retention scheme?

   |   View results
Yes
  11%
 
No
  89%
TOTAL VOTES: 2335

Vote