How not to get hacked: Microsoft

Powered by SC Magazine
 

Microsoft pushed security to the front of its Tech.Ed agenda on the Gold Coast this week, holding a developer and technical support session aimed explaining the easiest routes to hack attack on any IT network.

Microsoft pushed security to the front of its Tech.Ed agenda on the Gold Coast this week, holding a developer and technical support session aimed explaining the easiest routes to hack attack on any IT network.

Jesper Johanssen, enterprise security architect in the security, business and technology unit at Microsoft, told Tech.Ed attendees there were 10 easy ways to get any IT network hacked. First of all, don't patch anything. Then, run unhardened applications and services.

"All the interesting attacks these days happen through the applications," he said.

Johanssen said many vendors were more or less on top of any potential for operating system attack but few had much clue about how to best harden applications. "That's critically important," he said.

Companies should also avoid using an administrator account everywhere on the network. "That's a wonderful way for the bad guys to get it. You should be using least privilege. Different administrator access for everything."

Johanssen claims special insight into the way a hacker's mind operates. One of his previous tasks at Microsoft was going around figuring out how to attack Microsoft's networks.

He said organisations should avoid opening up lots of holes in their firewalls if they really wanted to be secure. However, in most cases that was simply unavoidable because companies often need to use the internet and allow traffic through.

"Opening port 80 -- that's the same as turning off your firewall really," he said. "Firewalls are pretty meaningless today because they're layer four, they block ports. Whereas the interesting things happen in layer nine or elsewhere."

He was less than positive about SSL VPN for the same reason. Organisations should install IPSec, which worked quite differently. "SSL VPN? That's not VPN. It's a giant hole in your firewall," Johanssen said.

Further, many organisations let all the clients and servers communicate, which he said was generally unnecessary. "That's what I call a Kum Bay Ah network --all the Windows machines getting together to sing 'Kum Bay Ah'."

Far better to only permit clients to talk to servers and vice versa if an organisation wanted to reduce the risk of getting hacked, he said.

Companies should restrict users from downloading applications from the internet but should also cut down the internal traffic. Outbound traffic should also be restricted, Johanssen said.

Meanwhile, passwords -- or, even better, passphrase -- should be unique for each user and each password-protected part of the network. Even if users wrote them down, it was far better that they used a set of unique passwords, Johanssen said.

Another trick was not to use high-level service accounts in many places. That invited risk because once that service account was cracked, it gave lots of further possibilities to the hacker, he said.

Last of all, never assume everything is OK, he said. "You live a lot longer in this business if you have a healthy level of paranoia," Johanssen said.

Attention to those issues was more likely to keep out attackers than buying "cheap" software from certain of Microsoft's "rivals", Johanssen said.

Fleur Doidge travelled to Tech.Ed on the Gold Coast as a guest of Microsoft.

 
 
 
Top Stories
 
IAG hands digital chief his own ‘Labs’ division
Enterprise ops chief squeezed out in restructure.
 
End of IT shared services experiment looms for SA govt
Centralised tech trickles to a halt.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
The 5 Windows 10 privacy issues you should be aware of
Jul 31, 2015
There are a few unsettling details when it comes to Windows 10 privacy
Windows 10 is here! (For some)
Jul 29, 2015
Delivery of the free upgrade versions of Windows 10 began today - have you got yours yet?
Microsoft reveals Microsoft Send, a new enterprise chat app to rival Slack
Jul 27, 2015
Microsoft Send is MSN Messenger for grownups, and you could be using it at work very soon
Developers offered $500,000 grants to find HoloLens uses
Jul 8, 2015
Can augmented-reality end up in business?
Microsoft Tossup: The planning app for unorganised groups of friends
Jul 8, 2015
App allows friends to research venues, vote on plans and chat. And depending on how you run your ...
Latest Comments
Polls
Should law enforcement be able to buy and use exploits?



   |   View results
Yes
  14%
 
No
  51%
 
Only in special circumstances
  17%
 
Yes, but with more transparency
  18%
TOTAL VOTES: 784

Vote