How not to get hacked: Microsoft

Powered by SC Magazine
 

Microsoft pushed security to the front of its Tech.Ed agenda on the Gold Coast this week, holding a developer and technical support session aimed explaining the easiest routes to hack attack on any IT network.

Microsoft pushed security to the front of its Tech.Ed agenda on the Gold Coast this week, holding a developer and technical support session aimed explaining the easiest routes to hack attack on any IT network.

Jesper Johanssen, enterprise security architect in the security, business and technology unit at Microsoft, told Tech.Ed attendees there were 10 easy ways to get any IT network hacked. First of all, don't patch anything. Then, run unhardened applications and services.

"All the interesting attacks these days happen through the applications," he said.

Johanssen said many vendors were more or less on top of any potential for operating system attack but few had much clue about how to best harden applications. "That's critically important," he said.

Companies should also avoid using an administrator account everywhere on the network. "That's a wonderful way for the bad guys to get it. You should be using least privilege. Different administrator access for everything."

Johanssen claims special insight into the way a hacker's mind operates. One of his previous tasks at Microsoft was going around figuring out how to attack Microsoft's networks.

He said organisations should avoid opening up lots of holes in their firewalls if they really wanted to be secure. However, in most cases that was simply unavoidable because companies often need to use the internet and allow traffic through.

"Opening port 80 -- that's the same as turning off your firewall really," he said. "Firewalls are pretty meaningless today because they're layer four, they block ports. Whereas the interesting things happen in layer nine or elsewhere."

He was less than positive about SSL VPN for the same reason. Organisations should install IPSec, which worked quite differently. "SSL VPN? That's not VPN. It's a giant hole in your firewall," Johanssen said.

Further, many organisations let all the clients and servers communicate, which he said was generally unnecessary. "That's what I call a Kum Bay Ah network --all the Windows machines getting together to sing 'Kum Bay Ah'."

Far better to only permit clients to talk to servers and vice versa if an organisation wanted to reduce the risk of getting hacked, he said.

Companies should restrict users from downloading applications from the internet but should also cut down the internal traffic. Outbound traffic should also be restricted, Johanssen said.

Meanwhile, passwords -- or, even better, passphrase -- should be unique for each user and each password-protected part of the network. Even if users wrote them down, it was far better that they used a set of unique passwords, Johanssen said.

Another trick was not to use high-level service accounts in many places. That invited risk because once that service account was cracked, it gave lots of further possibilities to the hacker, he said.

Last of all, never assume everything is OK, he said. "You live a lot longer in this business if you have a healthy level of paranoia," Johanssen said.

Attention to those issues was more likely to keep out attackers than buying "cheap" software from certain of Microsoft's "rivals", Johanssen said.

Fleur Doidge travelled to Tech.Ed on the Gold Coast as a guest of Microsoft.

 
 
 
Top Stories
First look: Microsoft Outlook for iOS
[Update] Office productivity suite for iOS completed with Outlook.
 
NewSat defaults on $26m in overdue Lockheed payments
Jabiru-1 satellite build hits further hurdles.
 
IBM denies plans to cut 112k jobs
But admits to further restructuring.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Microsoft Outlook is now on iPhone and iPad: why could this be useful?
Jan 30, 2015
Microsoft today released Office for Android and Outlook for iOS - complementing the other Office ...
Franchisees, here's something you should know about
Jan 23, 2015
You need to know the Code if you are a franchisee or franchisor as the penalties are significant.
Xero users rejoice! Quoting has finally arrived
Jan 23, 2015
It has taken years, but Xero has at last added integrated quoting to its online accounting software.
You can now get a no-contract wi-fi tablet from Telstra
Jan 17, 2015
Telstra has began selling wi-fi tablets out of contract without paying extra for cellular ...
Get your business ready for 2015: mobile payments
Jan 2, 2015
These handy apps from MYOB, Xero and others can reduce your administrative load and improve ...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  36%
 
Your insurance company
  5%
 
A technology company (Google, Facebook et al)
  8%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  4%
 
A Federal Government agency (ATO, Centrelink etc)
  18%
 
An Australian law enforcement agency (AFP, ASIO et al)
  14%
 
A State Government agency (Health dept, etc)
  7%
TOTAL VOTES: 3096

Vote
Do you support the abolition of the Office of the Information Commissioner?

   |   View results
I support shutting down the OAIC.
  27%
 
I DON'T support shutting the OAIC.
  73%
TOTAL VOTES: 986

Vote