Harden your security configuration and limit lateral movement
Harden your security configuration and limit lateral movement
To limit the impact of a successful compromise, segregate administration groups and limit their scope, which can be achieved by using an Active Directory (AD) tier model or Microsoft’s enterprise access model. Use purpose-dedicated service accounts with the least privilege principle to limit the impact of one account being compromised.
To further secure domain admin accounts, make sure they are:
Kept at minimum (less than 5 is recommended).
ONLY used to connect to domain controllers.
Not allowed to connect to the internet.
Configured with unique, random, long and complex passwords.
Used to connect remotely only in case of emergency (using VPN with MFA).
Monitored, with alerts in place.
Other security hardening best practices are described here.
There is no one single control or tool that can completely protect your organisation against the possibility of a cyberattack. Through a multi-layered approach to identifying and addressing vulnerabilities on every level, your system and assets will be far better protected.
Jad Nehmé
Cyber Client Experience Manager, Paris
Claims Example
A large healthcare organisation with 150 hospitals and clinics was victim of a system infiltration. The cybercriminal entered the network through a single compromised user account at one clinic and, because there was no network filtering between sites, quickly moved laterally within the network to reach the corporate data centre.
From there, they moved to other clinics’ networks, stealing sensitive data. Once the incident was discovered, our client cut off all network connections, isolating all sites; with no baseline of acceptable network flows, it was impossible to quickly identify malicious traffic without shutting everything down.
Two specialised vendors were engaged to investigate and open each network flow one by one. Resolution took several weeks, with significant business interruption consequences.
The information set forth in this communication is intended as general risk management information. It is made available with the understanding that Beazley does not render legal services or advice. It should not be construed or relied upon as legal advice and is not intended as a substitute for consultation with counsel. Although reasonable care has been taken in preparing the information set forth in this communication, Beazley accepts no responsibility for any errors it may contain or for any losses allegedly attributable to this information. Non-insurance products and services are provided by non-insurance company Beazley affiliates and independent third parties. Separate terms and conditions may apply.
There is no one single control or tool that can completely protect your organisation against the possibility of a cyberattack. Through a multi-layered approach to identifying and addressing vulnerabilities on every level, your system and assets will be far better protected.
