Hello, welcome to the Friday, July 26, 2019 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich.

I'm recording from Jacksonville, Florida.

Well, we got sort of a nice theme going this weekend with our Diaries at the United Storm Center, and it's all about people and what could possibly go

wrong with various user accounts. So today we have Rob talk about how to restrict access for

in particular administrators and also limited administrator access to people that actually

needed. Rob of course a big fan of the critical controls is you and also limit administrator access to people that actually need it.

Rob, of course, a big fan of the critical controls is using those critical controls to outline some of the steps that you can take in order to make your network more secure.

For example, by using crew policy objects and restricting where administrators can actually log into.

One of the important things that Raw points out is that these controls have to also take into account that administrators should never use software like email clients or web browsers as administrator. They should always use

their own lower product accounts for these high-risk activities. So some interesting ideas

here from Rob and certainly will make a great weekend read if you haven't read it yet.

And yet more news about the Blue Keep vulnerability.

That's the famous RDP vulnerability where everybody is waiting for the big exploit to come out.

Well, there is now an exploit available as part of immunity's Canvas penetration testing tool.

Now Canvas is a pretty expensive commercial package.

I think licenses run around sort of $30,000 a year, so nothing your average criminal would

necessarily purchase.

But in the past, it has happened that Canvas exploits have leaked soon after

they were included in the product, just because, for example, a customer of Canvas was compromised.

But what this means is that certainly for some of the more sophisticated attackers, $30,000 may not be that much and they

may already have a copy of Canvas anyway for other purposes. So would certainly make sure

yet again that you are patched for Blue Keep and this will put a working exploit in reach of more attackers.

...