Active Directory in ICS: Lessons Learned From The Field
15 likes7,801 views
This document provides lessons learned from implementing Active Directory domains in control system environments. It covers topics like time synchronization, DNS, Active Directory replication, domain controller maintenance, backup and restore, user and group guidelines, and ICS group policy. The key lessons are: accurate time sync is critical; DNS configuration on domain controllers must include the loopback address; Active Directory replication links need to be properly configured; flexible single master operations roles should be transferred before domain controller maintenance; individual user accounts should be used instead of shared administrator accounts; and group policy can be used to apply security settings to control systems. The presentation provides guidance on best practices, common problems encountered, and their solutions.
Ad
More Related Content
What's hot (20)
Viewers also liked (20)
Ad
Similar to Active Directory in ICS: Lessons Learned From The Field (20)
Ad
More from Digital Bond (12)
Recently uploaded (20)
Active Directory in ICS: Lessons Learned From The Field
- 1. L L d f th Fi ldLessons Learned from the Field Active Directory in ICS HPS Industrial Cyber Security Services DigitalBond S4x15 January 2015
- 2. AbstractAbstract • Many control systems don’t have domains or leverage them l f th ti ti Th i t d d t h lonly for user authentication. They are intended to help centralize the maintenance and management of a large group of member computers, as well as huge productivity gains for administration, implementing change, and consistency. This, p g g , y session will cover lessons learned of Active Directory domains and their use with control systems, from someone who deals only with control system environments. What works, what to avoid guidance on how to plan & implement certain featuresavoid, guidance on how to plan & implement certain features, and useful things you may not have known about. This is not an introduction to Active Directory, it is intended for those that have familiarity with Active Directory, its purpose, basic administration d li tand group policy management. • 45 minutes Honeywell Proprietary 2 2015
- 3. SpeakerSpeaker • Donovan Tindill, Senior Security Consultant – Honeywell Industrial Cyber Security (formerly Matrikon)Cyber Security (formerly Matrikon) – For almost 15 years, specialized in defending cyber security for industrial automation & control systems (IACS) to most every industry and countless ICS. R ibl f l l j t l i t i i k– Responsible for large scale project planning, enterprise risk management, security program development, training, vulnerability assessments, industry compliance, NERC CIP, etc. – ISA99/IEC62443 contributor, and co-chair of Working Group 6 on IACSg p patch management. – Assessed and designed LOTS of ICS networks and domains, cyber security assessments (people-process-technology), developed ICS cyber security programs etccyber security programs, etc. – Email: http://tinyurl.com/DonovanAtHon; Please connect on LinkedIn and mention this conference. The views and opinions expressed here are my own and don’t necessarily representThe views and opinions expressed here are my own and don t necessarily represent the views or opinions of Honeywell.
- 4. Honeywell Industrial Cyber SecurityHoneywell Industrial Cyber Security Honeywell Industrial Cyber Security is the leading provider ofy y y g p cyber security solutions that help protect the availability, safety, and reliability of industrial control systems (ICS) and plant operations. Leveraging our industry leading process control andLeveraging our industry leading process control and cyber security experience, our expertise, and technology, we deliver proven solutions designed for thewe deliver proven solutions designed for the specific needs of process control environments. Honeywell Proprietary 4 2015 Cyber Security = Process Availability, Safety and Reliability
- 5. Honeywell ProtectsHoneywell Protects From the Inside Out and Outside In • Build security into our products Employ same risk-management mechanisms for cyber security– Employ same risk-management mechanisms for cyber security we design for safe industrial operations • Strengthen security with proven end-to-end solutions – Security architecture, security controls and best industrial practices – Services delivered by global team of experts A ti d t ti d ili• Assure continued protection and resilience – Situational awareness – Monitoring, management and training services Honeywell Proprietary 5 2015
- 6. Industrial Cyber Security Solutions FrameworkIndustrial Cyber Security Solutions Framework Embedded Security Is Just the Start SecuritySecurity AwarenessAwareness Cyber Security Assessments, Monitoring and Situational Awareness Cyber Security Assessments, Monitoring and Situational Awareness SecuritySecuritySecuritySecurity TECHNOLOGY Used to Drive Secure Architectural Leveraging Network, Host & Used to Drive Secure Architectural Leveraging Network, Host & yy DesignDesign yy ControlsControls Architectural Design and Best Practices Operational Security Controls Architectural Design and Best Practices Operational Security Controls Honeywell Proprietary 6 2015 We Address Industrial Cyber Security End-to-End
- 7. Complete Industrial Cyber Security SolutionsComplete Industrial Cyber Security Solutions • Security Assessments • Network & Wireless Assessments • Security AuditsAssessmentsAssessments & Audits& Audits • Current State Analysis • Design & Optimization • Zones & Conduits & Audits& Audits ArchitectureArchitecture & Design& Design ResponseResponse & Recovery& Recovery • Backup and Restore • Incident Response • Firewall • Intrusion Prevention • Access Control P li D l t • Continuous Monitoring • Compliance & Reporting • Security Analytics NetworkNetwork SecuritySecurity SituationalSituational AwarenessAwareness TECHNOLOGY • Policy Development • Patching & Anti-Virus • Application Whitelisting • End Node Hardening • Security Analytics • Security Information & Event Management (SIEM) • Security Awareness Training EndpointEndpoint ProtectionProtection • Portable Media & Device Security Honeywell Proprietary 7 2015
- 8. Managed Industrial Cyber Security ServicesManaged Industrial Cyber Security Services Secure Connection Secure tunnel for servicesSecure tunnel for services Protection Management Qualified anti-malware files & operating system patchesQ p g y p Continuous Monitoring and Alerting Monitoring of system, network & cyber security performance 24/7 alerting against thresholds Intelligence Reporting Weekly compliance and quarterly trend reports Perimeter and Intrusion Management Firewall: Configuration rules + log file review and reporting Weekly compliance and quarterly trend reports Honeywell Proprietary 8 2015 Firewall: Configuration rules + log file review and reporting IPS: Signature update validation + log file review and reporting
- 9. Why Honeywell Industrial Cyber SecurityWhy Honeywell Industrial Cyber Security Global team of certified experts with deep experience across all industries Industry Leading People and Experience Global team of certified experts with deep experience across all industries 100’s of successful PCN / Industrial cyber security projects Leaders in security standards ISA99 / IEC62443 Proprietary methodologies specific for process control environment & operations Best practices developed through years of delivering solutions Industry Leading Processes and Expertise Best practices developed through years of delivering solutions Comprehensive understanding of unique process control security requirements Industry Leading Technology First to obtain ICS product security certification with ISASecure Largest R&D investment in cyber security solutions and technology Strategic partnerships with best in class security product vendors y g gy Honeywell Proprietary 9 2015 Trusted, Proven Solution Provider g y
- 10. TopicsTopics Technical Level 100 Time Synchronization DNS AD Replication DC MaintenanceDC Maintenance Backup and Restore 200 User and Group Guidelines ICS Group Policy200 ICS Group Policy Groups.xml Vulnerability 300 DC Through Firewall Fine Grained Password Policies 400 AppLocker If common sense were common we wouldn’t have to fix these over and Honeywell Proprietary 10 2015 If common sense were common, we wouldn t have to fix these over and over…
- 11. TerminologyTerminology • NTDS – NT Directory ServicesNTDS NT Directory Services • AD – Active Directory (aka. NTDS) • DC – Domain ControllerDC Domain Controller • FSMO – Flexible Single Master Operation • DNS Domain Naming Service• DNS – Domain Naming Service • GPO – Group Policy Object • SCW Security Configuration Wizard• SCW – Security Configuration Wizard Honeywell Proprietary 11 2015
- 12. Time Synchronization Ft McMurray Oilsands Conference 2015 12 2009 Drifting from Reality
- 13. Time SynchronizationTime Synchronization • Accurate time sync is a fundamental component of AD h i i Ti d if l i d i dauthentication. Time drift can result in domain decay and mysterious authentication issues if it exceeds 4 minutes between domain members. • Actual Event: – One group of computers cannot authenticate with other PCs in the same domain. Some logons work, some don’t, not i t t th i tconsistent across the environment. – Root Cause: Time drift greater than 5 minutes between DCs results in replication failure, domain members polarize with a DC and ‘islands’ of authentication resultDC and islands of authentication result. – Solution: It’s ugly! Force demotion of bad DC, fix time sync, promote to DC again. Honeywell Proprietary 13 2015
- 14. Time SynchronizationTime Synchronization • Identify the ‘PDC Emulator’ role. It is the timeIdentify the PDC Emulator role. It is the time master for the entire domain. • Get a GPS or other accurate (i.e., Stratum) time( , ) source; otherwise, the cheap clock on motherboard is used. • w32tm /config /manualpeerlist:“X.X.X.X Y.Y.Y.Y” /syncfromflags:manual /reliable:yes /update • w32tm /query /status • w32tm /query /peers Honeywell Proprietary 14 2015 Sources: - How to configure an authoritative time server in Windows Server, http://support.microsoft.com/kb/816042.
- 15. Domain Naming Service (DNS) Ft McMurray Oilsands Conference 2015 15 2009 What’s your address again?
- 16. Domain Naming Service (DNS)Domain Naming Service (DNS) • DNS allows humans to use hostnames to communicate with network devices. AD uses DNS to store DC roles, help DCs find each other, and domain members find DCs. • Every DC has a copy of the same DNS database and is continuously synchronized. • If a domain controller cannot communicate with DNS, you’re in trouble! • If a domain member cannot communicate with DNS, only previously cached credentials will work. Honeywell Proprietary 16 2015
- 17. DNSDNS • Actual Event: – Domain controller network driver update/change fails, after reboot it cannot find peer DNS server, cannot logon! – Root Cause: Its local IP address was not included in DNSRoot Cause: Its local IP address was not included in DNS server list. – Solution: DNS1 should be neighbor DC, DNS2 should be another neighbor, DNS3 should be 127.0.0.1. Have at least 2another neighbor, DNS3 should be 127.0.0.1. Have at least 2 real DNS servers, last one loopback IP. – When a DC first boots, it is member only. It must first find other DCs thru DNS and replicate DNS & NTDS databases,other DCs thru DNS and replicate DNS & NTDS databases, before it can authorize itself to authenticate users (including logons at console). Otherwise really slow or failed logon. – Always stagger DC reboots! Honeywell Proprietary 17 2015 Always stagger DC reboots! Sources: -DNS servers on NIC should include 127.0.0.1 but not as first entry, http://technet.microsoft.com/en-us/library/ff807362(v=ws.10).aspx. -Microsoft Best Practice for DC DNS settings, http://blogs.technet.com/b/askds/archive/2010/07/17/friday-mail-sack-saturday-edition.aspx#dnsbest.
- 18. DNSDNS • Replicate to all DNS servers in forest.p • Dynamic Updates: Secure Only – ipconfig /registerdns (used to refresh local DNS records on-demand) T i / i f ll f d d• Turn on aging/scavenging for all forward and reverse lookup zones (i.e., check the box). • Zone Transfers: Explicitly• Zone Transfers: Explicitly specify servers or turn off. • In ICS, you can delete list of, y root hint servers. Stops DNS noise before firewall. Honeywell Proprietary 18 2015
- 19. Active Directory Replication Ft McMurray Oilsands Conference 2015 19 2009 Working Together
- 20. Sites and Services (NTDS Replication)Sites and Services (NTDS Replication) • AD Sites and Services is used to specify theAD Sites and Services is used to specify the interval, protocol, and links for AD database (which may contain DNS) to replicate between domain controllers. • If subnets are specified and associated with sites (e.g., an area of the plant), members will prefer DCs in their subnet/site. Li k t ti ll t d f ll h d• Links are automatically created as full mesh and replicated every 3 hours. Honeywell Proprietary 20 2015
- 21. Sites and Services (NTDS Replication)Sites and Services (NTDS Replication) • Actual Event: – User accounts created on specific domain controller never work in other areas of the plant. Root Cause: NTDS replication links missing– Root Cause: NTDS replication links missing. – Solution: Re-architect links, verify all DCs participate in bi-directional replication. – Some scenarios require custom NTDS replication architecture • In ICS 15 minute replication• In ICS, 15 minute replication interval is fine (default 180). • repadmin /syncall Honeywell Proprietary 21 2015 p y
- 22. DC MaintenanceDC Maintenance • dcdiagdcdiag Honeywell Proprietary 22 2015
- 23. DC MaintenanceDC Maintenance • Actual Event: – Patches are installed on DC holding FSMO roles, during reboot it suffers critical failure and will not boot. – If FSMO roles are forcibly seized and transferred to anotherIf FSMO roles are forcibly seized and transferred to another DC while it is offline, its hostname is now blacklisted. Must force removal of DC role and reinstall OS with new hostname. – Root Cause: FSMO roles were not transferred before maintenance occurred on DC. – Solution: Transfer roles before/after using PowerShell:Solution: Transfer roles before/after using PowerShell: • Import-Module ActiveDirectory • Move-ADDirectoryServerOperationMasterRole -Identity “ServerName” -OperationMasterRole 0,1,2,3,4 • netdom query fsmo Honeywell Proprietary 23 2015 netdom query fsmo Sources: -Transfer or Seize FSMO Roles, https://support.microsoft.com/kb/255504/en-us, - How to remove data in Active Directory after an unsuccessful domain controller demotion , https://support.microsoft.com/kb/216498. - Why not to reuse server names, http://www.jackcobben.nl/?page_id=403.
- 24. Backup and Restore Ft McMurray Oilsands Conference 2015 24 2009 Prepared for Failure
- 25. Backup and RestoreBackup and Restore • DCs are peers that share and continuously replicate the AD d t b C t tl h i !AD database. Constantly changing! • Disk images (e.g., Acronis, Ghost, Clonedisk) of your DCs should not be used for restoration as it will include stale f AD d t b A f b k i k !copy of AD database. Age of backup is key! • Microsoft only supports Windows Server Backup Full System and ‘System State’ backups, which contains Active Directory contentsDirectory contents. • Schedule backup from 2+ DCs, store on different server, at least once per day. Also, use ntdsutil for ad-hoc snapshots Used by Directory Service Repair Modesnapshots. Used by Directory Service Repair Mode. • Microsoft recommends ntdsutil to remove failed DCs, then clean OS install and dcpromo for new ones. Honeywell Proprietary 25 2015 Sources: -AD Backup and Restore, http://technet.microsoft.com/en-us/magazine/2008.05.adbackup.aspx. System State Recovery of a Domain Controller; Taking Active Directory Snapshots.
- 26. Users and Groups Ft McMurray Oilsands Conference 2015 26 2009 “We use Administrator for everything”
- 27. User and Group GuidelinesUser and Group Guidelines • Don’t use domain or local Administrator account toDon t use domain or local Administrator account to run any applications! – Not due to security risk, but to decouple dependency upon it for password changes. • Rename local Administrator (e.g., LocalAdmin) d d i Ad i i t t ( Ad i i)and rename domain Administrator (e.g., Admini). • Avoid use of local or domain administrator t l i di id ll i daccounts, rely upon individually assigned user accounts with similar privilege. Honeywell Proprietary 27 2015
- 28. User and Group GuidelinesUser and Group Guidelines • Create two (2) user accounts per person.Create two (2) user accounts per person. – User-level account (e.g., jdoe) with application privileges. Standard password. – Admin-level accounts (e.g., admin_jdoe) with administrator privileges. Strong password. Logon regularly with user level account use admin level– Logon regularly with user-level account, use admin-level only when needed. Works very well with Windows 2008/Vista/7 UAC). Honeywell Proprietary 28 2015
- 29. User and Group GuidelinesUser and Group Guidelines • Create ‘Service’ user accounts for each major application ( hi t i i t f d t b h d l d t k(e.g., historian interfaces, databases, scheduled tasks, OPC services, backup software) so they can be used for running DCOM and Windows Services. Examples: dc backup task acronis backup service– Examples: dc_backup_task, acronis_backup_service, historian_opc_service • Running programs and services as Administrator is the single biggest reason why password changes don’tsingle biggest reason why password changes don t happen! – Changing Administrator password in many environments will require, or result in, process shutdown. • Application specific service accounts clearly identify their purpose and localizes their impact if/when their passwords are changed. Honeywell Proprietary 29 2015
- 30. User and Group GuidelinesUser and Group Guidelines • Restricted Resource group: grants a specificRestricted Resource group: grants a specific access level to a specific device/ system/ application. Defined owner for each. • Control System – Product Admins – Engineers • Domain Members – Domain Administrators – Remote Desktop Users – Supervisors – Operators • Domain Controllers – Domain Users • Network Infrastructure – Read-Only – Enterprise Admins – Administrators – Group Policy Mgrs – Password Update – Read-Write • Applications – Administrators E i / D l Honeywell Proprietary 30 2015 – Engineers / Developers – Users
- 31. Group Policy Ft McMurray Oilsands Conference 2015 31 2009 Shouldn’t they all be the same?
- 32. Group Policy SettingsGroup Policy Settings • Group Policies allow single step roll out of computer i l ll d i bsettings to select or all domain members. • GPO settings can be applied to users and computers, commonly based on group membership ory g p p organizational unit. – Windows 2008 Active Directory and Group Policy Preferences allows almost limitless selection criteria. With t h th t d b Wi d XPpatches, they are supported by Windows XP+. • Examples: – Password policy, security logging policy, disable unnecessaryy y gg g y y services, disable unnecessary Windows components and features, local group membership, Windows Firewall rules, Start Menu and Desktop appearance, startup scripts, etc. Honeywell Proprietary 32 2015 Sources: -Group Policy Preferences, Windows 2008, http://technet.microsoft.com/en-us/library/cc731892(v=ws.10).aspx. -Group Policy Preferences, Windows 2012, http://technet.microsoft.com/en-us/library/dn581922.aspx -Group Policy Preferences Patch, for Windows XP, 2003, and Vista: http://technet.microsoft.com/en-us/library/cc731892(v=ws.10).aspx.
- 33. Recommended Group Policy SettingsRecommended Group Policy Settings • Minimum password length, complexity, and age E bl it diti ( t l t t t l• Enable security auditing (account logon events, account mgmt, logon events, policy change, system events) • Increase default event log file size. • Disable LM authentication potentially NTLMDisable LM authentication, potentially NTLM. • Disable unnecessary services. In ICS, you can disable: – WinHTTP Auto-Proxy, SSDP Discovery, Smart Card, HomeGroup Listener, HomeGroup Provider Security Configuration Wizard (SCW) is excellent at hardening Windows Server– Security Configuration Wizard (SCW) is excellent at hardening Windows Server 2003 SP1 and newer (e.g., Disables unnecessary services; Windows Firewall rules; prepare Group Policies) • Disable unnecessary Windows components and features. In ICS, you can disable:can disable: – AutoPlay, Games, Desktop Gadgets, NetMeeting, Outlook Express, HomeGroup, Windows Messenger, Windows Media Player, Windows Media Center, • Uninstall unnecessary software (e g Adobe Java Office) Honeywell Proprietary 33 2015 • Uninstall unnecessary software (e.g., Adobe, Java, Office). Sources: -Security Configuration Wizard, http://technet.microsoft.com/en-us/library/cc754997.aspx
- 34. Advanced Group Policy SettingsAdvanced Group Policy Settings • Modify allow/deny User Rights Assignment for: – Logon locally (e.g., keyboard console) – Remote Desktop – Access Computer via network (e.g., Network Share, DCOM Service) – Logon As Service– Logon As Service – Logon As Batch (i.e., Scheduled Task) • Windows Firewall rules. In ICS, you might choose to control which IP address ranges (e.g., Local Subnet) can access:g ( g , ) – Network Discovery, Remote Desktop, File & Print Sharing, – Part of SCW • AppLocker application execution rules. In ICS, you can use A L k ’ hit li ti li tiAppLocker as poor man’s whitelisting application. – More on this in later slides… • Do not perform above on production environment without prior testing!!! Honeywell Proprietary 34 2015 testing!!!
- 35. Groups xml VulnerabilityGroups.xml Vulnerability • If you use Group Policy Preferences to automateIf you use Group Policy Preferences to automate resetting of local user passwords – Don’t! • The encryption used in the groups.xml file is weakyp g p and disabled in MS14-025. • Implement via PowerShell scriptp p – See MS14-025 Honeywell Proprietary 35 2015 Sources: -How To Automate Changing The Local Administrator Password, http://blogs.technet.com/b/askpfeplat/archive/2014/05/19/how-to-automate-changing-the-local-administrator-password.aspx. -MS14-025: Vulnerability in Group Policy Preferences could allow elevation of privilege, http://support.microsoft.com/kb/2962486,
- 36. DC Through Firewall Ft McMurray Oilsands Conference 2015 36 2009 Fitting Just Right
- 37. DC Through FirewallDC Through Firewall • DCs will often be in different zones and across firewalls. Really they should be in enclaves due to their importanceshould be in enclaves due to their importance. • Domain Controller Default Ports: KB179442 – DNS TCP/UDP53 – NTP TCP/UDP123 – Kerberos TCP/UDP88 – RPC TCP135 – NetBIOS UDP137-138, TCP139 – File Sharing TCP445File Sharing TCP445 – kpasswd TCP/UDP464 – http-rpc-epmap TCP594 – Global Catalog TCP3268 RPC (Windows 2003/XP and older): TCP1025 5000– RPC (Windows 2003/XP and older): TCP1025-5000 – RPC (Windows 2008/Vista and newer): TCP49152-65535 – Not Used in Field: UDP500, TCP636, TCP3269, UDP4500, UDP5355, TCP9389 (based on actual results 2008R2 at ICS site) Honeywell Proprietary 37 2015 Sources: -Service overview and network port requirements for Windows, http://support.microsoft.com/kb/832017. -How to configure a firewall for domains and trusts, http://support.microsoft.com/kb/179442.
- 38. DC Through FirewallDC Through Firewall • Registry changes can be applied to changeRegistry changes can be applied to change dynamic ports to fixed, or specify smaller range. • Set NTDS to 32901 • Set NTFRS to 32902 • Set NetLogon to 32903Set NetLogon to 32903 • Set DFSR to 32904 (if used) • Set WMI to 32905 (if used)Set WMI to 32905 (if used) Sources: Restricting Active Directory RPC traffic to a specific port http://support microsoft com/kb/224196 Honeywell Proprietary 38 2015 -Restricting Active Directory RPC traffic to a specific port , http://support.microsoft.com/kb/224196. -How to restrict FRS replication traffic to a specific static port , http://support.microsoft.com/kb/319553. -Configuring DFSR to a Static Port, http://blogs.technet.com/b/askds/archive/2009/07/16/configuring-dfsr-to-a-static-port-the-rest-of-the-story.aspx. -Setting Up a Fixed Port for WMI, http://msdn.microsoft.com/en-us/library/bb219447(v=vs.85).aspx. -IANA ports 32897-33122 Unassigned, http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt.
- 39. DC Through FirewallDC Through Firewall • KB154596: Configureg RPC/DCOM range by Registry or dcomcnfg exedcomcnfg.exe – TCP 45000-45999 – 1000 ports is sufficient for most applicationsmost applications. • Used by all listening RPC services. • Best effect on Win2003 and earlier OS as it moves away from 1025-5000 Honeywell Proprietary 39 2015 from 1025-5000. Sources: -How to configure RPC dynamic port allocation to work with firewalls, http://support.microsoft.com/kb/154596. -IANA ports, http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt.
- 40. DC Through FirewallDC Through Firewall • Before:Before: RPC RangeRPC Range 49152-65535 Honeywell Proprietary 40 2015
- 41. DC Through FirewallDC Through Firewall • After:After: Registry HacksRegistry Hacks 32901-32905 RPC Range 45000-45999 Honeywell Proprietary 41 2015
- 42. Fine Grained Password Policies Ft McMurray Oilsands Conference 2015 42 2009 Something for Everyone
- 43. Fine Grained Password PoliciesFine Grained Password Policies • By default, there is only one domain password policy.y , y p p y • Starting Windows 2008 domain functional level, different password policies can apply to different AD usersusers. – Set your Default: 12-char, 60-day expiry, never lockout. • Defined by Default Domain Policy Ad i L l 20 h 180 d i– Admin Level: 20-char, 180-day expiry. • Create and Assign to Group ‘Pass 20c 180d NoLock DL Group’ – Service Accts: 32-char, never auto-expire, never lockout. • Create and Assign to Global Group ‘Pass 32c NoExpire NoLock DL Group’• Create and Assign to Global Group Pass 32c NoExpire NoLock DL Group • Implemented manually with ADSIedit in Windows 2008; Wizard-driven in 2012. Rely on SIEM to detect Honeywell Proprietary 43 2015 Sources: -Fine Grained Password Policies, Windows 2008, http://technet.microsoft.com/en-us/library/cc770394(v=ws.10).aspx. multiple logons
- 44. Fine Grained Password PoliciesFine Grained Password Policies Parameter Admin Level Policy Service Accounts Common-Name Passwd-20char-MaxAge180d- NoLockout Passwd-32char-NoMaxAge- NoLockoutNoLockout NoLockout msDS-PasswordSettingsPrecedence 8 5 (low number is higher precedence) msDS- P dR ibl E ti E bl False PasswordReversibleEncryptionEnable d msDS-PasswordHistoryLength 20 32 msDS-PasswordComplexityEnabled TruemsDS PasswordComplexityEnabled True msDS-MinimumPasswordAge “-864000000000”, 9-zeros, 1 day msDS-MaximumPasswordAge “-155520000000000” 10-zeros, 180 days “-9223372036854775808” never expire10 zeros, 180 days never expire msDS-LockoutTreshold 0 msDS-LockoutObservationWindow 0 msDS LockoutDuration 0 Honeywell Proprietary 44 2015 msDS-LockoutDuration 0 msDS-PSOAppliesTo Windows Account: Pass 20c 180d NoLock DL Group Windows Account: Pass 32c NoExpire NoLock DL Group
- 45. Fine Grained Password PoliciesFine Grained Password Policies • ‘Pass 20c 180d NoLock DL Group’ members:Pass 20c 180d NoLock DL Group members: – Administrators, Domain Admins, Backup Operators, Schema Admins, Enterprise Admins, Account Operators, Server Operators, – DCS Administrators, Network Admins, Any other application specific groups or user accounts– Any other application-specific groups or user accounts with privilege to change the system. • ‘Pass 32c NoExpire NoLock DL Group’ members:Pass 32c NoExpire NoLock DL Group members: – Service Accounts Honeywell Proprietary 45 2015
- 46. AppLocker Ft McMurray Oilsands Conference 2015 46 2009 Use What You’ve Got
- 47. AppLockerAppLocker • Poor man’s application white listing to ensure onlyPoor man s application white listing to ensure only specified executables, scripts, and installers run. • It’s free-but: – No “learning mode” or management tools. – Weaker protections than commercial white listing solutions (e.g., injection, overflows) • Use-cases: Windows 7 Ent, 2008 R2, and higher – Application inventory, unwanted software, standardization, change control, etc. – DMZ Hosts Engineering Stations Operator Stations Honeywell Proprietary 47 2015 DMZ Hosts, Engineering Stations, Operator Stations Sources: -AppLocker Step-by-Step Guide, http://technet.microsoft.com/en-us/library/dd723686(v=ws.10).aspx.
- 48. AppLocker Base PolicyAppLocker Base Policy • Create group policy, link it to specific OU where the C ill b l dtest Computer will be located. • Computer Policy > Windows > Security > Application Control Policies: – Executable Rules: • Allow BUILTINAdministrators All Files • Allow Everyone All files in the Windows folder – Requires testing per-site to determine what executables are used commonlyRequires testing per site to determine what executables are used commonly. – Windows Installer Rules: • Allow BUILTINAdministrators All Windows Installer files – Script Rules: • Allow BUILTINAdministrators All Scripts • Application Identity service Startup Mode: Auto • Group Policy loopback processing mode: Replace Honeywell Proprietary 48 2015 p y p p g p
- 49. AppLocker Per-App PolicyAppLocker Per App Policy 1) Identify the application you want to run (e.g., R D k C i )Remote Desktop Connection) 2) Create Global Group (e.g., RDP Client Run) and add users. 3) Create GPO (e.g., RDP Client Run GPO), link to same OU as base AppLocker policy. 4) Modify GPO with Executable Rule allowing global4) Modify GPO with Executable Rule allowing global group to access specified executables (e.g., mstsc.exe). a Some applications may require multiple executables toa. Some applications may require multiple executables to function (will be confirmed during testing). 5) Logon as Test User > Execute > Check Logs > Tune GPO Honeywell Proprietary 49 2015 Tune GPO.
- 50. AppLockerAppLocker • With Loopback processing, only affects specifiedp p g, y p computers in the OU, and only users when they logon to that computer. • One GPO and group per application Once setup just• One GPO and group per application. Once setup, just add users to the AD group as well as link GPO to OUs. – Will need AppLocker GPOs for antivirus, backup tools, etc. • Ensures change control procedures are followed! • When implemented by qualified personnel with• When implemented by qualified personnel with testing discipline will increase system performance, reliability, and security posture. Honeywell Proprietary 50 2015
- 51. QuestionsQuestions • Time Synchronization • DNS • AD Replication • DC Maintenance • Backup and Restore • User and Group Guidelines • ICS Group Policy • Groups.xml Vulnerability • DC Through Firewall • Fine Grained Password Policies • AppLocker The views and opinions expressed here are my own and don’t necessarily represent Honeywell Proprietary 51 2015 The views and opinions expressed here are my own and don t necessarily represent the views or opinions of Honeywell.
- 52. Th k YThank You • Donovan Tindill, Senior Security Consultant • Email: http://tinyurl com/DonovanAtHon; Please• Email: http://tinyurl.com/DonovanAtHon; Please connect on LinkedIn and mention this conference. • Credits: Connor, Liam, Roger J.