-1

Bluecoat security did an analysis of the Sony attack and says the following

"This particular sample highlights the value of a network architecture where workstations cannot talk to each. While host-to-host file sharing, and communication can be convenient, it makes lateral movement for an attacker far easier." https://www.bluecoat.com/security-blog/2014-12-04/custom-sony-malware-indicates-previous-knowledge

Does anyone know how this would be accomplished? I want to understand a real world / realistic way this would be done on a medium to very large network?

Improve this question
1
  • 2
    Honestly, this is pretty shit advice. You can either have a usable network or one that's secured as Bluecoat advocates. But consider the source. A security consulting company recommends a security architecture that's complex, expensive, difficult to to work with or manage... and a service they'll happily provide for large piles of money.
    – HopelessN00b
    Feb 2, 2015 at 1:08

2 Answers 2

Reset to default
2

The first thing you need to do is run with least privileges. If your users are admins on the workstations then you already lost the battle. Then make sure each workstation uses a different administrator password.

The next big one is to logically segment your network. All nodes in each segment should have the same value if compromised. Think Desktops | Servers | Active Directory. Then elevated access accounts in each segment are only allowed access to that segment. So a server admin account cannot be used in the workstation segment. The Active directory admin account cannot be used in the server or workstation segment. By not used, they should be denied access.

The point is that if a domain admin account is used on a workstation, then the whole org is at risk if some can gain admin rights on one system. This is what you need to prevent.

Improve this answer
1

Firewalls. The same way you restrict network traffic in any other situation. You'd likely want to use a managed host-based firewall that would allow communications with servers and other infrastructure devices, on all or defined ports, and not allow communications otherwise. You'd also want to heavily restrict network access for any machine without the managed firewall, using 802.1x.

You'd have to be fairly sophisticated to also allow for business needs like mobile users and devices, new device deployments, etc, so that you're not introducing severe delays and inconveniences into the normal IT working environment. I haven't seen this done anywhere that I've ever worked.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .