A (23:31)
Okay, now this is something that we can do something with. I feel like we just went to a fancy restaurant and this story was like that bull crap amu's bush thing that they bring you where you're like, what is that like, okay, thank you. Bring me some meat and potatoes. Bring me the entree. Boom. Here's some. Here's some entree. Put a lobster bib on and get ready to roll your sleeves up and dig into this mother trucker. Okay, so Stryker Medical in what I would consider a very cool attack, again, I don't, I don't support cybercrime or cyber threat actors. I'm not into damage and devastation. I know that Stryker Medical as a business is suffering right now. But as a pure academic and someone who lives and breathes cybersecurity, this was cool, the, the intune. So listen, mobile device management, right? I don't care if it's intune or it's jamf or whatever, okay? Mobile device management is how we protect organizations with globally distributed workforce and multiple devices. Phones, tablets, laptops, speak and spells whatever. Okay? The MDM allows centralized administration to ensure, number one, that your phone has a pin lock on it. Number two, that you're. And your phone's or tablets hard drive is encrypted and to allow, and this is the key, allow remote wiping capabilities. Now why would you want remote wiping capabilities? Because executives leave their phones on their private jets and normal people leave their tablets or laptops in the Uber and sometimes, you know, maids steal your stuff. Right. Again, no, no shame thrown to the, the maid union here. I'm just using it as an example. Crap happens. So when crap happens, you can push A button and basically nuke that device from low orbit and everything's good. Okay. This is like great HIPAA control. Like, yeah, there's no, no risk of a data breach. Okay. What makes it so interesting is that these threat actors got into the environment and issued that command for all the devices. Brilliant, right? I mean, this is a devastating, very, very catastrophic type attack on a business, especially a business that has 60, 50, 60,000 employees. I think they had something of like 200,000 endpoints, because remember, I've got a phone and a tablet and a laptop, so there's three devices just for me. So what they're saying here is threat actor got into the Azure admin console with an administrator credential, then somehow created a global tenant admin, which in the world of Azure is the God mode. That is the root system God mode. Super user. You know what, Joshua? Like whatever you want to call it, whatever you want to call it, you can do anything. You've got the. You're the key master or whatever it was from the Matrix movie. All right? And they issued the command. All right, so what, what do you need to do if you're running Microsoft 365 and if you're running intune specifically. Right. Number one, you should absolutely take advantage of this. I'm going to drop this link in chat. This is Microsoft's guidance on how to protect or, excuse me, how to configure Microsoft intune to be secure. By the way, you could say, number one, I want to. I like low key. Want to punch the screen here. Start with least privilege. Yeah, okay. You know what, really quickly, guys. Least privilege, by the way, AC6 Nest 853AC6, winner, winner, chicken dinner. Oh, all right, so start with least privilege. My guy. This is not something you configure. You don't toggle left, right on, off, switch from. No least privilege to least privilege. Least privilege is like an identity and access management strategy that you have to deploy and you have to set up your environment with process workflows. Like, obviously workflows and process are kind of the same thing. Governance to make sure that that's okay. Because here's the reality. Someone tries to go do something and they can't because they don't have permissions. So then you increase their permissions. Then they try to do something else, you increase their permissions. Least privilege is hard because the more tightly controlled you make a user account or a group of accounts, the more times they call help desk and complain that they can't do their job. Now on the other side of the seesaw, if you give everyone. This is disgusting. So obviously I'm saying this for hyperbolic purposes. If you give every user in the environment, including Carl, cool domain admin or you make everyone a global tenant, right, you give everybody God mode, you will get zero calls to the help desk about not being able to do something because everybody has every permission to do everything, which, which is a gross security violation, massive risk. Okay? So you know, and Gen Z, this is not 6, 7. This is me trying to balance least privilege with managing overload on the help desk. Okay? So thank you Microsoft for making step one start with least privilege. Like, like, all I'll say is if you're going to try to knock this out today, Friday before close of business, you're not. Number two, embrace phishing resistant authentication and privileged access. Yeah, for sure. You absolutely should have multi factor authentication. This is not going to stop your Microsoft intune from issuing the wipe command all over the place. This is stopping the threat actor from actually getting into intune to begin with. Okay? Enable multi admin approval. Yes, yes, yes, this is true. So like, basically what they're trying to say is, you know that scene in War Games where like both the guys have to turn the key to make the nuke go off? Or any of these like bank heist movies where like part of the the vault requires two keys to be turned at the same time where a human physically couldn't be doing both keys. That's what this is. I hate to be a wet blanket or sand in your shorts at the beach or insert other irritating thing like knees in the back on your airplane seat for the person behind you. I particularly hate that multi admin approval. According to the story, the Iranian threat actors were able to create a new global admin account. So how might I circumvent this control? Oh, I don't know. Create a second global admin account and then use both of them to turn the keys. So like, yeah, I get it, that's fine. What we need to do here is we need to obviously put in MFA and all the controls. But number one, you should absolutely have detections on one. A new global admin account comes out, right? Like that's like alarm bells should be going off like number one. Number two, again, I'm being very judgy today, I guess, because I don't care. I love it. Listen, everybody on your IT team doesn't need to have a global tenant admin account. Stop that. Stop it. And I don't get. I don't care that Kevin's been there for 22 years and Kevin knows all the things and Kevin, Kevin, Kevin, Kevin. Listen, Kevin, drive around in a regular user account and then have a domain admin account or global tenant admin account with a very hard password that you use sparingly. You don't need to use a global tenant account to do your day to day job, knucklehead. Like, in fact, you're a manager. You probably don't even need to be in there. You should be managing the engineers, doing their job. All right. Anyways, with the increased threat of this happening to your environment, I will tell you this, unfortunately this can happen to any business that's using Microsoft 365 apolitically. But looking at the threat landscape, Stryker Medical was involved with Israel in some capacity, which heavily increased the likelihood of for an Iranian based threat actor to want to target them. Okay? The threat landscape is a very fluid, very dynamic element. You can't just do a threat model on January 1st and you're, you're good to go for the year. Okay, this is what my, my guy. This is why we have to pay attention to the News Daily, because there's a lot of moving pieces and moving parts. And if your company is Israeli based, if your company heavily deals with Israel as a partner or your, you know, your CEO or whatever is Israeli and like really public or something like that, you may have an increased likelihood of attack. Simply from an Iranian hacktivist perspective. That's it. I would say that protecting from a global wipe or having any threat actor, whether it's Iranian, Russian, Chinese, American, whatever, creating a global tenant admin account in your environment, you should be protecting from that. That is a definite bad thing that you do not want to happen. Okay, so what I would say is maybe not do it today. Okay? Like it's, it's giving me like an upset stomach just thinking about this. So maybe put a plan together and say, hey, like, we just want to do a quick audit of privileged user accounts in our Azure environment. Let's take a look. Make that a little GRC audit project next week. Okay, let's go.
