Preparation Stage (Part 2)

While the Preparation Stage primarily focuses on establishing incident handling capabilities, it also emphasizes the importance of protective measures to reduce the likelihood and impact of incidents. Although protection is not the direct responsibility of the incident handling team, understanding these measures helps the team better investigate incidents and identify artifacts or evidence. Below are some highly recommended protective measures with significant mitigation impact:

1. DMARC (Domain-based Message Authentication, Reporting, and Conformance)

Purpose: Protects against email phishing and spoofing by validating email authenticity.
How It Works:
- Built on top of SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail), DMARC ensures that emails claiming to originate from your domain are legitimate.
- Emails failing DMARC checks are rejected before reaching the recipient, preventing phishing attempts.
Implementation:
- Requires thorough testing to avoid blocking legitimate emails.
- Can be enhanced with email filtering rules to detect and block emails failing DMARC from external domains.
Challenges:
- High false positives may occur with emails sent "on behalf of" via third-party services due to domain mismatches.

2. Endpoint Hardening

Purpose: Secures endpoint devices (e.g., workstations, laptops) to prevent initial access by attackers.
Key Measures:
- Disable LLMNR/NetBIOS: Prevents name resolution attacks.
- Implement LAPS (Local Administrator Password Solution): Randomizes local admin passwords and removes administrative privileges from regular users.
- Restrict PowerShell: Configure PowerShell in "ConstrainedLanguage" mode to limit its functionality and reduce the risk of malicious scripts.
- Enable ASR (Attack Surface Reduction) Rules: If using Microsoft Defender, enable ASR rules to block common attack vectors.
- Application Whitelisting:
  - Block execution from user-writable folders (e.g., Downloads, Desktop, AppData) where malicious payloads often reside.
  - Restrict execution of script types like .hta, .vbs, .cmd, .bat, and .js.
  - Pay attention to LOLBins (Living-off-the-Land Binaries), which attackers use to bypass whitelisting.
- Host-Based Firewalls:
  - Block workstation-to-workstation communication.
  - Restrict outbound traffic to LOLBins.
- Deploy EDR (Endpoint Detection and Response):
  - Choose EDR products that integrate with AMSI (Antimalware Scan Interface) for visibility into obfuscated scripts.
  - AMSI allows antimalware products to inspect script content before execution.

3. General Hardening Principles

Don’t Let Perfect Be the Enemy of Good: Focus on implementing practical, effective measures rather than striving for perfection. Even partial hardening can significantly reduce risk.
Standards and Baselines:
- Use widely recognized standards like CIS (Center for Internet Security) benchmarks and Microsoft baselines as the foundation for endpoint hardening.
Regular Updates and Patching: Ensure all systems and software are up to date to mitigate known vulnerabilities.

Key Insights:

Layered Defense: Combining email protection (DMARC), endpoint hardening, and EDR creates a robust defense against common attack vectors.
Focus on High-Impact Actions: Prioritize measures that provide the most significant risk reduction, such as disabling LLMNR/NetBIOS, implementing LAPS, and restricting PowerShell.
Balance Security and Usability: While hardening is critical, avoid overly restrictive measures that hinder productivity. Test and refine configurations to minimize false positives and operational disruptions.

By implementing these protective measures, organizations can significantly reduce their attack surface, making it harder for adversaries to gain initial access and execute attacks. This, in turn, supports the incident handling team by providing a more secure environment and clearer evidence during investigations.

PreviousPreparation Stage (Part 1)NextDMARC

Last updated 29 days ago

1. DMARC (Domain-based Message Authentication, Reporting, and Conformance)

Purpose: Protects against email phishing and spoofing by validating email authenticity.

How It Works:

Built on top of SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail), DMARC ensures that emails claiming to originate from your domain are legitimate.
Emails failing DMARC checks are rejected before reaching the recipient, preventing phishing attempts.

Implementation:

Requires thorough testing to avoid blocking legitimate emails.
Can be enhanced with email filtering rules to detect and block emails failing DMARC from external domains.

Challenges:

High false positives may occur with emails sent "on behalf of" via third-party services due to domain mismatches.

2. Endpoint Hardening

Purpose: Secures endpoint devices (e.g., workstations, laptops) to prevent initial access by attackers.

Key Measures:

Disable LLMNR/NetBIOS: Prevents name resolution attacks.
Implement LAPS (Local Administrator Password Solution): Randomizes local admin passwords and removes administrative privileges from regular users.
Restrict PowerShell: Configure PowerShell in "ConstrainedLanguage" mode to limit its functionality and reduce the risk of malicious scripts.
Enable ASR (Attack Surface Reduction) Rules: If using Microsoft Defender, enable ASR rules to block common attack vectors.
Application Whitelisting:
- Block execution from user-writable folders (e.g., Downloads, Desktop, AppData) where malicious payloads often reside.
- Restrict execution of script types like .hta, .vbs, .cmd, .bat, and .js.
- Pay attention to LOLBins (Living-off-the-Land Binaries), which attackers use to bypass whitelisting.
Host-Based Firewalls:
- Block workstation-to-workstation communication.
- Restrict outbound traffic to LOLBins.
Deploy EDR (Endpoint Detection and Response):
- Choose EDR products that integrate with AMSI (Antimalware Scan Interface) for visibility into obfuscated scripts.
- AMSI allows antimalware products to inspect script content before execution.

3. General Hardening Principles

Don’t Let Perfect Be the Enemy of Good: Focus on implementing practical, effective measures rather than striving for perfection. Even partial hardening can significantly reduce risk.

Standards and Baselines:

Use widely recognized standards like CIS (Center for Internet Security) benchmarks and Microsoft baselines as the foundation for endpoint hardening.

Regular Updates and Patching: Ensure all systems and software are up to date to mitigate known vulnerabilities.

Key Insights:

Layered Defense: Combining email protection (DMARC), endpoint hardening, and EDR creates a robust defense against common attack vectors.

Focus on High-Impact Actions: Prioritize measures that provide the most significant risk reduction, such as disabling LLMNR/NetBIOS, implementing LAPS, and restricting PowerShell.

Balance Security and Usability: While hardening is critical, avoid overly restrictive measures that hinder productivity. Test and refine configurations to minimize false positives and operational disruptions.