That portion was covered by cyber liability, I was just giving a brief overview to draw the picture of my motivation to do better and get some examples/explanation of the ideology behind someone else’s ACP. I will share a little bit more about the how anyway;
There was “malware” (see scripts, memory dumps, etc that easily exploited a poorly secured AD environment) and that TA entry finder likely sold to a popular ransomware group. The investigation report declared initial entry by exploiting the vulnerability in the FTD. See CVE-2023-20269, this likely was not terribly difficult to exploit, due to poor configuration and a poor password policy with even crummier tiering on AD access.
I’ve made a lot of changes I should have made day 1, but get to make now and develop better standard operating procedures, cyber response plans, etc. (LAPS, least privilege, Purple Knight was my friend and PDQ I/d helped me to make rapid changes)
My boss at the time of my hire wanted me to maintain the status quo and not implement drastic changes, so I did what I could to request “Our password policy is garbage, can I change it?” “No, I don’t want to deal with tickets getting people locked out” - They did let me buy Nessus and Duo, but didn’t let me just roll Duo out environment wide for Microsoft logins. Even after a month long and successful trial run. They didn’t let me put it on the servers, and they went in duo admin and set up a bypass for their DA account because they liked to log on to their work station with those credentials and couldn’t be bothered. Shudders. You say “That’s dumb” to someone who has been “doing this way longer than you” and they will ostrich even harder.
There is an understandable friction when change is mentioned to people that have just been going with tradition. I’m very much of the mindset, let me utilize this device/service I’m paying for fully, understand best practices for it, and implement those best practices per my need and capabilities. When it breaks stuff, take accountability, curse random engineers and capitalism, and fix it.
Rant aside, I’ve read a lot of best practice guides for FMC/FTD and am just looking to connect best practice and practical given my resources.
Block as the suggested default action from the NSA seems like a gargantuan undertaking which I’m severely understaffed to support a simple transition to.
I’ve thought about collating logs and scripting a solution to examine the traffic, make a million and 2 rules in the ACP, and go with the default action of block. I just fear that it would be incredibly difficult for me to implement with minimum friction. Maybe someone has done something like this and knows some magic resources that I could investigate and execute on.
I’ve started adding allow from inbound to outbound with a less extensive intrusion policy for known IP blocks, Google servers, apple servers, Microsoft update servers, etc to lessen the strain and having a more aggressive intrusion policy on the inbound outbound allow rules at the end of my ACP. This rule creates a lot of false positives, but it has saved me in conjunction with my mdr of a few client machines trying to hit a known CnC.
I really just wish I could hop on, and chat with a peer and have them explain their ACP. Monkey see, monkey do. I asked here hoping someone might have a redacted SS, but I do understand it’s the equivalent of “Hey show me your dirty underwear”