security

VMware vCenter Native Key Provider

VMware vCenter Native Key Provider

VMware vCenter can be a key provider, which is perfect for using a vTPM (Virtual Trusted Platform Module). With VMware vSphere, you can configure a native key provider that VMware vCenter fully manages. No external key provider is needed. The native key can even be used to encrypt your VMs.

In this post, I will show you step-by-step how to add a Native Key Provider (NKP) to VMware vCenter.

The Process

  • Login to VMware vCenter.
  • Click on your vCenter.
  • Click on the Configure tab.
  • Under the Security section, click on Key Providers.
…

Read More Read More

Microsoft 365 Passkey Setup

Microsoft 365 Passkey Setup

Microsoft 365 supports hardware security keys with passkeys. Passkeys are sometimes called FIDO2. Passkeys are one of many ways you can secure your accounts.

In this post, I will show you step-by-step how to set up a passkey in Microsoft 365, including configuring a passkey with a break glass emergency access account.

Prerequisites

  • Hardware security key that is FIDO2 compliant. (A common one is YubiKey 5)
  • Microsoft Entra ID Authentication Method for Passkey (FIDO2) and Temporary Access Pass enabled.

The Process

  • Login to Microsoft 365.
  • Click on your account in the top right and click on View account.
  • Click on Security info.
  • Click on Add sign-in method.
  • Select Security key and click Add.
  • Select the type of security key you have.

In this example, I will use a USB device.

  • Plug your security key into your computer and click Next.
  • On the new window select the Security key option to save the passkey to the security key and click Next.
…

Read More Read More

Microsoft 365 Remove Stay Signed In Option

Microsoft 365 Remove Stay Signed In Option

Microsoft 365’s Stay signed in option is designed for user convenience but can increase security risks when used on public or non-corporately owned devices. The risk is due to the potential for unauthorized access to the user’s account and the resources they have access to.

The Stay signed in option presented to users

The stay signed in option, also known as KMSI (Keep Me Signed In), stores a cookie on the device for around 90 days when the user selects Yes to KMSI. When the cookie’s lifetime is active, users will see fewer prompts to log in with their Microsoft 365 account and fewer MFA prompts, this can pose a security risk on shared or public devices.

For corporate devices that are Microsoft Entra joined or Microsoft Entra Hybrid joined, the impact of removing the stay signed in option is minimal, as these devices already participate in Microsoft Entra SSO, which reduces the number of times users need to log in with their Microsoft 365 account when accessing Microsoft 365 web resources.

Turning off the stay signed in option in Microsoft 365 can help reduce your attack surface. This helps prevent users from accidentally selecting Yes to KMSI and can positively impact an audit or penetration test.

In this post, I will show you step-by-step how to remove the Stay signed in? option in Microsoft 365.

The Process

  • Login to Microsoft Entra admin center.
  • Click on Identity > Users > User settings
…

Read More Read More

SSL Inspection

SSL Inspection

Inspecting TLS/SSL traffic on corporate networks is very common, as over 80% of all web traffic is encrypted. If you aren’t performing TLS/SSL traffic inspection, you are potentially leaving your network exposed.

The simple act of inspecting SSL connections helps reduce your attack surface. SSL inspection can make it harder to establish malicious outbound connections, such as malware trying to communicate with the C2 (Command and Control) server.

To reduce the attack surface further, I like to deploy a block on common file types that could be malicious, such as EXEs. If SSL inspection isn’t performed, any EXE downloaded via SSL won’t be blocked.

In this post, I will go over the basics of SSL inspection. I won’t go into details about certificate chains. If you want to understand more about certificate chains, my post Certificate Chain goes into more detail.

An SSL inspector sits in the middle of all SSL traffic, inspecting everything by decrypting and re-encrypting encrypted traffic on the fly. At its core, SSL inspection is like a MitM (man-in-the-middle) attack you control.

To inspect SSL traffic, the SSL inspector needs to decrypt it first. It can do this by tricking clients into communicating with it instead of the actual website, and the SSL inspector will communicate with the website on the client’s behalf. An SSL inspector is also a proxy.

To keep everything secure even when decrypting SSL traffic, the SSL inspector needs to be its own intermediate CA to resign and re-encrypt everything to send back to the client. All public-facing websites or web applications have certificates issued by a public root CA.

The SSL inspector can’t just issue certificates on behalf of a public root CA, as that would break the chain of trust. Even if you reach out to an intermediate CA, they will not sell you a certificate that could allow you to issue certificates on their behalf, even if it’s just for your internal network, as that also breaks the chain of trust.

To deploy an SSL inspector, you have two options. The first option is to deploy the certificate from your SSL inspector to all devices, making it and the certificates it issues trusted. The second option is to deploy your own internal root CA and allow your SSL inspector to be a subordinate CA (also known as an intermediate CA) and issue certificates on behalf of your internal root CA.

…

Read More Read More

Palo Alto Private Data Reset with HA (Active/Passive)

Palo Alto Private Data Reset with HA (Active/Passive)

Sometimes, you need to do a quick factory reset on a Palo Alto Networks firewall. If you aren’t decommissioning the firewall, a Private Data Reset can be a faster way to accomplish similar results as a factory reset and can be done via CLI directly and could technically be done remotely with some coordination.

In this post, I will show you step-by-step instructions on how to perform a private data reset on a primary Palo Alto Networks firewall in an Active/Passive High Availability Pair using the GUI and the CLI.

The Process

HA Election Settings

If the HA election settings are set to preemptive, we need to disable that.

HA Election Settings GUI

  • On the Primary firewall, click on Device.
  • Click on High Availability
  • Uncheck Preemptive (if it isn’t selected, you don’t need to do anything)
  • Commit the changes

HA Election Settings CLI

  • SSH into the Primary firewall
  • Enter the configuration mode by running the command configure
  • Run the following command to output your HA election settings show deviceconfig high-availability group election-option

If preemptive is set to yes, make a note of that (if it isn’t selected, you don’t need to do anything)

…

Read More Read More

Securing GlobalProtect

Securing GlobalProtect

Out of the box, you can’t just add a Security Profile to the interface that runs GlobalProtect fortunately there’s a relatively easy way to do it with minimal impact to your existing GlobalProtect setup.

In this post, I will show you step-by-step how to secure GlobalProtect by adding protection with a Vulnerability Protection Profile or a Security Profile Group to an already existing GlobalProtect setup by using a loopback interface.

The Process

  • Log in to the Palo Alto Networks Firewall
  • Click on Objects
  • Click on Addresses
  • Add a new address for your loopback address

I will be using the address 192.168.187.2 for this example.

  • Click on Network
  • Click on Zones
  • Add a new Zone. I will be using the name GP-WAN. (This zone will be the zone allocated to the GlobalProtect loopback interface later on.)
    • Set the Type to Layer3
    • Select your Zone Protection Profile. In my case, I will use the one called Recommended_Zone_Protection
    • Select the option to Enable Packet Buffer Protection.
  • Click on Interfaces
  • Click on Loopback
…

Read More Read More

Saved Browser Passwords

Saved Browser Passwords

It’s super convenient to save your passwords to your web browser but it isn’t very secure. In this post, I will show you step-by-step how to easily reveal a saved browser password.

Normally if you want to view a saved password you need to go into settings and click on it, then enter the password of the logged-in user account to view it. This isn’t always true, let me show you how to get around this.

The Process

  • Go to any website that has the login credentials saved.
  • Right-click on the password field and select inspect or just inspect the whole page.
  • Find the line for the password field this should show up as type="password"
…

Read More Read More

Microsoft 365 Enable DKIM

Microsoft 365 Enable DKIM

DKIM (DomainKeys Identified Mail) is a way to help validate the authenticity of the emails you send.

DKIM adds a signature to your email by using a private key and a public key. Your public key is your DKIM DNS record and only your email server knows your private key. When you have DKIM setup every email you send gets signed with DKIM.

A DKIM signature is built from the hashed values of some of the email headers, one of which is the hash of the email body itself. With the hashed value of the email headers, DKIM encrypts it by using a private key and a public key and adds the encrypted result to the email as a DKIM header signature. This is similar to how PGP works. If you want to know more about PGP you can read more in my post about PGP.

When the recipient receives an email that was signed with DKIM, the recipient’s email server can validate that the email hasn’t been tampered with by decrypting the DKIM header signature using the sender’s public key. If the message was altered the DKIM header signature wouldn’t exist or the decrypted result wouldn’t match.

In this post, I will detail step-by-step how to enable DKIM on a Microsoft 365 tenant by using the GUI and PowerShell.

GUI Way

  • Login to Microsoft 365 admin center
  • Click on Security
  • Click on Policies & rules
  • Click on Threat policies
…

Read More Read More

PGP

PGP

PGP (Pretty Good Privacy) has been around for a long time. PGP is a system that allows you to encrypt a message using a key pair. A key pair consists of a public key and a private key. The public and private key pair are created at the same time and are permanently linked; one can not work without the other.

The basics of PGP are that the private key has a passphrase on it that only the creator knows. When you encrypt a message with PGP you encrypt it with your private key and a public key you specify, be that your public key or someone else’s public key. This makes it so the PGP encrypted message can only be decrypted using the public key you specified.

Here is a step-by-step example of using PGP.

Setup

For this example I will use an online PGP Tool.

First we need to generate our key pair to get our public and private key.

  • Fill in the options and click Generate keys
PGP key pair options
  • Download the public and private key.
My example public and private keys

Below is my full PGP public key for this example.

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: Keybase OpenPGP v2.0.76
Comment: https://keybase.io/crypto

xo0EZSHBoAEEAOgwPyzB0SK3qTcMm4qAdPy5v3uB+pEydKIypNMW+aDPc4ybYAYy
lPgKXmLqAEFE7QkE6zkvOJwUAoqZLOHinAD41f66pxZfEGCcdfPF5X7PPJHyr5/y
znNZLs28O54yZ2lLbsecTR+znyADMK3oebSDnuiJURlqC8L0Y8xekwm9ABEBAAHN
GW15IG5hbWUgPGVtYWlsQGdtYWlsLmNvbT7CugQTAQoAJAUCZSHBoAIbLwMLCQcD
FQoIAh4BAheAAxYCAQIZAQUJAAAAAAAKCRAZDnvqP9lqifE8A/4ytKWOSQJLSVzY
p2K0gtSLmFOfgD+kaMQ+CdtUEBbU/V6UoMu8w1/eRS9XMX4eDTY5n+paT0r6+Vis
ej9tFhTR1O0iZ+6Bose/MBIiSElZrw38rqmlh3tJd7iL1J3/THTM58+hjj2Ld4QZ
oomr1U4ORvLRF8vUNpTlxrOKRcyiz86NBGUhwaABBADiTMFd/AcihKHreVmHpxxW
buZHdtyj7sk6j7eEWAv40LnnhtZWASiW0BR07DRQzFMQmOrHaSqwdI5Ey/B/XBIl
el5+fIp/9/wEuAL7i3/fc8ugGJoEMuW4NLSNLjzHHasd8b9QT4mxD/F96JLx1ewF
masTU56csW2UqJnrUA5LTwARAQABwsCDBBgBCgAPBQJlIcGgBQkAAAAAAhsuAKgJ
EBkOe+o/2WqJnSAEGQEKAAYFAmUhwaAACgkQ0I8cDT2aUH6QjgQAikUt4cpoaGMO
ZmuqKytMDNk8WNbcCNjuMvJFEWa5UrSlhPv//7TP/8d7fxVeQzMn1I/Z4xmbtoz9
Yg6B0opMD0BV/FO1HOkYZ+9s1CqCQTy5frKrFppf1EC176FunBXAZtenUzBpCDxb
80SVarDHo6JFF9pkuf1b6Yixp7VGzaU2DAQAvfofR3/dZ15B0eLp1kVfq49b/9uj
g/yJjG8/86xUMTh6IoHEWuWOedVo3PHiAObYTNkv8IDWxLKBJDZcDE8STpF1kWO7
lVBP2JM2VSyUPqbH/A78Its00DiEeDH1n9PyTta2SJHrRPpneTUzuCQns6KarEfn
8bxBYJMxYAyf1SXOjQRlIcGgAQQAv1rfDxtbuhBzRtzrIYC8w9O5SH34HNDiZi9d
Zdhryku358l8sQhnSnQgeHO4v0s3yk1mdCFLNBZmeBgZ0UgDH0Kw+P1S96Qj6RKs
H26e0PkUgSTtfx2KpNx/QuYLRYJJtsULyTWmT8jUvapjcNggb8rhrAtmXDwrBD0g
EK1ZkoEAEQEAAcLAgwQYAQoADwUCZSHBoAUJAAAAAAIbLgCoCRAZDnvqP9lqiZ0g
BBkBCgAGBQJlIcGgAAoJEE4F+cdvR1VK9mED/0AvioatNTUcTQyuZ6d5+/ZRRiQL
3Oxtxbn9TmHmSO8F7h7qujsTNLz17D7bPUl4V7+spWpP30sjSYu7EzFJdv0VnEUZ
c7NcGlMM3krDbgK0QnV6iX65iQ1mWFlnatXl0OVzaTYHhZZ5EAimz2HbHSeW7PTW
I/X/WfruK6LfrObQBpgD/1l20D/5yPmp7hc/CxHYQewhhg6XsO+NoE2clpyRmPg+
dqFqwMQ31gLF0z5Ob9OOnzH+dB9W7r/T5whG/VKuJMctF7URCvWJn0DA/aRs0px5
5v0gvzo6TJekLPqfajK2TRqk8ZQdZ5iM+GIYLjnstooYVJ40Hl5B9N7m6ZPBvpiv
=vnvb
-----END PGP PUBLIC KEY BLOCK-----
Code language: plaintext (plaintext)

Encrypting

Now lets encrypt a message.

…

Read More Read More

Deploying Windows LAPS

Deploying Windows LAPS

I’ve been a fan of LAPS for a while and in 2023 Microsoft made LAPS even better by introducing a new version called Windows LAPS. Windows LAPS (Local Administrator Password Solution) is a great tool for managing your local admin passwords.

You might be thinking it’s ok I use one complicated password for my local admin accounts, it does not matter in fact it’s worse because if that local admin password hash is obtained then techniques such as pass-the-hash could be used or the password could be cracked and then all systems are compromised, it also sticks out on a penetration test.

Let’s be real, how often are you really changing those passwords even if they are all unique? Well, it doesn’t matter now because Microsoft has made managing all of it much simpler.

LAPS is not new, it has been around for years. In the past to use LAPS you needed to install a small client on the systems you wanted to manage with LAPS. You also needed to install the LAPS UI to retrieve the password or go digging in the AD attributes for the password.

After April 2023 all of that has changed as with the April 2023 security update systems running Windows 10 or newer and servers running Windows Server 2019 or newer now support Windows LAPS natively. No more extra programs are needed. There’s really no excuse for not using Windows LAPS.

The old way of doing Microsoft LAPS with the small client and LAPS UI is now called Legacy LAPS.

Here is step-by-step how to deploy Windows LAPS after the April 2023 update in on-premises Active Directory setup.

Prerequisites

  • All domain controllers and systems managed by LAPS must have the April 2023 update or newer.
  • An AD group for the users who can view LAPS passwords.
  • An AD group for the users who can reset the current LAPS password. (You can use the same group for both if you want.)
  • An Admin account that is a member of Schema Admins and Domain Admins.
  • Domain Functional Level of Windows Server 2016 or higher.

Initial Configuration

  • Login to a domain controller with an account that is a member of schema admins and domain admins
  • Open PowerShell as admin
  • Confirm you have the LAPS PowerShell module by running the following command get-command -module LAPS
…

Read More Read More