#najampicks

[najamtech-blog]

What should I know about security? The massive list of links post

I maintain a list of links I call "security stuff every Microsoft customer should know" that I send to every customer I visit. The list ranges from basic things to more in depth security knowledge, and is now available even if I haven't visited you. :) You might want to bookmark this page, as it will get updated periodically.

My links on security I send to every customer :

Best Practices for Securing Active Directory http://aka.ms/bpsadtrd This whitepaper also contains a large quantity of monitoring guidance including which optional logs to turn on. I highly recommend at least skimming through this whole whitepaper.

Pass the Hash Whitepapers

http://microsoft.com/pth (this URL also hosts ongoing content and discussions on the topic of Pass the Hash – there are two whitepapers here, I recommend reading both. )

Channel9 Presentation of SLAM and Lateral Movement :

http://aka.ms/toppopslam

POP-EMET Presentation :

https://channel9.msdn.com/Blogs/Taste-of-Premier/Taste-of-Premier-Protect-Your-Enterprise-with-the-Enhanced-Mitigation-Experience-Toolkit

LAPS Video :

https://channel9.msdn.com/Blogs/Taste-of-Premier/Taste-of-Premier-How-to-tackle-Local-Admin-Password-Problems-in-the-Enterprise-with-LAPS

Download LAPS :

https://aka.ms/laps

JIT-JEA (just in time just enough admin – this is the future) :

http://channel9.msdn.com/events/Ignite/2015/BRK2470

AGPM :

http://channel9.msdn.com/events/TechEd/NorthAmerica/2011/WCL308

Advanced Threat Analytics :

https://channel9.msdn.com/events/Ignite/2015/BRK3870

Ransomware Talk:

https://channel9.msdn.com/Blogs/Taste-of-Premier/Ransomware101

Windows Event Forwarding and monitoring what matters (centralized logging for free!)

http://blogs.technet.com/b/jepayne/archive/2015/11/24/monitoring-what-matters-windows-event-forwarding-for-everyone-even-if-you-already-have-a-siem.aspx

http://blogs.technet.com/b/jepayne/archive/2015/11/27/tracking-lateral-movement-part-one-special-groups-and-specific-service-accounts.aspx

http://blogs.technet.com/b/kfalde/archive/2015/11/18/laps-audit-reporting-via-wef-posh-and-powerbi.aspx

Blackbelt security from TechEd 2014

http://channel9.msdn.com/events/TechEd/Europe/2014/WIN-B318

KB2871997 Overview of the backported security features from 8.1/2012 to 7/2008R2. These features are critical for stopping lateral movement, especially the "Local Account" principal. (Highly recommend following the SRD blog in general, as it is one of the best sources from Microsoft) :

http://blogs.technet.com/b/srd/archive/2014/06/05/an-overview-of-kb2871997.aspx

How Cybersecurity investigations actually work - how real attacks happen, a little on what the Incident Response process looks like and a lot on what you could be doing to stop attackers

https://channel9.msdn.com/Events/Ignite/Australia-2015/WIN433

*the attack I show in this was based on this : http://carnal0wnage.attackresearch.com/2013/10/dumping-domains-worth-of-passwords-with.html I'm not linking this to show you how to hack - that's not why I am here, but to show you people who do want to attack you can find clever ways quite easily. You should learn how these work so you can defend against them.

My Boss talking about Microsoft Incident Response :

https://channel9.msdn.com/Blogs/Taste-of-Premier/Taste-of-Premier-Cybersecurity-Incident-Response

Information on the JASBug/GPO patch - this bug would allow you to trick a Windows workstation into getting group policy from the internet. It was patched however there are steps that need to be configured post-patch to defend against it :

https://www.jasadvisors.com/additonal-jasbug-security-exploit-info/

https://www.jasadvisors.com/about-jas/jasbug-security-vulnerability-fact-sheet/

Blackhat talk on Golden Ticket and other attacks (which can be prevented by the controls we discussed)

https://www.youtube.com/watch?v=-IMrNGPZTl0  (PtH mitigations make all of this moot.)

SRD posts on some of the critical security issues in the last year: :

http://blogs.technet.com/b/srd/archive/2015/02/10/ms15-011-amp-ms15-014-hardening-group-policy.aspx

http://blogs.technet.com/b/srd/archive/2014/06/05/an-overview-of-kb2871997.aspx

Discussions on Powershell persistence and logging - this is a very popular technique now and most 2008R2/Win7 customers don't have sufficient logging or preventions :

https://blog.gdatasoftware.com/blog/article/poweliks-the-persistent-malware-without-a-file.html

https://www.fireeye.com/content/dam/legacy/resources/pdfs/fireeye-lazanciyan-investigating-powershell-attacks.pdf

Pretty good writeup of some webshell behavior to maintain persistence on a network (I’ve encountered this group/webshell before and this is pretty spot on even if not written my Microsoft) :

http://blog.crowdstrike.com/mo-shells-mo-problems-web-server-log-analysis/

Threatpost discussions of various attacks that can be used:

http://threatpost.com/tracking-malware-that-uses-dns-for-exfiltration/111147

http://threatpost.com/patched-windows-kernel-mode-driver-flaw-exploitable-with-one-bit-change/111020  

http://threatpost.com/chinese-hackers-compromised-forbes-com-using-ie-flash-zero-days/110996 This one is really important, because this targeted malware being deployed simply by visiting a website. This is why defense in depth/desktop hardening/credential hygiene/EMET are so key.

“Admin Free” Active Directory blog posts (anything Laura writes is gold)  :

http://blogs.technet.com/b/lrobins/archive/2011/06/23/quot-admin-free-quot-active-directory-and-windows-part-1-understanding-privileged-groups-in-ad.aspx

http://blogs.technet.com/b/lrobins/archive/2011/06/23/quot-admin-free-quot-active-directory-part-2-protected-accounts-and-groups-in-active-directory.aspx

Purging Legacy Authentication Protocols :

http://blogs.technet.com/b/askds/archive/2012/02/02/purging-old-nt-security-protocols.aspx

Building custom X-Path filters :

http://blogs.technet.com/b/kfalde/archive/2014/03/25/xpath-event-log-filtering.aspx

Spotting the Adversary with Windows Event Forwarding from our dear friends at the NSA, which is a good write-up of basic monitoring (including gathering crash dumps, as they can indicate compromise in many instances) :

http://www.nsa.gov/ia/_files/app/Spotting_the_Adversary_with_Windows_Event_Log_Monitoring.pdf

OCTAVE framework for threat modeling :

http://www.cert.org/resilience/products-services/octave/

http://www.sei.cmu.edu/reports/99tr017.pdf (this is the older version but still applicable!)

TechEd presentation on memory analysis which contains details on Pass the Hash and Golden Ticket :

http://channel9.msdn.com/Events/TechEd/NorthAmerica/2014/DCIM-B350#fbid=

TechEd presentation on EMET to prevent zero days and other exploits (EMET is free!):

http://channel9.msdn.com/events/TechEd/Europe/2014/CDP-B348

Way more indepth overview of EMET :

http://channel9.msdn.com/events/TechEd/NewZealand/2014/PCIT417

TrustedSec giving EMET an endorsement:

https://www.trustedsec.com/november-2014/emet-5-1-installation-guide/

Redirecting the default place computers joined to your domain go (remember Computers is a “Container” and can’t get policy such as randomized passwords and firewall.) :

http://support.microsoft.com/kb/324949

Reducing the number of computers someone can join to the domain so any person with credentials can’t add random Macs to the domain :

http://support.microsoft.com/kb/243327

Using Powershell to get local group membership like Admins :

http://blogs.technet.com/b/heyscriptingguy/archive/2012/12/15/weekend-scripter-use-powershell-to-find-local-administrators-on-a-computer.aspx

Blocking out of date ActiveX on the internet :

http://technet.microsoft.com/en-us/library/dn761713.aspx

Hope these help!

-Jessica @jepayneMSFT

[najampicks-blog]

Learning These 26 Useful Things Now Will Change The Rest Of Your Life PRODUCTIVITY BY ANNA CHUI If you pay attention to your everyday life careful enough, you’ll know that you can learn from everything and everyone you come across. Our life is basically full of useful lessons that we should learn. Here are 26 useful things that Abhishek A. Singh wants you to learn now. He shared on Quora how these life theories would lead you to live a different life. 1. Primacy and recency: People mostly remember the first and last things that occurred, barely the middle. When scheduling an interview, ask the employer the time slots they do interviews and try to be the first or the last. 2. If you work in a bar or in customer service of any kind, put a mirror behind you at the counter. In this way, angry customers who approach you will have to see themselves in the mirror behind you and the chance of them behaving irrationally will be lowered significantly. 3. Once you make a sales pitch, don’t say anything else. This works in sales, but it can also be applied in other ways. My previous boss was training me and just gave me pointers. I was working at a gym trying to sell memberships. He told me that once I got all the small talk out of the way and presented the prices, the first person to talk would lose. It didn’t seem like a big deal but it actually worked. Often there were long periods of awkward silence as the person tried to come up with some excuses, but usually they bought. 4. If you ask someone a question and they only partially answer, just wait. If you stay silent and keep eye contact, they will usually continue to talk. 5. Chew gum when you’re approaching a situation that would make you nervous, like public speaking or bungee jumping. When we eat, our brain tell ourselves, “I would not be eating if I were danger. So I’m not in danger.” This has helped me to stay calm. 6. People will always remember how you made them feel, not what you said. Also, most people like talking about themselves; so ask lots of questions about them. 7. When you’re learning something new, teach it to a friend. Let them ask you questions about it. If you’re able to teach something well, you will be sure that you’ve understood it very well. 8. If you get yourself to be really happy and excited to see other people, they will react the same to you. It doesn’t always happen the first time, but it will definitely happen the next time. 9. The physical effects of stress — breathing rate and heart rate — are almost identical to the physical effects of courage. When you’re feeling stressed in any situations, immediately reframe it : Your body is getting ready to be courageous, you are NOT stressed. 10. Pay attention to people’s feet. If you approach two people in the middle of a conversation, and they only turn their torsos and not their feet, they don’t want you to join in the conversation. Similarly, if you are in a conversation with a coworker who you think is paying attention to you and their torso is turned towards you but their feet are facing in another direction, they want the conversation to end. 11. Fake it till you make it; confidence is more important than knowledge. Don’t be intimidated by anyone, everyone is playing a role and wearing a mask. 12. If you pretend to be something for long enough, you will eventually become it. 13. Not to be creepy, but if you want to stare at someone unashamedly, look directly past them and wait for them to try and meet your eyes. When they fail to do that, they’ll look around (usually nervously for a second) they won’t look at you again for some time. This is your chance to straight up stare at this person for at least 45 seconds. Corollary (Suggested by Brian Stutzman) If you’re staring at someone and get caught, DON’T turn your head or your body to look away, because that just confirms that you were staring. Just move your EYEBALLS off the person. Unlike turning your head, it’s instantaneous. And the person will think you were just looking at something behind them and that they were mistaken for thinking you were staring. Do it confidently, and ignore any reaction from the person, and you can sell it every single time. After a second you can even look back at them with a “Why are you staring at me?” look on your face to really cement the deal! 14. Build a network. Become the information source, and let the information be yours. Even grabbing a beer with a former colleague once a year will keep you in the loop at the old office. Former co workers might have gotten a new position in that office you always wanted to work in, great! Go to them for a beer, and ask about the office. It’s all about connections and information. 15. If you are angry at the person in front of you driving like a grandmother… Pretend it is your grandmother, it will significantly reduce your road rage. 16. Stand up straight No slouching, hands out of pockets, and head held up high. It’s not just a cliche — you literally feel better and people around you feel more confident in you. 17. Avoid saying “I think,” and “I believe” unless absolutely necessary. These are phrases that do not evoke confidence, and will literally do you no good. 18. When feeling anxious, clean up your home or work space. You will feel happier and more accomplished than before. 19. Always buy the first pitcher or round of drinks. You’d be surprised how long you could drink on the phrase “I bought the first one.” 20. Going into an interview… be interested in your interviewers. If you focus on learning about them, you’ll seem to be more interesting and dynamic. (Again, people love to talk about themselves.) 21. Pay Attention Parents: Always give your kid a choice that makes them think they are in control. For instance, when I want my son to put his shoes on I will say ,”do you want to put your star wars shoes on or your shark shoes on?” Pro-tip: In some cases, this works on adults. 22. Your action affect your attitude more than your attitude affects your action. As my former teacher said “You can jump and dance FOR joy, but you can also jump and dance yourself joyful.” 23. When a group of people laugh, people will instinctively look at the person they feel closest to in that group. 24. If you want to build rapport or gain someone’s trust quickly, match their body posture and position. If someone is sitting with her legs crossed, cross your legs. If they’re leaning away from you, lean away from them. If they’re leaning towards you, lean towards them. Mirroring and matching body position is a subconscious way to tell if someone trusts you or is comfortable with you. If you’re sitting with your arms crossed and you notice someone else is sitting with her arms crossed, that is a good indicator that you have/are successfully built/building rapport with that person. 25. The Benjamin Franklin Effect (suggested by Matt Miller) I find the basis of the Benjamin Franklin effect is very useful and extends far beyond pencil borrowing. This knowledge is useful in the world of flirting too. Asking a girl in your class if you can borrow a pencil or her notes or to explain the homework will make her more likely to like you than if you let her borrow your stuff or are the one to help her. Even just asking a girl to buy you drinks (facetiously) leaves a much bigger impression than offering to or actually buying a girl a drink. The best part is it kills 3 birds with one stone: you get the advantages of the favor itself, the person subconsciously likes you more, and it makes them more open to future favors and conversation. 26. Handling Panic and Anxiety Behavior (Suggested by Jade Barbee) When you’re feeling stressed, worried or angry, tap each finger tip while thinking (or speaking quietly) a few specific words about what is bothering you. Repeat the same words while tapping each of your 10 fingers, including thumbs. For example, tap while saying, “I’m so angry with her…” Doing so will likely take the charge out of the feeling and return you to a more resourceful (better feeling) state of being. It’s called EFT (Emotional Freedom Technique) or “tapping,” and it is useful in many life situations – emotional sadness, physical pain, food cravings, traumatic memories…

[najampicks-blog]

8 Reasons You're Still Weak or Fat

Here's what you need to know...

•  If after several years of training you're still weak, there's a good chance you need to rethink your ideas about squats and deadlifts; that you've got no love for the upper body squat; that steroids misled you about a basic training principle; and that you work muscles instead of movements.

•  If after several years of training you're still fat, there's a good chance you need to rethink your ideas about eating 6 meals a day and doing fasted cardio.

•  If you're still skinny, there's a good chance your ideas about post-workout nutrition are 10 years old and your definition of recovery days needs an adjustment.

Go to full article: 8 Reasons You're Still Weak or Fat

[najampicks-blog]

Read the light with a marble

Light is the essence of photography. And being able to capture the light to our benefit is what sets a great photographer apart from the rest. But sometimes finding the precise direction of light can be a little tricky. Professional photographer Frank Donnino shows us how to use a marble to pinpoint the light source:

A simple 25 millimeter black marble is all it takes to help locate the direction of light, particularly in wide-open bright space. Like the reflection on an eye, look for the catch light on the marble. By twisting your wrist around and moving the marble side to side the change in light and shadows will help to localize the source.  Donnino continues,

“Wherever I see the catch light at 2 o’clock or 10 o’clock …that’s the optimum lighting that I want.”

With the 10 and 2 o’clock theory in mind, Donnino also suggests using your thumb knuckle to mimic the ‘nose’ of your subject. This will help in positioning your subject in order to obtain the best lighting possible.

A marble is an effective and low cost tool that can easily be added to any kit. Just remember to find a source that will sell a single marble, otherwise you’ll be left with a full bag of marbles just waiting to be lost.

[najampicks-blog]

Are you using the best aperture setting?

It happens all the time. People get a fast lens and only want to shoot with it wide open. Of course, the point of having a fast lens is to utilize its wide aperture settings, but not all photographs benefit from f/1.8 or wider. In fact, a wide aperture can take away from certain photographs. Sound crazy? Listen to Matt Granger as he provides a quick primer on aperture settings:

n the video, Granger says it best:

“It’s not as simple as just throwing it wide open for portraits and having it stopped right down for landscapes.”

As photographers, it’s easy to get set into our ways. Many of us are taught that we should shoot with wider apertures for portraits so the background is blurred and doesn’t distract from the subject. We are also often told that landscapes should be shot at narrow apertures so the maximum depth of field can be achieved. While these are solid starting guidelines, they shouldn’t necessarily be regarded as law.

Take a look at the example portrait below. This image was taken at f/1.8, which did an excellent job of creating bokeh in the background. But upon closer inspection, we can see that the depth of field is so shallow that only one of the subject’s eyes is in focus.

f/1.8

To get both of the subject’s eyes in focus without changing the angle of the model or the camera, it’s necessary to stop down the aperture to bring more of the subject’s face within the range of focus. For example, Granger notes that he regularly shoots portraits at f/5.6 or f/8.

It goes without saying that the majority of time you will want as much of the scene in focus as possible when shooting landscapes. Naturally, closing your aperture to f/22 seems like a good way to achieve that, but it is not the only way. Look at this shot Granger took of Machu Picchu, what aperture setting do you think he used? F/16? F/22?

Can you guess what aperture was used for this landscape photo?

Would you be surprised to learn that this image was taken wide open at an aperture of f/1.4? Are you asking yourself how he managed to get the entire image in focus at such a wide aperture?

It’s actually quite simple. The farther away your subject is, the more depth of field you are starting with.

“If you are shooting something like Machu Picchu at 24mm at 1.4, if your subject is 100 feet away, for example, that’s your focus point. You’re going to have everything in sharp [focus] from 70 feet away all the way to infinity. That’s assuming you are using a full frame camera.”

To that end, not all lenses are created equally. Some perform much better wide open than others, which is definitely something you should consider. Regardless, even with a lens of lesser quality, you will probably not have to stop all the way down to f/22. Experiment with your lens to see its capabilities by shooting the same scene at various apertures. See if you can find its “sweet spot” in regards to aperture settings.

Courtesy: http://www.picturecorrect.com/tips/are-you-using-the-best-aperture-setting/

[najampicks-blog]

A satire that monkey can understand. Thanks Jon Stewart.

[najampicks-blog]

Just days after the tragic crash of a Malaysian Airlines flight over eastern Ukraine, Western politicians and media joined together to gain the maximum propaganda value from the disaster. It had to be Russia; it had to be Putin, they said. President Obama held a press conference to claim – even before an investigation – that it was pro-Russian rebels in the region who were responsible. His ambassador to the UN, Samantha Power, did the same at the UN Security Council – just one day after the crash!   While western media outlets rush to repeat government propaganda on the event, there are a few things they will not report.   They will not report that the crisis in Ukraine started late last year, when EU and US-supported protesters plotted the overthrow of the elected Ukrainian president, Viktor Yanukovych. Without US-sponsored “regime change,” it is unlikely that hundreds would have been killed in the unrest that followed. Nor would the Malaysian Airlines crash have happened. 

[najampicks-blog]

TechEd is Dead. Long Live…

The announcement is now live (the first of many) so I can talk a bit more freely about what I've known for a while about this latest newsworthy account from Microsoft.

In 2013 Microsoft decided to end the Microsoft Management Summit, the go-to event for System Center lovers. The community was up in arms about it, but Microsoft promised a successful and seamless integration into its long-standing IT generalist event, TechEd. To those in the upper echelon of the TechEd management teams, it was a success. But, to those who actually attended TechEd 2014 in Houston, it was a broken promise. Still, many believed this was a first effort, and Microsoft could use subsequent years to do better.

Fast forward to today, Microsoft is once again talking integration. Today the company has announced that they are ending ALL IT related events and rolling them up into a single, massively crowded conference in May 2015 in Chicago. Dubbed the Unified Technology Event for Enterprises (which is an interim name, thank God!), Microsoft will bring together all IT walks-of-life into a marketing extravaganza. And, as a bit of clarification, the only Microsoft-owned events left will be WPC, BUILD, and this new one. All other conferences will be rolled up into this new entity.

In the Channel 9 post, Denise Begley says:

You talked, we listened...

(I'm scratching my head trying to figure out who was actually doing the talking. It wasn’t me, and it definitely wasn’t anyone I know, i.e., anyone who derives value from events like MMS and TechEd.)

I'll have more to share on this as the week progresses, but let me leave you with something. As Microsoft continues cutting significant and valuable resources for IT Pros (TechNet subscriptions, TechEd, MMS, others) in an effort to consolidate messaging, it should be getting even clearer for you just how important 3rd party events like IT/Dev Connections really is becoming. IT/Dev Connections is a "right-sized" (to coin a Microsoft layoff term) conference that provides deep technical learning and education. These types of events are becoming more and more important to your career because they focus on you and your job now. For Microsoft to be successful in the IT Pro ranks, the company will need to invest support in these smaller, better targeted events – and that may be happening already. Later this week we'll announce Brad Anderson, Corporate VP of Cloud and Enterprise at Microsoft, as the keynote speaker at IT/Dev Connections 2014.

If you truly want to hear the Microsoft roadmap, I'd highly suggest attending UTEE (is that the new acronym?). I'll be there, for sure.

Courtesy: http://windowsitpro.com/cloud/teched-dead-long-live