Weekly Newsletter

Security

Backup

• Protect backups from hackers [YouTube]
  Philip Elder provides a great refresher on making sure backups are isolated and properly managed.

Cyber insurance & risk management

• Get answers to your questions about cyber insurance and the legal risk of ransomware [YouTube]
  Watch our FAQ webinar with MSP legal advisor Bradley Gross and insurance expert Justin Reinmuth from techrug.
• Get a primer on protecting your business with effective risk management [YouTube]
  Techrug CEO Justin Reinmuth breaks down how to better leverage your contract, processes, procedures, and insurance to reduce your liability (more important now than ever with WFH and COVID).
• Get the facts on how liable you (or your clients) are for a data breach [YouTube]
  One of the biggest worries surrounding data breaches is the thought that your MSP could be held responsible and subject to fines and damages. This explainer video from Joseph Brunsman will help arm you with the facts and help put your mind at ease.

Dark web & data breach monitoring

• Start notifying clients when their email addresses are in data breaches [script]
  When Kelvin Tegelaar's MSP was approached by a vendor offering to provide info on what breaches their email addresses were associated with, he thought — why don't I just build that myself? The result is a set of PowerShell scripts anyone can use.

DNS & URL filtering

• See a head-to-head assessment of DNS malware filtering tools [YouTube]
  Tom Lawrence of Lawrence Systems recently ran a test that compared filtering results for Quad9, Cloudflare, DNS Filter, and OpenDNS/Cisco Umbrella. The results were dramatic (though Tom did need to issue a follow-up to clarify a few things).
• Stay on top of new malicious URLs to block [tool]
  URLhaus is an open and regularly updated database of malicious sites being actively used for malware distribution.

MSP internal security

• Grab this MSP cybersecurity checklist to protect your company from ransomware and other attacks [checklist]
  This is a perfect time to roll out security controls you may have been putting off. This checklist has more than 50 practical suggestions that can save your bacon. Is there anything on here that you’ve missed?
• Take a major step forward with your internal security by introducing Named Accounts
  Cyberdrain author Kelvin Tegelaar explains why introducing named accounts is crucial to improving audability and access control, reducing attack surface, and more. Better yet, he shares PowerShell scripts to automate that.
• See how criminals sell access to MSPs on the dark web [blog post]
  Go undercover with Huntress Labs as they interact directly with a seller. The goal: get enough information to warn the would-be victim MSP in time.

Phishing

• Sign up to get notified when one of your MSP employees gets phished [tool]
  Abuse.ch, the non-profit behind URLhaus, has a free web service that sends out email notifications if a user enters their password on a phishing website.
• See an example of the latest (incredibly convincing) phishing emails targeting MSP remote access tools [reddit]
  As if we needed any reminder that MSPs are top targets. Reddit user /char512 shares details and a screenshot of the phishing attempt he received targeting his ConnectWise Control credentials.
• Run a variety of DNS, blacklist, and SMTP diagnostic tests with just one tool [tool]
  If you're not familiar with mxtoolbox.com it's a great site to diagnose a host of things, including DNS issues and DMARC.

Ransomware

• See new statistics behind the latest ransomware trends [blog post]
  Big changes in the ransomware ecosystem are resulting in large increases in downtime, resulting costs, and average ransom amounts — from $6,733 in Q4 2018 to $84,116. Find out why.
• See a fantastic breakdown of 2020 ransomware campaigns along with attack vectors and mitigation techniques [article]
  Microsoft's Threat Protection Intelligence Team shares data they've gathered on ransomware deployments during the first two weeks of April. This is honestly one of the best, most actionable write-ups on ransomware we've seen in a while.
• See data on Q1 ransomware trends gathered from victim organizations [blog post]
  These days there are really only two security vendor reports I actually look forward to: 1) Verizon's DBIR; 2) Coveware's Quarterly Ransomware Marketplace Report. The latter's report for Q1 2020 highlights a 33% rise in the average ransom payment along with several interesting shifts in attacker activity and tactics.
• Get threat intel on the ransomware that is costing Cognizant $50 - $70M
  MSP heavyweight Cognizant says that the Maze ransomware attack it suffered in April is going to significantly cut into its Q2 2020 revenue. FireEye recently released a deep dive on Maze, includiing IoCs.

Securing Microsoft (Azure, M365, O365, Teams, etc.)

• Tighten up Microsoft Office 365 Email Security [checklist]
  For all the talk of sophisticated new attack techniques, the truth is email remains one of the most popular attack vectors. This checklist will help you conduct an audit and reduce your risk.
• Set up alerts for O365 logins from untrusted locations [blog post + PowerShell script
  CyberDrain author Kelvin Tegelaar offers a script that monitors where users are logging on from and compares it to a database online.
• Learn all about why Microsoft 365 Sensitivity Labels are a big deal [blog post]
  ITProMentor author Alex Fields explains why Sensitivity Labels represent the future of access control.
• Make sure Microsoft Teams is setup securely
  If you're encouraging your clients to use Teams here's a walkthrough of configurations and controls that can harden its security. If the linked-to video is too long for you, check out the checklist here.
• Ensure Azure service is HIPAA, PCI, GDPR, and/or CCPA compliant [guide]
  This meaty guide walks through each of the restrictions and covers all the best practices you need to know.
• Learn about Azure AD password spraying attacks and how to defend against them [blog post]
  Daniel Chronlund shares an example of a password spray attack abusing PowerShell and how to break it with a simple Conditional Access policy
• Secure Microsoft Exchange Online with PowerShell
  This video walkthrough covers settings and policies you can configure to harden Exchange Online and reduce its attack surface. Better yet, scripts are included to make it all automated.
• Start reporting to clients what their Microsoft Secure Scores are [script]
  If you're looking for ways to upsell clients on security products/services, a proven way of convincing them is by introducing them to their Microsoft Secure Score — and getting them to chase after raising it. This script from Elliot Munro at GCITS automates pulling client scores and exporting the data into a branded HTML report.

Security awareness training

• Get your hands on remote work security training materials [kit]
  The great folks at SANS have made a bunch of their training materials available for free, including a security awareness guide and checklist.

Security monitoring

• Get a primer/refresher on critical Windows logging [cheat sheet]
  Are you collecting the right logs necessary for security audits and incident response? Here's a handy cheat sheet to confirm.
• Confirm which crucial Windows Event IDs I should be monitoring [blog post]
  While not comprehensive, this post from RocketCyber shares what they consider to be the top 10 security events, from account logins to lockouts.
• Know what ports are open on client networks [blog post]
  Kelvin Tegelaar walks through how to conduct quick and easy external port scanning with PowerShell, and shares a script for alerting when 3389 or any other port is open.

Security policies & incident response planning

• See 50 examples of security policy templates from SANS [templates]
  We've had several partners asking for examples of policies templates. This collection from SANS covers everything from antivirus guidelines to workstation security for HIPAA compliance.
• Grab an example incident response plan template
  Is your team ready to jump into action when a security incident hits? Get access to a collection of playbooks here.

System hardening

• Secure ConnectWise Control (ScreenConnect) with 2FA [YouTube]
  With attackers continuing to abuse it to deploy ransomware, it's absolutely crucial to have access locked down with 2FA. Tom Lawrence of Lawrence Systems shows how.
• Learn how to defend against PowerShell attacks [blog post]
  See the latest recommendations directly from Microsoft, including its take on disabling PowerShell (spoiler alert: it's not recommended).
• Learn how to prevent PowerShell-based “living-off-the-land” attacks [blog post]
  Why drop malware when you can achieve malicious goals by abusing legitimate system programs, instead? That approach — referred to as "living off the land" — has instigated yet another cat-and-mouse game between attackers and defenders. But as Kelvin Tegelaar points out in this post, many living-off-the-land techniques leverage PowerShell commands that can be blocked relatively easily.
• Check for security holes accidentally introduced during the mad WFH rush [checklist]
  Security expert Jake Williams points out some of the core things you should look out for and mitigate — before attackers find them first.
• Learn how to create an application whitelisting policy in Windows [guide]
  For all the shiny, cutting-edge security software out there, the fact is, under the right conditions, application whitelisting can still do a lot of heavy lifting.

Vulnerabilities & patch management

• Mitigate Citrix RCE vulnerability CVE-2019-19781 —which is actively being exploited [blog post]
  Referred to as "one of the most dangerous bugs disclosed in recent years" you can learn all about CVE-2019-19781 aka "Shitrix" along with mitigations here.
• Check to make sure Microsoft Exchange servers haven’t been compromised [blog post]
  Attackers are actively exploiting a vulnerability that allows them to remotely execute code as SYSTEM. Microsoft issued a patch last month, but if you're concerned the folks at TrustedSec have provided a list of IoCs.

Windows 7 & Windows Server 2008 EOL

• See how much Extended Security Updates are going to cost [chart]
  This handy visual breaks down the options and costs for receiving ESUs for Windows 7, Windows Server 2008, and Windows SQL Server 2008.
• Confirm how I'm actually going to get Windows 7 ESUs [blog post]
  There's quite a bit of confusion surrounding who can get ESUs and who can't, not to mention what the actual process looks like. This post helps clear things up.
• Confirm how I'm actually going to get Windows Server 2008 ESUs [documentation]
  These are being handled differently than Windows 7 ESUs. Here are the details straight from Microsoft.
• Get a reminder of the other Microsoft products/versions going EOL in 2020 [list]
  Windows 7 and Server 2008 may be the big ones, but they're not alone. See the full list along with migration guidance for each here.