Over the years, security has evolved from being a shared role or a role that was non-existent within a business. Today, well-defined teams and organizational structures exist or are being created to focus solely on security. Not only are these teams maturing constantly, but the Chief Information Security Officer (CISO) has become a person of significant importance and may report directly to a Chief Executive Officer (CEO) and not the Chief Information Officer (CIO).

Over the years, many roles that never existed before have begun to appear within the security world, and new skill sets are always in demand. As an overview, here are some of the more common security roles that you can expect to see within a security program: CISO/CSO, Information Technology (IT) Security Director, IT Security Manager, Security Architect/Engineer, Security Analyst, Security/Compliance Officer, Security Administrator, Security Engineer, Software/Application Security Developer, Software/Application Security Engineer, Cryptographer/Cryptologist, Security Consultant/Specialist, Network Security Engineer, and Cloud Security Architect.

As an example, the following screenshot shows what a security organization may look like through an organization chart. Every organization is different, but this will provide you with a basis of what can be expected:

Figure 1.1 – Sample organization structure

One thing to point out regarding these roles is the shortage of a cybersecurity workforce throughout the world. Although an ongoing concern, the great news is that since the original version of this publication, there has been a significant increase in cybersecurity professionals worldwide, according to the cybersecurity workforce study by the International Information System Security Certification Consortium ((ISC)²). The updated (ISC)² 2021 Cybersecurity Workforce Study shows that a worldwide growth of 65% is still needed to meet the demand for cyber experts, which is significantly down from 2019 when 145% growth was needed. The study estimates that there are approximately 4.19 million cybersecurity professionals globally. This is an increase of more than 700,000 from 2020. The ongoing challenge continues to be with the growth of new positions that are continuously being created as cybersecurity programs continue to enhance. This makes it difficult to find well-seasoned talent and may require you to think outside the box as you look to onboard those new to the field or looking to shift careers. You can read more about the (ISC)² 2021 Cybersecurity Workforce Study here: https://www.isc2.org/Research/Workforce-Study.

One of the primary factors for a growing need for security experts correlates to the advancement of the personal computer (or PC) and its evolution throughout the years. The PC has changed the way we connect, and with this evolution comes the supporting infrastructure, which has evolved into the many data centers seen throughout the world.

As we are all aware, Windows has been the victim of numerous vulnerabilities over the years and continues to be a victim even today. The initial idea behind the Windows Operating System (OS) was a strong focus on usability and productivity. As a result of its success and adoption across the globe, it became a common target for exploits. This, in turn, created many gaps in the security of Windows that have traditionally been filled by many other companies. A good example was the need for third-party AV software. As the world has turned more toward digitization over the years and Windows usage has continued to grow, so has the need for improved security, along with dedicated roles within this area. Protecting Windows has not been an easy task, and it continues to be an ongoing challenge.

Today, we are more reliant on technology than ever and live in a world where businesses cannot survive without it. As our younger generations grow up, there is greater demand for the use of advanced technology. One scary thought is how fast the world has grown within the previous 100 years compared to the overall history of mankind. Technology continues to push the boundaries of innovation, and a significant portion of that change must include the securing of this technology, especially since the world has become a more connected place with the advancement of the internet.

To give you a rough idea of technology usage today, let’s take a look at the current desktop usage throughout the world. For these statistics, we will reference an online service called StatCounter GlobalStats: https://gs.statcounter.com/. This dataset is not all-inclusive, but there is a very large sampling of data used to give us a good idea of worldwide usage. StatCounter GlobalStats collects its data through web analytics via a tracking code on over 2 million websites globally. The aggregation of this data equates to more than 10 billion page views per month. The following screenshot shows the OS market share that is in use worldwide. More information from StatCounter can be viewed at https://gs.statcounter.com/os-market-share/desktop/worldwide:

Figure 1.2 – StatCounter desktop OS market share worldwide

As you can see, the Windows desktop market is more widely adopted than any other desktop OS available today. Seemingly, Windows has always had negative connotations because of its ongoing vulnerabilities in comparison to other OSs. Part of this is due to how widely used Windows is—a hacker isn’t going to waste their time on an OS that isn’t widely adopted. We can assume there would be a direct correlation between OS adoption rates and available security vulnerabilities. Additionally, the Windows OS is supported across many types of hardware, which opens opportunities for exploits to be developed. One reason why we see significantly fewer macOS vulnerabilities is due to the hardware control with which Apple allows its software to run on. As the platform has grown, though, we have seen an increase of vulnerabilities within its OS too. The point I’m making is that we tend to focus our efforts on areas where it makes sense, and Windows has continued to be a leader in the desktop space, making it a very attractive source to be attacked. This, in turn, has created an ecosystem of vendors and products over the years, all aimed at helping to protect and secure Windows’ systems.

Let’s look at the current adoption of the different Windows OSs in use. The following screenshot from StatCounter shows the current Windows desktop version usage around the world today. To view these statistics, visit https://gs.statcounter.com/os-version-market-share/windows/desktop/worldwide:

Figure 1.3 – Desktop Windows version market share worldwide

As you can see, Windows 10 is the most adopted OS at 73%. In addition, Microsoft has recently released Windows 11, accounting for almost 9% of the desktop market share already. Microsoft continues to push more users and organizations to the latest version of Windows, and this is where it spends the majority of its development resources. There are also major changes to Windows 11 compared with older versions, which is why it is critical to migrate from older versions, especially for security-specific reasons. Microsoft ended its support (including security updates) for Windows XP in April 2014 and Windows 7 in January 2020. It has also announced the retirement of Windows 10 support for October 14, 2025.

A recent buzz term you have most likely heard in recent years is that of digital transformation. This refers to the shift from a legacy on-premises infrastructure to a modernized cloud-first strategy to support the evolving need for big data, machine learning, Artificial Intelligence (AI), and more. A significant part of this shift also falls within Windows systems and management. In Chapter 11, Server Infrastructure Management, we will look at the differences between a data center and a cloud model, including where the responsibilities fall for maintaining and securing underlying systems. Prior to digital transformation, we relied heavily on the four walls of the corporation and its network to protect a data center and its systems. This included a requirement for client devices to be physically on the corporate network in order to access data and services. With this model, our devices were a little easier to manage and lock down, as they never left the corporate office. Today, the dynamics have changed. Referencing back to StatCounter, in the following screenshot, you can see a significant shift from traditional desktop usage to a more mobile experience. The Mobile percentage reflects an increase of over 2% since the initial release of this publication 2 years ago. To view the source of this screenshot, visit https://gs.statcounter.com/platform-market-share/desktop-mobile-tablet/worldwide/#monthly-200901-202110:

Figure 1.4 – StatCounter platform comparison (January 2009 - May 2022)

Focusing on Windows security, the traditional model of an organization would have typically included the following security tools as part of its baseline:

• AV software
• Windows firewall
• Internet proxy service
• Windows updates

Depending on your organization or industry, there may have been additional tools. However, for the most part, I’d imagine the preceding list was the extent of most organizations’ security tools on Windows client devices. The same would have most likely applied to the Windows servers in the traditional model. As the digital transformation has brought change, the traditional method of Windows management has become legacy. There is an expectation that we can work and access data from anywhere, at any time. With the rapid increase in remote working during 2020 and 2021, this model and expectation have been fast-tracked. We live in an internet-connected world, and when we plug our device in, we expect to access our data with ease. With this shift, there is a major change in the security of the systems we manage and—specifically—the Windows server and client. As we shift our infrastructure to the cloud and enable our users to become less restricted, the focus of security revolves not only around the device itself but that of the user’s identity and, more importantly, the data. Today, the items we listed earlier will not suffice in the enterprise. The following tools are those that would be needed to better protect your Windows devices:

• Advanced Threat Protection (ATP): AV and threat protection, Endpoint Detection and Response (EDR), advanced analytics and behavioral monitoring, network protection, exploit protection, and more
• Data Loss Prevention (DLP) and information protection
• Identity protection: Biometric technology, Multi-Factor authentication (MFA), and more
• Application control
• Machine learning and advanced AI security services

The threat landscape within the cyber world is extremely diverse and is continually becoming more complex. The task of protecting users, data, and systems is becoming more difficult and requires the advancement of even more intelligent tools to keep bad actors out. Today, criminals are more sophisticated, and large groups have formed with significant financial backing to support the wrongdoings of these groups. The following are common cyber threats: national governments, nation-states, terrorists, spies, organized crime groups, hacktivists, hackers, business competitors, and insiders/internal employees.

Tip

To learn more about these cyber-threat sources, the Department of Homeland Security (DHS) has a great reference here: https://us-cert.cisa.gov/ics/content/cyber-threat-source-descriptions.

To shed some light on real-world examples of data-breach sources today, Verizon releases an annual report, Data Breach Investigations Report. You can view their latest report here: https://enterprise.verizon.com/resources/reports/dbir/. The report is built on a set of real-world data and contains some eye-opening data on data breaches, such as the following revelations highlighted in the 2021 report:

• 85% of breaches involved a human element.
• 61% of breaches involved credentials.
• 3% of breaches involved vulnerability exploitation.
• Action variants in breaches: phishing 36%, up by 25% from 2020; use of stolen credentials 25%; ransomware 10%, which more than doubled from 2020.
• Credentials remain one of the most wanted data types.
• The most common motivation for attacks continues to be financial.
• The number-one threat actor is currently organized crime.

The full 2021 report can be found here: https://www.verizon.com/business/resources/reports/dbir/2021/masters-guide/.

There are many types of cyberattacks in the world today, and this creates a diverse set of challenges for organizations. While not all threats are Windows-specific, there’s a chance that Windows is the median or attack vector in which an attacker gains access by exploiting a vulnerability. An example of this could be an unpatched OS or an out-of-date application. Next, we list many types of threats that could cause damage directly using a vulnerability within the Windows OS or by using the Windows OS as an attack vector.

Malware is software or code designed with malicious intent that exploits vulnerabilities found within the system. The following types of threats are considered malware: adware, spyware, virus (polymorphic, multipartite, macro, or boot sector), worm, Trojan, rootkit, bots/botnets, ransomware, and logic bombs.

In addition to malware, the following types of attack techniques can be used to exploit vulnerabilities:

• Keylogger
• Phishing (email phishing, spear phishing, whale phishing, vishing, smishing, or pharming)
• Social engineering
• Business Email Compromise (BEC)
• Structured Query Language (SQL) injection attack
• Cross-Site Scripting (XSS)
• Denial of Service (DoS) and Distributed Denial of Service (DDoS)
• Session hijacking
• Man-in-the-Middle (MITM) attacks
• Password attacks (brute-force, dictionary, or birthday attacks)
• Credential stuffing or reuse
• Identity theft
• Advanced Persistent Threats (APTs)
• Intellectual property theft
• Shoulder surfing
• Golden Ticket: Kerberos attacks
• Domain Name System (DNS) tunneling and dangling DNS
• Zero-day

  Tip

  To learn more about the threats listed earlier, the National Institute of Standards and Technology (NIST) has a glossary that provides more information on most, if not all, of the threats in the preceding list: https://csrc.nist.gov/glossary.

Now that we’ve just reviewed today’s threats, let’s take a look at an extremely important topic that has everyone’s attention. Ransomware preparedness is on everyone’s security priority list.

In the previous section, we introduced many of the threats and cyberattacks that continue to challenge us as cybersecurity professionals. One specific type of malware we want to cover in more detail is ransomware. Since the original release of this publication, ransomware incidents have grown exponentially, and ransomware is currently one of the biggest threats to organizations today. In short, a ransomware attack refers to an intruder encrypting data belonging to a user or organization, making it inaccessible. For the user or organization to gain access back to their data, they are held to a ransom in exchange for the decryption keys. The intruders will use many tactics to try to force payment, including threats to leak the data and list the data for sale on the dark web, to the extent of erasing backups, to name a few.

Ransomware has been around for a long time, and the first documented incident occurred in 1989, known as PC Cyborg or the AIDS Trojan. Since then, ransomware has evolved substantially into a business with high payoffs for attackers. There is even a ransomware-as-a-service (RaaS) model that allows hackers to subscribe and use the service to commit their own attacks. A report released by the Federal Bureau of Investigation’s (FBI’s) Internet Crime Complaint Center (IC3) (https://www.ic3.gov/) received 2,084 ransomware incidents between January and July 2021 alone. The cost of complaints from the 2,084 incidents totaled over US dollars (USD) $16.8 million. This is a 62% increase in reported incidents and a 20% increase in losses from the same period in 2020. These numbers alone show a significant increase in ransomware. You can read more on the report here: https://www.ic3.gov/Media/News/2021/210831.pdf.

When it comes to ransomware (or any other threat), the first action should be to protect your environment as best as possible. Although there is a lot that can be done to prevent ransomware from occurring, there is no way to make your environment 100% resilient from such an attack. Because of this, the second action you need to take is being prepared to respond. Ransomware can impact anyone at any time, and the better prepared you are, the better you will be able to handle the situation and the quicker you will be able to recover your environment. Time is of the essence in these situations as you may be losing millions of dollars, customers, and a reputation that has taken years to build.

There are many great resources available for ransomware preparedness and response. Our review of ransomware preparedness and response will be referencing the following two excellent resources for recommendations and information:

• Cybersecurity and Infrastructure Security Agency (CISA): https://www.cisa.gov/stopransomware
• NIST: https://csrc.nist.gov/projects/ransomware-protection-and-response

First, let’s review some best practices for protecting your environment from a ransomware attack. A lot of the following recommendations should be part of your standard security best practices, but it’s best to review and validate any gaps you may have in your infrastructure:

• Enforce MFA, use least privileges or just-enough privilege, and implement Privileged Access Management (PAM) and Privileged Identity Management (PIM).
• Patch and update all software and OSs (including network devices) to the latest supported versions.
• Ensure you are using the latest protection solutions including EDR or Extended Detection and Response (XDR).
• Implement next-generation network protection: firewalls, Intrusion and Detection Prevention (IDP), Intrusion Prevention Systems (IPSs), and so on.
• Implement network segmentation.
• Restrict the use of scripting to approved users.
• Secure your Domain Controllers (DCs).
• Block access to malicious sites.
• Only allow trusted devices on your network.
• Disable the use of macros.
• Only allow approved software to be used by your users.
• Remove local admin permissions.
• Enable advanced filtering for email.
• Use Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC).
• Block the Server Message Block (SMB) outbound protocol and remove outdated versions.
• Follow best practices to harden your end-user and infrastructure devices.
• Protect your cloud environment with best practices, especially public file shares.
• Review your remote strategy and ensure outside connections into your environment are secure. If Remote Desktop Protocol (RDP) is needed, ensure best practices are deployed.
• For backups, maintain an offline backup or air gap, encrypt all backups, and validate recovery by testing regularly.
• Implement and focus attention on a well-defined Vulnerability Management Program (VMP).
• Implement a good cybersecurity and awareness program. Train users not to click on links or open attachments unless they are confident they are legitimate.
• Build a mature Vendor Risk Management (VRM) program.

This is a very high-level summary and may not be inclusive of everything that you may need to account for when protecting your network from a ransomware attack. This is a great starting point, but a lot of effort and time will be needed to best protect against malicious attackers.

Additional Information

The preceding list has been derived from the CISA Ransomware Guide (https://www.cisa.gov/sites/default/files/publications/CISA_MS-ISAC_Ransomware Guide_S508C_.pdf) and the NIST Tips and Tactics | Preparing Your Organization for Ransomware Attacks document (https://csrc.nist.gov/CSRC/media/Projects/ransomware-protection-and-response/documents/NIST_Tips_for_Preparing_for_Ransomware_Attacks.pdf), which contain a lot more detail for review.

As already stated, there is no way of completely preventing a ransomware attack in any environment—it could happen to anyone. No matter how much you protect your environment, there will always be a way to circumvent it. Because of this, the next best action you can take is responsiveness. Being prepared and ready to respond to a ransomware attack will allow you to handle the situation much more efficiently and get your environment up and running much faster. Here are some critical items to help with your response:

• Have an up-to-date Incident Response Plan (IRP). This should include all critical information needed to respond to a ransomware attack, including contact information (local law enforcement), responsibilities, communications, and so on.
• Ensure you have a ransomware playbook as part of your IRP.
• Ensure you have a well-documented Disaster Recovery (DR) plan and Business Continuity Plan (BCP) that is up to date and tested.
• Ensure you have a mature Security Operations Center (SOC) or Managed Security Service Provider (MSSP).
• Conduct a tabletop exercise using ransomware as your theme. Ensure executives are involved in these exercises as they will ultimately need to make some of the important final decisions.
• Carry cybersecurity insurance and understand what options are available with ransomware payment from your cyber insurance policy if this becomes a decision point. Check if you need to obtain a cryptocurrency account or if this is part of the service they provide. Make sure you are not breaking any laws if payment will proceed.
• At a minimum, contract with a couple of respected Incident Response (IR) vendors with whom you have Service Level Agreements (SLAs) for engagement. Ensure that they also provide Digital Forensics Incident Response (DFIR) and are approved for use by your cybersecurity insurance policy. A couple to review are Secureworks (https://www.secureworks.com/services/incident-response/incident-management-retainer) and KPMG (https://advisory.kpmg.us/services/cyber-response-services.html).

  Information

  We will cover the IRP in more detail in Chapter 14, Security Operations.

Everything we have covered for ransomware response should be part of the overall hardening of your environment as part of your security program. Implementing these recommendations will help protect you against many threats. In addition, having an IRP is intended for any security incident within your environment, and this should be a requirement for your security program in general. As we take you through this book, you will learn how to harden your Windows environment to best protect yourself from a ransomware attack.