Michael Waterman

Ramblings on IT and Security

Mastering AppLocker: Security Group Exceptions

I’ll promise to keep this blog post short—well, shorter than usual (hopefully). Last week, I worked on a project involving application allow listing. In the Windows ecosystem, this can be achieved using Windows AppLocker. While AppLocker has been around for quite some time, it’s only recently become available on Windows 11 Professional. Previously, it was an exclusive feature for Enterprise versions.

Continue reading

Exploring Persistent Access in Active Directory: The AdminSDHolder Backdoor

Hey there, tech enthusiasts and Active Directory adventurers! Today, let’s talk about something really cool yet often overlooked in the world of Microsoft Active Directory: the AdminSDHolder. Now, you might be thinking, “What’s so special about this AdminSDHolder?” Well, let me tell you, it’s a game-changer in how security permissions are managed in your organization’s digital realm.

Continue reading

Advanced QEMU/KVM Networking on Ubuntu

Transitioning between Operating Systems can be a challenge. Many aspects of what you’re used to work differently and you should expect a learning curve.

Well, that was a weird intro for a blog post that has Linux networking in the title! Actually I’m saying goodby to Windows as my primary system…. yes you read that correctly. It’s not that I don’t like the system anymore, it’s the direction Microsoft is taking with AI and the integration into the OS that made me take this decision.

Continue reading

Privileged Access Workstation Shenanigans

Do you know what really ticks me off? Stuff that doesn’t work as expected. Exactly that happened to me today while I revisited configuring a “Privileged Access Workstation” (PAW). Now a PAW is used to safeguard highly privileged credentials in a domain or cloud environment. In essence it’s a workstation used solely for admin work, all infrastructure management is done from this machine. While talking about configuring a PAW is beyond the scope of this blog post, I do need to point out that “Domain Admins” and equivalent groups should never ever have local admin rights on a PAW, they should be regular users, reducing the risk of credential theft and the obvious malware infection that usually follows.

Continue reading

PKI – Part 4: Understanding Cryptographic Providers

Introduction

In the realm of Public Key Infrastructure (PKI), where the keys to digital security are exchanged, stored, and safeguarded, cryptographic providers play a pivotal role. These providers are the guardians of cryptographic keys, ensuring the integrity, confidentiality, and authenticity of digital communications. They are the invisible sentinels that underpin the very foundation of trust in the digital world.

Continue reading

PKI – Part 3: The role of hash functions in PKI

With Public Key Infrastructure (PKI), cryptographic hash functions play a pivotal, yet often understated role, operating ceaselessly to secure the integrity and authenticity of digital data as it navigates through contemporary communication networks. To appreciate fully the indispensable role they occupy in PKI, it is essential first to delineate the fundamental principles of hash functions and to understand why they are frequently analogized as the digital fingerprints within the cybersphere.

Continue reading

PKI – Part 2: Choosing the key length and algorithm

As I advance into the heart of PKI in this second installment, the focal point shifts towards two pivotal decisions that anyone involved in setting up a PKI must grapple with — choosing the appropriate key length and the cryptographic algorithm. These choices are far from arbitrary, for they are the bedrock of a secure and efficient PKI. A meticulous selection in this stage ensures a fortification capable of withstanding the numerous cyber threats that litter the digital space in this day and age.

Continue reading
« Older posts

© 2024 Michael Waterman

Theme by Anders NorenUp ↑