Asset Inventory and IT Hygiene Help Reduce an Organization’s Attack Surface
Summary
The article recommends maintaining an accurate inventory of systems and applications, removing unneeded assets, and securely configuring required services to improve monitoring and reduce attack opportunities.
Key points
- Track systems, applications, owners, access, versions, and patch levels in a regularly maintained asset inventory.
- Huntress says it observed legacy TeamViewer installations used to install cryptocurrency miners, highlighting the risk of forgotten remote-access software.
- Remove systems, applications, and services that are not needed for business operations.
- Limit required systems to necessary services and ensure appropriate compensating controls and monitoring are in place.
- Configure endpoints and applications to reduce risky initial-access paths, including macros, disk-image attachments, and weaponized OneNote files.
- The article says better asset visibility and attack-surface reduction can support earlier detection and response and reduce false-positive alerts and alert fatigue.
Article Details
- Defense Focus
- Reduce organizational attack surface through accurate asset and application inventories, secure configuration, and effective monitoring.
- Detection Methods
- Maintain an inventory of systems and applications, including where applications are installed and their versions and patch levels.
- Use SIEM or EDR monitoring informed by an accurate view of organizational assets.
- Monitor endpoint configurations and applications for unauthorized or unnecessary services and access.
- Data Sources
- Asset inventories of physical and virtual systems, applications, and servers
- Application version and patch-level records
- SIEM and EDR telemetry
- Endpoint and application configuration data
- Platforms
- SIEM
- EDR
- Defensive Actions
- Identify systems, applications, their managers, and who has access to them.
- Remove systems, applications, or services that are not required for business operations.
- Limit systems to the services necessary for their business functions and apply compensating controls and monitoring.
- Patch applications and maintain records of versions and patch levels.
- Control endpoint and application configurations, including blocking macros in downloaded MS Office files and reducing exposure to ISO, IMG, and VHD email attachments and weaponized OneNote files.
- Review legacy remote-access software, remove unnecessary installations, and secure or disable exposed access.
Vendors
Products
3CX VoIP Desktop Applicationwith respect to installed applications, such as the PaperCut print management software, the 3CX VoIP Desktop Application and the MOVEit file transfer software. Part of a regularly maintained asset inventory programMicrosoft Office OneNotephishing attacks using macros in MS Office document attachments. Toward the end of 2022, “weaponized” OneNote files were observed being sent as email attachments. In March 2023, Huntress published a blog post withMS Office2022, Microsoft announced that they were going to change the default behavior and block macros in MS Office files downloaded from the Internet.PaperCutfirst half of this year saw a number of issues arise with respect to installed applications, such as the PaperCut print management software, the 3CX VoIP Desktop Application and the MOVEit file transfer software. PartProgress MOVEit Transferapplications, such as the PaperCut print management software, the 3CX VoIP Desktop Application and the MOVEit file transfer software. Part of a regularly maintained asset inventory program would ideally include aTeamViewerRecently, the Huntress team observed several instances where legacy TeamViewer installations had been used to install cryptocurrency mining software. While cryptocurrency miners themselves may not seem significant, the