2020BCS-北京网络安全大会：无惧前行-新数字经济场景下的特权访问管理.pdf

1、2020北京网络安全大会2020 BEIJING CYBER SECURITY CONFERENCEPERCONNERiSKENCEPSIMANAGEMEAPON无惧前行新数字经济场景下的特权访问管理GDPRLEARNINGJPPLY CHAINTRUENDPOIMENDPOINT SECURITYSEFENSEBEHAVIORAL ANALNETWORAHUMAN PRloTCRIICAL路军龙INTERNTIONBEHAVIORALANRESPONSETECHNOLOGYCyberArk software技术术总监#page#2020北京网络安全大会黑客攻击链020BE1JCredenti

2、alforHarvestingAimsWindowsWORKSTATIODRKSTATIONPrivilegesThe Privileged Pathway toTHE DOMAINCONTROLLERInitialintrusion，Steal adminStealadminoften phishingpasswordpasswordusedfor aserverCRITICALWORKSTATIONSDOMAIN CONTROLLER668中NefiworkUse password.Steal hash for anSYSTEFindnothing.admin passwordwirate

3、 tickets forallHijackinMove on.broadacGainaccess toALLcriticalassetsssetsin domain#page#2020北京网络安全大会特权访问风险面巨大020BE1JDANGER!特权账号无处不在账号共享，缺少责任界面mysql:databasepopulate my-db应用内嵌密码难于管理username = production-robot改密带来挑战远程访问无法保证安全，难于追踪password=不同服务商的远程访问难于实现灵活访问控制D3d*9lxs3#fkd5fsDvu%34qsocv3黑客的最爱privileges

4、 =SELECT.INSERT,UPDATE,DELETEschemafile =/usr/share/my-db/schema/mysql.sql#page#2020北京网络安全大会新常态下的安全趋势02001JAccordingtothereportphishing remains thetopformofsocial-driven breach and“schemes are increasinglysophisticated and malicious”asremote work surges.DBIBMeanwhile，theuseofstolen credentialsbyexte

5、rnalactorsisona meteoric riseMore than 80% of breaches tied to hacking（the number one threat action）involve the use of lostorstolen credentials or brute force.While these findingsare not new or surprising，theDBIRremindsus thatattackers nearlyalways take the path ofleastresistanceby usingthistried-an

6、d-trueapproach:startwithaphishing scam（96%arrive byemail）targetingausersendpointtheneasilycrackweakpasswordsorstealcredentialsstored on the device.Using these credentials，theattackercanmove fromworkstation toworkstation in searchof sensitive data to stealand privileged credentials (such aslocal admi