Full transcript
0:00Ransomware in small and medium businesses or SMBs. The top five missing or incomplete controls that could prevent or attackers. I think I've posted about these in the post on Twitter now X multiple times in fact, but I felt the subject deserves its own little article. Security Aura or Just Aura is their hacker handle, their
0:21alias, their online nickname. And I saw that they had shared this just previously and the reviews are in. Jeff K says it's literally the best thing written on the internet today. So, I would like to take a look through it. And just to say aloud, I did ask for their permission. I wanted their blessing and approval to be able to
0:38showcase this in a video. And they did say yes, absolutely. Go ahead. And Ora says, "I'm going to try and keep this article light. I don't intend for it to be a full-blown guide on how to address these controls, and I don't mean to either for the React content of this video. I suppose there are more in other
0:53videos that should get into the gist of things, but just to make you aware of them. and what's their state in SMBs in 2025. As an active incident responder, I deal with ransomware every week. I've been doing this for the last few years now, mostly in the SMB or small medium business realm. And I can tell you this,
1:10AI based threats, whatever that means, is far from being the biggest worry when it comes to ransomware. Which means even any AI based security solution won't help you when it comes to ransomware when a threat actor gets in via valid credentials and can just net exec or CME for the OGs. Crackmap exec. Shout out to the homies. When a threat actor can just
1:32netexec or crackmap exec his way through a domain controller before deploying the ransomware payload using psex.exe and targets.ext. Oh, the top missing and or incomplete controls that could help prevent these attacks or even attackers hard enough to give defenders enough time to detect them. Assuming you're not missing number five in this
1:52list, have in my opinion nothing to do with AI and or whatever sort of security solutions some overhyped vendor tries to tell you. Honestly, it comes down to basic IT hygiene and best practices. And we're not even talking about stuff like Microsoft Security Baseline or Active Directory best practices. Simply stuff that anyone can do without much
2:14overhead. Yes, even you MSPs or managed service providers. I always feel bad, you know, like as a person in the industry, as a professional, whatever air quotes, is that I feel like when I have to kind of be saying the same things over and over again of the like boring basic boilerplate baby beginning things of security, of the stuff you
2:35hear all the time. Oh, don't click on links and emails. Don't plug in USB drives. Have multiffactor authentication. Use a passive manager. Blah blah blah. That's it, though. That that is the the foundation. Oh, hang on just a quick second before we go any further. Please let me take just a couple moments to tell you about the
2:50sponsor of today's video. Security reviews, compliance audits, vendor questionnaires, risk assessments. Look, if you lead governance, risk and compliance or GRC, you know the reality. It's not just a job. It's pressure without pause. Donna exists to change that. Donna is the AI native trust
3:12management platform built for modern GRC teams. So you don't just keep up, you lead. No more chasing evidence, drowning in spreadsheets, or repeating yourself in every security questionnaire. With Drada, you automate the heavy lift. Security questionnaires covered. Continuous evidence collection done.
3:33Internal and vendor risk management built in. And with AI questionnaire assistance, DRDA goes beyond automation. It learns from your controls, evidence, and past responses. So you complete security reviews faster with more confidence. No more scavenger hunts for audit evidence. No more rinse and repeat for every vendor. Just a single real
3:56time source of truth. And yes, this is Safe Base, a real-time trust center that builds trust and accelerates sales. It's not separate. It's by Drada. One platform, one team. Risk, compliance, and trust, all working as one. Whether you're scaling fast or operating globally, DRDA adapts to your workflows
4:17so you reduce risk, prove posture, and accelerate revenue. GRC doesn't have to be a reactive scramble. With Drada, it's strategic, proactive, and empowered. Learn more about the unified platform transforming GRC. Visit jh.live/drada. Thanks to Donna for supporting this
4:37video. That is the basic IT hygiene. But let's dive into the top five of these controls. Number one, no MFA or multiffactor authentication on external remote services. The initial access vector that I probably see the most may it be VPN, virtual private network, RDP, remote desktop protocol, RD web, or even
4:58Microsoft 365 or entra ID. When it comes to bacon, egg and cheese, sorry, not bacon, egg, and cheese. Uh business email compromise, but the acronym works really well. BEC. It's hard to imagine that MFA or multiffactor authentication isn't still implemented everywhere in 2025. Yet, here we are. You know what sentence I hear the most? When I get
5:17called in on an IR, incident response for ransomware or bacon, egg, and cheese. Sorry, I got to stop doing that. I did learn that, by the way, from Jamie Williams. Big shout out. You know what sentence I hear the most when I get called in on incident response and the thread actor got in via simple username and password authentication. Oh, we were
5:35just about to roll out MFA next week. For the organizations that did roll out MFA, I hear, "But how could this happen? We deployed MFA." More on that second one in another blog post. Hint, AITM. Now, to fill in the gaps without waiting for the next blog post or folks that might not be familiar with that acronym,
5:52AITM. Normally, that's adversary in the middle or attacker in the middle, however you kind of want to deacronize it. That's meaning a session hijacking attack or technique. Usually using tools that we've showcased in other videos like Evil Jinx or anything that can do sort of the reverse proxy capability so that they will fish you and gain your
6:12valid legitimate credentials while presenting and looking like the real actual legitimate and genuinely being the real actual legitimate Microsoft login page or any other service. So even when you do provide and enter your multiffactor authentication code, that still gets forwarded along to the adversary and they are in the middle of your communications. Still a foot in the
6:33door. But I hear all these statements in 2025. Every single week or month I hear that sentence. Every single day without MFA enabled on an actual or external remote service is another day you may or may not be granted to pursue your business operations in peace. At some point an attacker is going to get in. They're
6:54going to get in that way. It's just a matter of time. It's not luck. It's just that your number hasn't been drawn yet. Depending on your setup, MFA or multiffactor authentication isn't that expensive to deploy. Even if you have to pay for physical tootp or timebased onetime pad onetime pin that acronym always gets me for some users at the
7:14very least it's less expensive than dealing with a successful ransomware attack. Yeah, cuz that could be however many millions of dollars in Bitcoin or Monero. The cost of which depends on whether or not you told your cyber insurance provider that you even had MFA deployed on your VPN when in fact you probably didn't. Yeah, MFA is a big one
7:31and that is something that I feel like even just for any online service or online account we forget about. Like I know that I forget and sometimes that just falls through the cracks and it gets neglected. I think I would pair this really well with using a password manager because at that point you have an archive while you're using a password
7:48manager on every single online service or account that you use. So literally go through that list that it has made for you for things that you know you interact with because you have to you've had the password authentication there and just double check, triple check, go make sure that's all set up and staged with multiffactor authentication. So
8:04even if it's not strictly oh VPNs or RDP or some of those other online accounts, whatever website you go to, take a look. Set up multiffactor authentication absolutely everywhere possible. Number two, exposed and/or unpatched edge devices. Probably the second initial access vector that I see the most. Hello, CVE202455591.
8:26An authentication bypass using an alternate path or channel vulnerability affecting 40 iOS uh 40 OS version 7.0.0 through the Okay, so forinet okay the CVE is in SIS known exploited vulnerabilities catalog. Is that still happening? 2024 still bleeding on to
8:46today probably. Anyway, second initial access vector I see the most after the lack of multiffactor authentication. If there's one category of devices or appliances that should be patched as soon as updates and patches come out, it is the edge. If folks aren't familiar with the edge, the network perimeter, right? You consider it, okay, the outer fence, the boundary of what your network
9:07is. So, your firewall, your VPN utility in some cases, right? The edge of your network being literally the surrounding fence and perimeter. It is guaranteed that edge devices will be targeted the moment a vulnerability and/or puck or proof of concept hits the streets. Simply removing the exposition of the management interface, why is it exposed
9:28in the first place? Could help reduce the attack surface should new CVE or different vulnerabilities attack it and not another service that's available like SSLVPN. Oh, SSLVPN has to be a little call out. We were working with security aura just like personally during a lot of the recent Sonic wall shenanigans and this blog post or writeup came just following that.
9:48Carrying on in the SMB world, small mid-market businesses, smallmedium businesses, however you want to interpret the acronym, the management or read including the patching of these devices often falls on the MSP or the managed service provider like okay, the upstream business or company that will provide it and information technology or security services to another business
10:09and or the IT partner that installed that device. However, unless the client decides to pay an extra in his monthly or yearly contract, usually patching will be done on a best effort level, if done at all. Now, I don't know. I am not an MSP, right? We've worked with them, of course. But for MSP friends listening in, is that an upsell in your deals and
10:29how you bundle? or for clients and customers of a managed service provider. Are you living in that experience where you do need to pay extra for that extra support of patching the latest security updates? That is if patches are even available and if the client or that downstream company isn't running some endof life edge device. Yeah. And I mean
10:50obviously this goes well beyond oh just edge devices. This goes for any sort of forward-f facing application, like not strictly a firewall or a VPN application, but like something in your DMZ, something that could still be offering external services via HTTP, email, maybe FTP. The biggest one, of course, that we've seen has been managed file transfer or MFT. We could go on and
11:12on and on about the move it exploitation or go FTP. What was the name of the others? Crush FTP. I think that's the one I'm thinking of. But obviously that included with edge devices or the things that are front-facing and public open to the internet. Well, that's dangling out there and anyone could just spray and prey, right? So when the new
11:30vulnerability or CVE or exploit or pock hits the streets, damage is going to be done. Number three, no basic network segmentation. And by basic, I mean really basic. Most organizations do have multiple VLANs or subnets, but they're flat. Workstations can talk to servers on every port and so can servers. It's
11:51OCP proving grounds. All right. Rachel from accounting can VPN in the network while working from home and the userVPN subnet she lands in allows her to RDP to the domain controller directly. Okay, I'm sorry. I'm I'm laughing. I'm making light of it. But obviously that is real. Obviously a thousand% anyone could probably kind of have that availability
12:11and access. So, what do you think happens when a threat actor manages to get in through the VPN using only a username or password because of number one, multiffactor authentication missing? They can attack the servers right away. Granted, they weren't lucky enough to log in to the VPN with Active Directory account credentials that already has some access to the servers.
12:31We're not even talking about DMZs here, but simple networking. Have your workstations in one subnet. Have your servers in another subnet. Your workstation should only be able to access specific services on the server subnet like port 80 or 443 for the web server, port 1433 for the SQL server, etc. Your userVPN subnet should be similar to your workstation subnet, if
12:52not even more restricted, but in all reality, that should be separate from the workstation and server subnet. VPN gets its own little playground. Your servers shouldn't have unconstrained access to the internet. Hi to the person that made a tweet once where every time he sees a web browser installed in a DC he cringes. That basic network segmentation can go a long way. The less
13:13services and systems that you expose, the smaller your attack surface is and the bigger the chances you have of weeding out threat actors in your network that start lighting up your consoles like a Christmas tree. Assuming you have someone looking at that Christmas tree. More on that in number five. I like the little like teasers and preview for upcoming stuff. It feels
13:33like an online news article where they're like, "Wo, the top 12 tricks to secure your persona on the internet. Hackers hate him for these. You won't believe number nine, improper configuration of service accounts." Number four here, I use air quotes when talking about service accounts because at the end of the day, we all know what
13:53they are. They're not managed service accounts, MSAs, not GMCA, not SMSA. They're simple Active Directory users or local users with the SVC string in their name. That's another OCP gimmick. From there, their credentials were plugged into whatever system or service they
14:14need to power and we call it a day. These accounts often have high privileges. Why is SVCSQL a domain admin? And they aren't restricted or limited in what they can do on the network. Why can SVC exchange RDP to the DC? Why couldn't it RDP at all? So, of course, these accounts are highly interesting for thread actors because
14:35they know that if they compromise only one, it's practically already game over at that point. Somehow, that account can be leveraged to compromise an actual DA or domain administrator account when it can't just straight up RDP to a DC and then the kingdom will have fallen. In an ideal world, you should be using your flavor of MSAs and not actual simple
14:57users. However, if you are, do take the proper steps to secure them. Make it so they can only log into specific systems and they can't RDP at all. They have long complex passwords, etc. And if someone ever tries to use them in an interactive fashion like RDP, remote desktop protocol, alert on it. But that may be too much to ask. SMBs really
15:19don't have a SEAM or SIM or however you want to pronounce it security information event management platform and solution after all. H I know some folks that offer a SEM solution, but that is a subject for another blog post. Okay, we're at the end here. Number five, the light at the end of the tunnel. No AV antivirus, nextG AV, nextG
15:40antivirus, EDR, endpoint detection response platform, or even someone to look at the alerts. All right. So, look, let me back it up. This is the place where, hey, if someone were to be doing something bad, a user may be compromised, maybe taken advantage of via MFA missing or any exposed unprotected and unpatched edge device or any of the others. If some bad actor
16:02were to try to use a user and then do something nefarious and operate like in an interactive fashion with RDP, you fire an alert. There should be a signal that is raised so that analysts or security operations center individuals could be taking a look through this triaging, digging into the investigation, maybe going all in on an incident response. But that means you
16:23need to have people that are looking at that, someone to look at these alerts. I have never seen a single incident in my professional life so far where no alerts were generated during an incident. That's a good thing. That that's a that's a good thing. That means whatever an incident may be big, bad, small, otherwise it's going to have some signal
16:42or telemetry to it, right? But we just need to make sure we see it, capture that, acknowledge it, and work with it. But that's all assuming an antivirus, nextG antivirus or EDR solution was deployed. Even on Windows versions where Windows Defender is built in now, it'll have always raised alerts. Granted, if the organization is running Defender
17:02standalone, like no SECM, no intune, no MDP1, etc. Obviously, a lot of those are management solutions uh in businesses and computer endpoint devices often times in the cloud kind of thing. So, if you're running just local only installed everywhere Windows Defender stand alone, well, unless the user actually notices the Defender popup when there's a detection, but there will always be a
17:25detection. And keep in mind that even when a threat actor disables or uninstalls the third-party endpoint security solution on a system, Defender will be turned right back on. I think we could split hairs and you could kind of get into the weeds and maybe there's some nuance in there. Obviously, you could do some stuff that we've showcased
17:40in other videos to kill or nerf Defender in the most way possible. But say you were using other antivirus ABCYZ. If they had whatever neat tricks to turn that off, Defender will see, oh, there's no security solution in there and it'll step in to take its place. Bad actor would then need to do more post exploitation or other operations,
17:59hands-on keyboard activity to now fight and disable defender, which again will raise telemetry, alerts, logs, artifacts, things that will help the case. There are very good chances that defender will start triggering on what the thread actor is doing. I think for a long while, like we were pretty easy and quick to oh poop on defender. Everyone was like, Defender's trash. It's free.
18:19It's built in. How how could it be good? You get what you pay for. But the thing is, it's freaking good now. Like, it's the best because there's so much inside info, telemetry on every single Windows computer. It's there everywhere. It's Microsoft. Like, they're going to be pretty quick to get out all those alerts, signatures, behavior detection
18:37stuff out the door. I for one think Defender is good, fine, perfect. It's what we should be using as an AV, as an antivirus. EDR solutions, obviously, endpoint detection response. You got to have another layer on top of that. That's the defense in-depth stuff that we again scream and shout about from the rooftops uh while I'm trying to talk
18:54about the same boilerplate baby basic IT hygiene stuff. Anyway, most SMBs don't have an EDR and still run whatever AV NGAV that their MSP or IT provider offers them. Hello, Webroot, Bit Defender, ESET, and all that. Salute. However, it seems like when these products are sold to the client, they're
19:15sold to check a bullet point or a box. They're checking a box in a list and that's it. There is no monitoring and or review of the alerts is being done and if there is, they are mishandled anyway. Read the person looking at the alert doesn't understand what they're looking at. Education, awareness, knowing what things are in cyber security. It's my
19:33job. Just having a decent security company do triage on your endpoint protection solution alerts can go a long way. At the very least, they'll know that it's odd for SMB Reception One to execute Mimiats.ex. exe out of C users public music too real. Well, I hope so. In conclusion, so if you are an SMB or
19:55small mid-market business, smallmedium business reading this, or even an MSP, managed service provider, or IT information technology provider, the best thing you can do right now to help your clients against ransomware attacks or even make it harder for threat actors to execute their goals once they're inside is to work on just these five points above. Obviously, there's a ton
20:15of other stuff we could throw in here. We can throw the kitchen sink of oh the application and asset inventory list. Oh, everything we should have a approve, deny, allow list sort of thing. Yes, sure. We'll get to that. But please, if you're starting taking it seriously now, going allin to get security right, don't boil the ocean. You're just going to
20:34overwhelm yourself, your team, the people that you work with, and it's just not going to happen. That's going to fall to the wayside again because you're busy. You're doing what you do. You got to keep driving on with what you're doing. security. That's just how it falls through the cracks. So, start small. Even if we go, oh, a top five
20:48list here. I think it's good. Depending on the environment, some of these five controls, if not all, might be easy to implement, while others may be a little bit harder. At the very least, when it comes to number three, you should deploy a network environment with basic security first mindset from the get-go, and it makes things way easier down the
21:07road. You're free to do whatever you want with that information in my opinion. At the end of the day, I know I'll continue to deal with incidents where at least one, if not multiple or all of these controls are absent and allowed an attack to go through. So, I may as well put it out there for anyone
21:22who wants to know what it's like to deal with ransomware and small, mid-market, or medium businesses in 2025 so you can see for yourself. There's really nothing extraordinary about it. It's not some AI Kool-Aid. It's not some elite hacks zeroday kernel exploit VM sandbox escape or whatever. Sure, that could happen. But more often than not, it's the easy
21:43stupid stuff. So, don't let yourself get hacked over something stupid. All right, that was Security Aura's blog and writeup. I thought it was good. I thought it was cool. I thought it was worthwhile to share with you. I hope you thought that was valuable in whatever way maybe share with some of your team, your folks. I don't know. Let me know if
22:00you enjoy this style of video because normally just reading through something that's out on the internet is not normally what I like to do. I like to have a demo. I like to do some showand tell along with it, but it's pretty clear to me. I think that YouTube is leaning in the way of this sort of
22:14stuff. I see a lot of other creators that do basically this just reading and it's usually background noise. That's what people tell me. Oh, they'll have the video on going on in the background while they're doing whatever. So, I wanted to uh try it. Maybe we'll experiment with a couple more reading reaction videos. But big thanks seriously to Security Aura for putting
22:31this out on the internet and giving me permission for me to showcase it in a video. And thank you for tuning in and watching this video. Hope you enjoyed. Please do all those YouTube algorithm things.