Security Confidential S13 E8 James Potter

Manoj Tandon (00:01.122)
Hello everyone, this is your host Manoj Tandon. Welcome to another episode of Dark Rhino Security, Security Confidential. Today we have another awesome guest joining us. We’re honored to have James Potter join us. James has been in the business for over 25 years. He’s an active directory veteran with that much experience and computer experience for much longer than that. We’ll let him tell us about that here in a second. You know, he has worked at prestigious firms like Ernest & Young and Pric and then went on to form his own company, DSE, in 2019. And he’s a car aficionado, resides in the Pacific Northwest, and is a complete expert on all things AD, and we’re eager to get his advice. So James, thank you so much for joining us on the show today.

James Potter (00:54.751)
Yeah, not a problem. I was looking forward to interviewing myself, but I think you did a pretty good job of it.

Manoj Tandon (00:59.766)
Well, you wanna add something if we screwed it up.

James Potter (01:03.243)
No, you got it man, it’s spot on.

Manoj Tandon (01:08.063)
So, you know, give us a little bit about your background. You know, the intro will only give us a little bit. How, like, you’ve been in this business forever. You predate Active Directory. So tell us about how life got started in computer land, if you will.

James Potter (01:22.471)
Yeah, sure. So, well, I grew up in Detroit, you know, fairly, you know, fairly poor. I mean, I wasn’t sleeping on the streets by any means, but definitely hopped around some different flats and apartments with my mom growing up. But I always thought computers were really interesting, right? I mean, there was an Atari in my life at one point. And that was just like this thing is the coolest thing ever. I can’t imagine anything even cooler than an Atari. And a little bit later on,

My family actually got an Amiga 2000, which was just, it blew all of my friends’ computers out of the water, right? Like compared to their Atari’s or NES’s, it was just state of the art. And it was just so fascinating. And I wanted to learn everything there was to learn about this thing. It was just this amazing tool, not just for gaming, but for anything else you could wanna do. Like you could spreadsheet on that, it had a full GUI. It was really, really fascinating.

Manoj Tandon (01:54.286)
Remember those.

Manoj Tandon (02:17.55)
That would have placed, that was like the early 80s, right? Or mid 80s.

James Potter (02:22.447)
The Amiga came out like mid, mid late 80s. They had a few different variants running around out there. The 2000 was late 80s if memory serves. That was a, it was a great, great system. Even had a hard drive, not a tape drive. It had a, gosh, how big was this hard drive? It was in megabytes, it was so small. But it, yeah, it was, it was, it was a, it was a big deal. My, my stepfather had purchased it to,

Manoj Tandon (02:26.519)
Yeah.

Manoj Tandon (02:32.258)
That’s awesome.

Manoj Tandon (02:42.122)
Yeah, but back then that would have been considered big, right? I mean, five meg.

James Potter (02:50.715)
because all of his brothers had computers and he picked it up and I don’t think he really knew what to do with it. So it just kind of sat there and then I got to play with it.

Manoj Tandon (02:59.81)
That’s fantastic. So did you go into from there, go into mainframe systems or?

James Potter (03:02.72)
Yes.

James Potter (03:07.859)
No, so for me, kind of, you know, cutting my teeth on all this tech in the 80s and early 90s, I was still going to public school, but I ended up dropping out fairly early. I think I made it to like 10th grade. The public school system just really wasn’t for me. I was learning better on my own than I was through the school system. So at that point, I started looking at certifications and what can I do in this industry to get exposed and, you know, get

get that first foot in the door, which is tough. Like late 90s was not the best time to get into tech, like 99, 2000. And then we had that huge bust in 2000 and 2001. And yeah, that was a rough period of time. But what I had done is after I dropped out of high school, I started working at U of M, their computer lab, replacing floppy drives and 50 pound CRT monitors.

Manoj Tandon (03:50.058)
yeah.com bust. Yep.

James Potter (04:05.219)
helping students with Word and how to transfer data from floppy drives to zip drives and stuff like that. But it was a foot in the door for the hardware side, the help desk. And I personally think that’s something I love to see on a resume. Because when I see someone that has at least a couple of years of help desk, I know they’ve been through it. Because that’s when you learn empathy and you learn humanity working help desk. And I think that’s a really underrated skill set in this industry.

Manoj Tandon (04:31.374)
Or you come out a very mad person. You know?

James Potter (04:38.342)
Yeah, you figure it out after a year or two of help desk if it’s something you want to do the rest of your life.

Manoj Tandon (04:42.602)
That’s right. Because you’re right, either you’re going to learn empathy or you’re and patience or you’re going to turn out to be very, very upset.

James Potter (04:55.355)
Well, when I was at U of M, they were still using that where, right? Cause this is like a free windows 2000 kind of stuff. And, uh, my, uh, my first exposure to, uh, active directory would have been right when it came out in, in 2000, cause I, we done the, like the NT four O and the network systems and had that visibility. And it was, it was clumsy. It was like the best thing that was out at the time, but it was just very hard to maintain at scale and AD came out. It’s like.

Manoj Tandon (05:01.244)
Oh wow.

James Potter (05:23.607)
Holy smokes, we can replicate all of our users. We don’t have a limit of like, you know, 500 users per domain controller. This is amazing. We could have a hundred thousand users. This is gonna scale infinitely. And I saw that as like, man, all the large companies, they have to do this. There’s no way not to do this. There’s no competitor.

Manoj Tandon (05:42.338)
So was back then, I’m trying to remember, NT4.0 didn’t have AD. Was it like JetBlue or Blue? I forget the name of the… There was an old data… Yeah.

James Potter (05:50.919)
Ah, Jet. So yeah, so actually modern Active Directory is still based on a Jet database methodology that was developed in the early 90s, around 90, 92 or so. So at its core, like Active Directory is just a replicated database based on a Jet of all things, which is almost 30 years old, over 30 years old now. Wow. So it was the first big replicatable database that was deployed at scale for enterprises.

Manoj Tandon (05:57.696)
Really?

James Potter (06:19.903)
And it was, it was a big deal. It really was. Cause before you had to have these NT four O DCs with a primary DC and a backup DC. And if you had over a certain number of users, you had to create more of these and more of these and more of these. And if user moved from side a to site B, their user account didn’t exist there. So there’s all sorts of add-on technology that you had to duct tape and stick on top of it, and it was just very, very clumsy, but you know, the first windows 2000 act to directory service.

of changed everything. It was a big deal and it’s still leveraged by the vast majority of Fortune 500s around the world today.

Manoj Tandon (06:54.978)
Has its organization or security changed since Windows 2000?

James Potter (07:01.087)
Oh, oh my gosh. Yes, so much. There’s been so many changes in the past 20 years. So we’ll go to the very, very first one. So now back in the early 2000s, Microsoft would recommend an empty administrative domain and then a child domain, right? So you put all of your production stuff in the child and all of your high security stuff in the parent. And they had to stop telling everyone to do that because it’s not a security boundary, right?

the parent-child relationship is not inherently secure. Forrest are security boundaries, but child and parent domain trust are not security boundaries. What you see in a lot of these older companies that adopted AD right back in the 2000 days is they all have this empty route for basically no reason because Microsoft told everybody to do it. There’s lots of examples of that over the course of time. Security has gotten just so much better of Active Directory.

But the downside is Microsoft doesn’t force those changes because they don’t want to break somebody’s production. So Microsoft comes out with all these new security methodologies and baselines and they’re there in the operating system. You can flip them on, but more often they’re not, they’re not flipped on by default. Again, because backwards compatibility and that’s the big thing with Microsoft. Like if you could do it in Windows 2000, you can almost still do all of that now in the latest versions of the operating systems.

all the GUIs, command lines, everything’s there.

Manoj Tandon (08:27.519)
You know you.

Manoj Tandon (08:31.25)
You bring up a very interesting point here, is that there’s a notion that, especially with the cloud, that Microsoft’s taking care of my security, and I don’t have, there’s this, especially in the…

executive circles, there’s this notion that if we go to the cloud, Microsoft’s taking care of it. So if you go to AD in the cloud, that’s apparently there. But as you’re rightfully describing, it doesn’t matter if it’s cloud or on-prem, I’m guessing. You’re gonna have to do configuration changes. That’s still left.

James Potter (09:10.113)
Yeah.

Yeah, you still need the three tiers of security for at least larger organizations. And this is what DSC prime really works with is your Fortune 500s. So in our opinion, you need really three things to have a good security foundation. These are abstract concepts, but ones that I think are very applicable. One, you need a security architect for that specific tech, whether it’s a network security architect, an identity security architect, a desktop security architect.

Manoj Tandon (09:29.294)
Okay.

James Potter (09:41.591)
It doesn’t matter. Depending on your scale, you have a security architect for that specific technology. Let’s talk about Active Directory here. So you need a good Active Directory security architect. You’re going to have to spend money on this person. They aren’t going to be cheap, but they need to be passionate, right? They need to care about what’s going on at the business and kind of have a dog in the race, right? There should be some sort of like performance or compensation plan. Like, Hey, if we don’t get hacked, you get this over this time period, some sort of golden handcuffs, right?

Manoj Tandon (09:49.742)
Okay.

Manoj Tandon (09:59.47)
Okay.

James Potter (10:11.555)
to keep that motivation there. And two, you need at least a couple very good engineers to implement that architect’s vision, right? They push out the security changes, they push out the policies, they make the architect’s vision into reality and the enterprise. And then below them, a bunch of sysadmins that are able to turn wrenches, press buttons and get the job done. You don’t have to spend a ton of money on the admins, but definitely spend on the engineers and the architect. And then third,

Manoj Tandon (10:13.902)
Okay.

James Potter (10:41.507)
You need auditors to come in and make sure those security controls are implemented, whether they’re internal or external, it’s kind of depends on your org and what you do. But if you have those three things, you have security controls that are updated and pushed out in policy, you have them actually implemented in the organization. And then you have auditors checking to make sure those policies are there and they’re functioning as expected. And that could be through auditing, red teaming, kind of very org dependent.

Manoj Tandon (11:08.738)
So James, you’ve worked with lots of companies. How many actually have all three of these basic things in place?

James Potter (11:16.267)
Very, very few. Typically you get two out of three, right? You’ll get, you know, hey, we have great security architects with great engineers, but there’s holes because no one’s auditing it, right? And the thing about, you know, users and admins is they find the path of least resistance. And the path of least resistance is not always the most secure path. So having the organization externally audited,

Or at least having some internal auditors or internal red teams kind of poke around and see if there’s holes is really important because that’s what the threat actors are going to do, right? The bad guys are going to be running discovery tools to discover where your weaknesses are. And if you’re 98% secured, they’re going to find that 2%.

Manoj Tandon (11:58.282)
Yeah, well, that’s how they make money. So, right. So they’re absolutely hell bent on doing that. And what

James Potter (12:02.017)
Yeah, absolutely it is.

Manoj Tandon (12:09.33)
Like you’re working at DSC, you guys are working with Fortune 500s, but what’s an SMB to do? Because most of the time they got like two guys or maybe a guy or a part-time person that’s, you know, does their networking. In fact, they’re the jack of all trades, right? And cybersecurity means I’ve put like a phishing protection and then point tool or something like that on. And that’s it for cyber, man.

James Potter (12:24.32)
It’s tough, it’s…

James Potter (12:33.783)
It’s really, really tough for SMBs because they don’t have a ton of extra money. They don’t have a ton of extra resources for headcount. So the people that you have, as we talked about, are typically generalists. And generalists can go off of security baseline. So NIST inspires CIS to release their compliance standards, right? All of the CIS stuff is largely based on NIST.

But this is compliance and not security. And there is a difference there. So compliance will help secure your org 100%, but mostly it’s there to help you pass compliance tests. And the data tends to be rather old. It takes a long time for security control to get added to NIST and then added to CIS, and then trickle down into something that these admins can click a button and push out. So it’s really tough there, but it’s a good starting point, right? Getting everything like…

CIS level two compliant, you know, if you’re smaller or that’s something you can look to that’s gonna help out a lot. That’s fairly well documented that any jack of all trades could just pick up and go push out.

Manoj Tandon (13:39.114)
Now, do you think the situation would improve if the decision makers or the powers that be somehow better understood the risk or it was articulated to them in a much better way? Feeling a lot of people just don’t know that how big a.

James Potter (13:55.747)
Well, this is this is how I’m sorry. I got us. I got a spider on my camera here. Get out of here. Sorry about that. Sorry, I didn’t hear that question. I apologize.

Manoj Tandon (14:01.198)
It’s okay.

Manoj Tandon (14:04.778)
I was gonna say, do you think the situation would improve in especially in SMB if people understood the risk or knew how to articulate the risk better? Or it just seems like cybersecurity risk is even today, especially in SMB is not grasped really well. You know, they don’t understand what.

James Potter (14:29.215)
It’s tough because a lot of SMBs assume they’re not targets. Like, hey, we’re only making 50 or 80 mill a year. Like, why would anyone care about us? Or we’re only making 20 mill a year. We’re small, like we’re a rounding error. But when you’re small, you’re an easier target because you don’t have that same kind of security presence that the larger organizations have. So you’re the house on the block that has their back door unlocked. And that’s the house that’s going to get broken into because it’s the easiest

to get into. And because of that, we’re seeing threat actors like LockVid and Alfie hit a lot of smaller companies. And for many of them, it can be a death knell, right? If suddenly you can’t do any accounts payable or accounts receivable because all of your accounting systems are ransomware and you don’t have a backup that’s not from three years ago, then you’re dead in the water. It’s literally put organizations out of business. Hospital went out of business because of this.

Yeah, they couldn’t do any accounts payable or accounts receivable and then poof, they don’t exist anymore.

Manoj Tandon (15:28.574)
Oh, you know, James, uh,

Manoj Tandon (15:34.663)
You know what the interesting stat on that is that most SMBs, six months post breach are typically out of business.

James Potter (15:42.679)
Yeah, it’s bad. It can be extremely, extremely debilitating. And that kind of risk is hard for humans to like intrinsically place a value on. We’re really bad at what if there’s a big natural disaster? What if there’s a flood or a hurricane or a war or, you know, some sort of global climate change? Like, what does that look like in dollars and cents? And we’re not very good at that. Right. We’re very historically bad at it. Even insurance companies are bad at it.

And this is something we’re kind of seeing this space because it’s hard for an SMB to justify spending on security because they can’t quantify the risk appropriately because even spending money on someone to come in and quantify the risk is like, that’s a lot of cash. Why would I spend like a half million dollars to like just know what my risk threshold is like, because that’s a big chunk of change to a smaller organization. So it’s really tough. So we see a lot of these SMBs turning to MSPs for their security, right?

Manoj Tandon (16:25.323)
That’s a lot of money.

Manoj Tandon (16:34.454)
Well…

James Potter (16:39.479)
So they’ll have one guy on staff that does tech, and then they’ll outsource everything out to an MSP. And okay, the MSP is taking care of all of it. I don’t need to worry about it, the MSP is doing it. But the MSPs themselves are also small businesses, right? They’re also SMBs. So they’re cutting corners as well. They’ll bring in one person or a small group of people, and they’re juggling five, 10, 20 different clients simultaneously.

So they’re trying to go as fast as possible to make as much money as possible. So when that MSP gets popped, then all of their clients also get popped downstream. It’s supply chain stuff like that is getting really nasty.

Manoj Tandon (17:15.894)
which is why a lot of MSPs can’t get cybersecurity insurance, but that’s a separate topic altogether. It’s expensive as heck for them. And for that exact reason, James, that you just pointed out. So what is it? What would you say is the biggest in your just in your opinion, the biggest risks that the organizations face, large and small? What?

James Potter (17:21.303)
It’s expensive, it’s expensive.

James Potter (17:29.791)
Yeah, there’s a lot of liability.

James Potter (17:44.163)
The biggest one is credential elevation, right? Because more often than not, a threat actor’s entry point into an enterprise is workstations, desktops, laptops, that kind of stuff. And the first machine they pop normally doesn’t have a ton of privileges on it, right? It has, you know, Bob or Judy’s account, they can email, they can, you know, message people. Maybe they have access to some web front end, but it’s not domain admin permissions.

And through really common misconfigurations, whether SMB or enterprise, there could be service accounts kicking off on that machine that have much higher permissions. Like a really popular thing for a long time was, I just make the SCCM and SCOM accounts domain admins and they can do everything. The problem is if you’re using the same SCCM and SCOM account on your workstations, your servers and your DCs, well, you copy any one of those machines and now you’re a domain admin.

James Potter (18:36.779)
More often than not, we see domain admins using the same desktop they use for productivity as for their domain administrative tasks. And if one of their machines gets compromised, that’s, that’s game over for the org, right? Uh, threat actors are going to get in. They’re going to establish persistence. You’re not going to find them for average of five to six months. That’s how long it takes. Uh, average company to discover a threat actor in their environment. And, uh, you’re going to have a bad time because they’re, they’re getting more patient. Um,

Manoj Tandon (18:44.194)
Absolutely.

James Potter (19:04.675)
Threat actors more often not aren’t doing what they did at MGM or as a fast kind of smash and grab they’re planning and they’re, they’re even infiltrating backups. So if you have a backup, great, that’s not a hundred percent proof for ransomware because the threat actors know you have good backups. They’re going to linger as long as they can corrupt your backups. So even if you restore from backup, your stuff is still ransomed. So it’s not, not a sure fire defense.

Manoj Tandon (19:30.946)
Wow, that’s what you just described is ubiquitous. I hate to say it in the industry though. Right? It’s every.

James Potter (19:40.811)
Yeah, it’s everywhere. There’s very few orgs that have gone and actually separated their domain admins with separate workstations or paw or saw or something like that. And the thing we’re telling orgs is like, look, you don’t, you don’t need a paw or a saw for everyone in the org. You just need it for your tier zero, your domain admins, your enterprise admins. And increasingly your network admins, right? Cause threat actors are going after network devices. So getting those users also on a paw or saw is really going to help fortify your environment with.

about a ton of extra costs. Like even if you don’t do like a bastion forest or something like that, you do inner forest tiering by isolating those domain admins and other tier zero admins off to the side with their own workstations and laptops to perform their tier zero activities and then prevent those tier zero IDs from logging into regular desktops and regular servers. You’ve already gained a lot of security with no subscription, no software. It’s just technical controls you’ve implemented.

to help secure your org. And that’s something SMBs can do, but there’s not a clear instruction guide on how to do that from Microsoft, right? This is something you kind of have to get in and figure out yourself. There’s not like a step-by-step article out there for this.

Manoj Tandon (20:54.519)
For some of the folks who may be listening who are not super technical, why do we still have an AD? Let me back up to that. What’s the reason for it?

James Potter (21:04.811)
Well, there’s really no replacement for it if you’re a large organization. Now, there’s some orgs have homebrewed their own, right? Like Google and Apple, obviously they’re not big Microsoft shops, right? But for anyone that’s been around, it’s a requirement because you started using it in 2000, especially for these large orgs, and you’ve been using it ever since. And once you start and you have everything running off AD, your auth is going through it, all your applications are going through it.

It’s hard to uproot that and just put it somewhere else. Uh, Lululemon tried this and they’re a relatively, uh, newer company. They tried to move a hundred percent cloud native. They got like 90, 95% of the way. And then five to 10% of their infrastructure has to stay in the data center because there was app, uh, compatibility that they needed for their business. That they just couldn’t get a hundred percent away from. And that’s the kind of thing that still.

So it gets people. It’s very hard to be 100% cloud native unless you started 100% cloud native. So we’re seeing more newer SMBs just do 100% cloud, whether it’s Google or Microsoft or Amazon, whatever your favorite flavor is.

Manoj Tandon (22:12.782)
But does that still solve your AD problems?

James Potter (22:17.271)
Uh, yes, yes and no. So for a lot of these, these cloud providers, they have, they’re variant of identity, right? So Microsoft has a Entra and that’s, you can kind of look at that as Active Directory for Azure, but it’s really not a full Active Directory suite. It’ll handle creation or removal of identities, but anything you were doing on-prem with application tie-ins or off, anything that’s AD compatible, it’s not really gonna work with Entra.

Manoj Tandon (22:29.026)
Yep.

James Potter (22:46.211)
So they’re two different technology stacks. And there’s similar variants to Entra on Google and AWS. It’s not really the same. You can throw an Active Directory server out in the cloud and still have Active Directory, but there’s not really any native cloud replacement for AD.

Manoj Tandon (23:05.766)
What about, I’ll ask the dumb question here, like these identity providers, like Universal Directory from Okta, does that play a role in? Yeah, please comment.

James Potter (23:14.491)
Uh, well, uh, beyond the black eyes that Okta already has right now from a security standpoint, the problem, the problem with, with creating a secondary store of identities from a security standpoint is, is now you have an additional door on your house that someone can break in. You have active directory and that’s your only identity store. You only have one door. So you can fortify the crap out of that door. You can deadlocks on it, put a camera.

Manoj Tandon (23:23.399)
Right.

James Potter (23:43.227)
You know, peephole, deadbolt, steel door, whatever. And then you bolt Okta on the side and it’s your back door made out of balsa wood with no lock on it. Not great. And even if it does get better with time, it’s not gonna be as solid as the existing solutions from a security standpoint. Just because we’re all development and experience. Look how much development time, hours, and money Microsoft has been putting in the Active Directory over the years. Now how much has Okta, a company of

not even a fraction of the size of Microsoft put into their security stack. It’s not going to be as strong of a door.

Manoj Tandon (24:20.338)
Right? But the Microsoft door, you have to configure properly as you’ve mentioned. Right? Right. Otherwise…

James Potter (24:28.69)
Yes, you too have to configure it properly.

Manoj Tandon (24:35.239)
So give us some tips. You already told us about a few things, things that foundationally you would say, this is hygiene 101, AD101 that you should be doing. Whether you’re in the cloud or… Yeah.

James Potter (24:52.083)
Regular password audits, yeah. Audit your passwords, 100%. So there’s password lists that threat actors will use. One of the most common password attacks right now is called password spraying. Threat actors will take the most common passwords that exist and just hit every account in your org, once with it, try and get someone, try and get that password to work. And then they’ll wait a little bit, do another round and another round, and that’s not gonna set off.

as many alarms, right? Because all of our alarms are set to recognize, hey, someone’s trying thousands of passwords on account B, let’s lock it out. Okay, we got that. But password spraying kind of flies under the radar because they try these common passwords that meet current security compliance policies that are still very, very weak. And these are all well-known passwords that sit in dictionaries that anyone, one of these orgs can grab and do a cross-reference. And that’s what I would really encourage doing. Like,

Manoj Tandon (25:25.228)
Right.

James Potter (25:48.187)
cross-reference your existing passwords with one of these password spray or these Rockyou password tables that threat actors are using. And if you show users that are popping up with these well-known passwords, change them, right? And it’s tough for SMBs to kind of like devote time and resources to doing this. But even doing this once every six months is gonna have a lot of value for an org. And it’s also gonna tell you if you’re…

Your system admins are using the same password for their productivity account as they are for their administrative account, assuming they have two.

Manoj Tandon (26:20.936)
likely they are.

James Potter (26:23.679)
Yeah, I mean, path of least resistance. This is what humans do.

Manoj Tandon (26:26.214)
Yeah, it’s just a it’s human nature, right? I mean, it’s not that they’re doing the there’s no malicious intent on their part. It’s like it’s a path of least resistance, right? It’s one more password to remember. Right. So do password audits.

James Potter (26:36.74)
Yeah.

James Potter (26:41.283)
Yep. And it’s, it’s tough. Yeah, definitely password audits, you know, meet your compliance standards. CIS is a, for SMBs at least it’s, it’s a good way to get most of the way there. And then beyond that just intelligent network designs. You don’t open external management if you don’t absolutely need to. We’ve been seeing a lot of network devices being popped lately because they have, you know, external administrative access.

And there’s some sort of vulnerability of the software, whether it’s, you know, Cisco or some sort of firewall, Citrix. Um, if you don’t have to have that administrative portal open, don’t, don’t open it, use it internally. And that’s going to buy you a lot of security, right? Just right there. Cause you don’t have that admin portal facing externally. So if there is a vulnerability, you’re protected from it, cause you don’t have those ports open.

Manoj Tandon (27:36.15)
What about, we talked briefly about escalation of privileges, but it happens. I’ll give you a simple use case. A lot of times under security policies, admins will block users from installing software or updating software, okay, which is controversial too, because that’s a double-edged sword, but we’ll.

we’ll go away from that for just a second, right? Cause you end up with a whole bunch of unpacked systems with that, that’s besides the point. You know, sometimes you see that they will, they call their help desk and they yell at them. And then the help desk says, you know what? Fine, we’ll enable you to, there’s this program that you gotta have cause you know, you’re, you do a specific function and it’s unique and whatever the reason they, they let you install it.

but they never take away that privilege, right? So now that, yeah, so now that user is out there and they’ve got administrative privileges and then that gets used to bounce.

James Potter (28:36.123)
permission creep.

James Potter (28:47.771)
So there’s a few different ways to kind of tackle that specific issue. You can have your help desk staff install the application for them by some sort of remote management software, right? That’s an option. You can temporarily make that user and administrator with a timeout effectively. So there’s a lot of ways you can kind of dev this internally. You don’t need CyberArk or any other expensive software suite for that. You can write it in-house with PowerShell.

as long as the infrastructure has already been prepped. One thing we like to do is we like to manage our workstation administrative groups and our server administrative groups with a group policy preferences. This is all built into Windows and it has wild card environmental variables that you can leverage. And what I mean by wild cards is let’s look at our desktops. So you could have the group right in your policy, do desktop dash percent computer name percent dash.

Manoj Tandon (29:40.526)
Okay.

James Potter (29:46.827)
admins. So that one gets thrown into your local admins group on the desktop. And then you also put desktop, you know, dash, admins, global, global admins. So that one gets put in there as well. So now you have a global admin. So anyone that’s a member of this can manage all the desktops. And then you have a one-to-one. You actually have a specific active directory security group that sits out there for each one of your desktops.

Manoj Tandon (29:59.2)
Okay.

James Potter (30:12.319)
And now when Bob or Judy calls in and says, hey, I need to be an admin on my machine. I have to install this software. We’re going to miss this big, big timeline, whatever. You can pop their account into that group temporarily say, all right, Bob, now you’re an admin for the next four hours, install whatever you need to. And then you, you can have PowerShell just time it out and pull it out of the group or lots of different kinds of methodologies to do that. But that gives you the ability to actually push that out and manage it.

via PowerShell and Active Directory instead of on the local machine where things often get forgotten.

Manoj Tandon (30:46.391)
How do you do that when a lot of people don’t even know what all their compute assets are? I mean, that’s a foundational problem.

James Potter (30:53.495)
Oh gosh, yeah. Yeah, it’s worse for SMBs too, because they move fast, they grow fast and asset inventory isn’t always at the top of the list for things they should be doing. You’ll find machines that aren’t even domain joined, right? They’re just, hey, I spun up this machine so I can start doing this task and it’s not a part of the domain, it sits off to the side, but I need to do this thing on it. And IT department might not even know about it. That’s asset inventory is pretty.

pretty important and especially as you grow, you start doing a good job of it when you’re small, as you grow, that’s gonna really, really pay dividends. And as far as the discovery side there, network should be able to help you discover all those machines. Look at all the MAC addresses, you can cross reference those to the vendor that the MAC address belongs to, cross reference those to IPs, what location they sit in. And that’s a good start if you’re not gonna buy a solution that already does inventory.

Manoj Tandon (31:51.662)
So I’ll tell you, many years ago, we used to do tanium work. Okay. And of course, it’s technology for a megacorp, right? It’s not for an SMB play, but yeah. In the enterprise space, we would still find that what they thought they had versus what the technology found, the number was always 10 to 15% higher.

James Potter (31:59.181)
Ah, yeah.

James Potter (32:06.655)
It’s built for enterprise, yeah.

James Potter (32:21.183)
Yeah, it gets really murky, especially if you have like a creative department and they’re all running non-Windows machines, right? They’re running Apple machines or maybe your security team is running a bunch of Linux machines and now those aren’t always directly exposed to the domain. So from an AD standpoint, they don’t exist. They might still exist on the network side. Network will still know about them, but AD will not know they exist. That’s why I really like

Manoj Tandon (32:21.671)
Even in.

James Potter (32:49.355)
running inventory from a networking perspective and not so much from an agent perspective because network’s going to see everything. Active Directory or a specific agent is only going to see things that it’s been exposed to.

Manoj Tandon (33:04.703)
That’s very true. And you’re right, there’s a lot of mixed environments. Even in small businesses, there’s mixed environments. There’s people who are running Macs or there’s Linux boxes or what have you, or you got Android devices sitting out there, all kinds of stuff that’s on your network. Not that I have anything against Android, it’s just an example that came out.

James Potter (33:20.472)
Yeah, yeah.

Manoj Tandon (33:30.014)
It’s a real mixed bag and getting a handle on that inventory is a problem. To begin with, what do you do like?

James Potter (33:39.671)
Well, because if you don’t find it, the threat actors will. Use case here, the Ubisoft hack, right? Threat actors sat in their environment, looked at Jira documents, networking designs, all the documentation that company had. They ingested all of it and learned the network better than the people running the network, found the weaknesses and exploited them. But they were they were in there over six months.

just doing discovery and learning about this environment before they executed their payloads. And they made sure to do a good job so that they didn’t get caught because they were doing a lot of monitoring in the Ubisoft network. They’re looking for LLMNR and password hash manipulation, all the common stuff. And the threat actors found a vulnerability they weren’t looking for and exploited it via assets that weren’t known. So, inventorying is very important from a security standpoint.

Manoj Tandon (34:15.638)
You know, which again.

Manoj Tandon (34:39.794)
Now, why would they not have geofence their identities? That’s another question. So when you’re logging in, why is…

James Potter (34:47.091)
Well, geofencing is tough for global companies, right? Because you can’t just say, hey, don’t let anyone in from Europe if you have a presence in Europe. So you can get more granular, right, at a per country level. But even that’s kind of difficult to maintain and not 100% effective, right? Because you can easily have a machine that a threat actor is using from that region that’s been compromised.

Now it will show up as a new IP address. So if you get granular to the level of, hey, you can only do your administrative work from this specific IP address, that’s effective from a networking control for sure. But it’s also very expensive to maintain at scale. Cause you know, dev goes from their home to another location and, hey, I can’t do my work anymore. Hey, I can’t do this anymore. I can’t do that anymore.

And they have to call into the help desk and get a new IP added. And, you know, they’re never going to use that IP again, because it was their, their aunt’s house or something. Right. So it’s, it’s hard to maintain at scale. You can definitely do a lot of geofencing and depending on what your org does and where they do it, there’s definitely a lot of benefits there, but it’s, it’s not a silver bullet.

Manoj Tandon (35:59.982)
Thanks for saying that. You made the point that I was gonna go after. It’s not the silver bullet. It has value as long as you understand the context in which it is deployed and understand what the limitation behind it is. Because often it’s marked as, well, you know, well, if you have adaptive MFA, then you’re golden. You’re much better, but you’re not golden.

James Potter (36:28.151)
Yeah, much better. That’s what I would say. It is significantly improved, but not bulletproof. Ha ha ha.

Manoj Tandon (36:30.038)
Thank you.

Manoj Tandon (36:34.166)
but you’re not bulletproof. Well, nothing really is. I would venture to say, James, I mean, you’ve been in this business for a long time. Will we ever really get to a system that cannot be hacked unless it just doesn’t connect?

James Potter (36:47.495)
Even air gap systems have vulnerabilities. And these have been known for quite a while actually, since, you know, before me, right? So air gapping systems, you have to control any electronic emissions. Think about when you’re typing on a keyboard, each key makes a distinct sound for that location and that user in that room. And if you had a sound device hooked up to that room and you’re performing listening, you can…

with relatively good accuracy, determine which keystrokes are being entered. And beyond that, electronic emissions from the computer itself. I had a case in the probably early 2000s that was an old DoD case from like the 80s or 90s, I don’t remember exactly, but it had electronic EMF shielding all around the external of the case to control electronic emissions. So no one could, you know, point a device at the case and try and figure out

what you’re doing from a processing standpoint. So even air gap systems have their vulnerabilities. I’ll, I’ll be at real edge case stuff.

Manoj Tandon (37:49.258)
Yeah, and you know-

Manoj Tandon (37:53.266)
Well, I mean, I always bring it up on this show. That’s how we compromise the Iranian centrifuges, right? That was Operation Nitrozeus, right? That was the whole thing there. That was completely air gapped until, but again, it’s a great example of human greed. Yeah. They dropped USB devices. That’s what they, and they were hoping, they left freebie USB devices at local haunts.

James Potter (38:03.714)
That was air gapped. Yep.

James Potter (38:09.429)
It wasn’t.

Manoj Tandon (38:23.43)
and somebody.

James Potter (38:23.535)
Well, there’s some new data that’s coming out that actually pointed to a Dutch double agent for this. And the USB drops were just the story to give this person some cover. This has been published relatively recently, I think past couple of weeks, but basically they tracked it down to this individual who smuggled in a USB system using some of the water input for the environment. So they floated the USB in because they get searched when they’re at the door.

Manoj Tandon (38:34.4)
Oh really?

James Potter (38:52.771)
And then he picked it up internally, plugged it in, and his job is done. And then they did the cover story for dropping USB in public areas to kind of remove some of the heat from that individual. Fascinating, right?

Manoj Tandon (38:58.635)
Well.

Manoj Tandon (39:03.37)
Ah, that’s, well, that’s fascinating. Well, we’ve had, we’ve had a couple, just a couple of weeks ago, we had a human targetter on who worked for the Navy. And that was her job, was to target people and figure out how.

James Potter (39:10.315)
Yeah.

Manoj Tandon (39:25.954)
they can be compromised. We’ve had a real CIA agent on the show and he says compromising people is actually pretty straightforward if you know how to go about practicing your craft. So that-

James Potter (39:37.307)
What’s up?

It’s all about the data sets you have. This is something that the CCP has been doing to the US at scale, harvesting our financial data, harvesting our health data, debts, all these kinds of things. And they’re looking for people that already work within the government, that have a lot of debt, that maybe become disillusioned with the US for one reason or another. And they might be looking at an individual whose wife or husband has cancer and they’ve second mortgage on their house, they spend everything on this treatment.

And they’re just scraping by and this person is clearance. Well, that’s a, that’s a target, right? That’s someone who, who did everything right and they’re losing. And they, they might not be a very patriotic at that point in their lives. And they’re a target. And if you have a large enough data set, you can identify lots of targets fairly quickly.

Manoj Tandon (40:28.146)
Oh yeah, and then, you know, it gets back to human behavior again, right? So if you have deadbolts and everything on your door, that’s great. But what if I just unlock all that stuff?

James Potter (40:43.755)
Well, yeah, threat actors are starting to target users at home, right? Because we have a lot of people working remotely, right? More than we probably have at any other point in history. And the corporate network might be very well fortified. But this user is sitting on their home network. They have SMB exposed with their family, a bunch of people downloading things, going out the internet, and they’re on that same subnet. And the machine they’re using…

It might even be a personal machine, maybe just some Windows machine that doesn’t really have any rigorous security controls. But even if it’s a corporate asset with good security controls, if you compromise the network, before that machine connects to the VPN, it’s vulnerable. And we’re seeing more sophisticated threat actors that are doing specific targeting attacks, starting at the home and then infiltrating into the enterprise from there.

Manoj Tandon (41:32.542)
And you know what? This trend is here to stay. So we need to solve it. Another thing that we haven’t solved yet is this whole thing of mergers and acquisitions. When you look at companies that grow, you acquire a firm, you might have great security controls, but the guys you acquired sucked. And now they’re part of your domain.

James Potter (41:36.012)
Absolutely.

James Potter (41:40.627)
Ha ha!

James Potter (41:48.601)
Oof.

James Potter (41:57.783)
Yeah.

M&A and divestitures have been huge the past two years, just like they were after 08 and 01. You get a lot of smaller companies getting bought up and you get larger companies that are publicly traded and shareholders are saying, hey, sell this profitable area. The stock’s not doing well. You need to make some money because you need to sell this arm. So there’s a lot of M&A and divestitures that are happening right now. And you hit the head on the nail right there rather perfectly.

The smaller orgs often do not have the same security presence as the larger org that’s consuming them. And when you bring that environment into yours, you’re presenting a fair amount of risk and one of the most common things will happen is, Hey, let’s just snapshot their AD and you know, bring it over and then we’ll start kind of merging everything over.

Manoj Tandon (42:51.138)
That is a bad idea, man.

James Potter (42:54.079)
Yeah, it happens. It happens so much. You just get a complete snapshot of the dick, it gets moved over and then everything that was bad before gets brought into that new environment. So it’s not something I advise people to do, but it’s the path of least resistance. It gets them up and running as quickly as possible. So there’s a lot of non security oriented, you know, M&A firms or divestiture firms that will do this. They’re very good at

Manoj Tandon (43:03.856)
Ugh.

James Potter (43:21.803)
at merging identities and getting everything migrated, but they don’t always put security at the forefront because it’s an added cost, right? So you see a lot of vendors, even vendors that are releasing the software themselves, kind of cutting corners here from the security side of things.

Manoj Tandon (43:37.086)
And this happens in really large companies too. You get a lot of big companies that acquire the innovative player, right? In the space, they may be the small company. And they’re extremely good at whatever widget they’re making, whatever that is, right? But security on their network was not their thing. And now the big companies.

James Potter (43:41.577)
Ha ha.

James Potter (43:53.856)
Yeah, yeah.

James Potter (43:58.391)
Yeah, they’re widget makers. They’re widget makers, they’re not security people. Like, why do we need to do security? We’re making widgets. Real common problem. And there’s another flag that’ll get turned on here too, which is SSID history or SID history. And that allows basically you to mimic different IDs. And it’s handy when you’re performing a migration, but a lot of times post-migration, those flags will get left on.

Manoj Tandon (44:07.254)
Hey.

James Potter (44:25.015)
And that’s a great tool for threat actors, because now they can leverage that and they can pretend to be kind of whoever they want in their org while not appearing to be that individual. So definitely, you know, go turn your SID history off when you’re done with migrations, everyone. Pretty common baseline kind of thing, but just keep an eye out on that.

Manoj Tandon (44:42.358)
That great advice. You know, before we run out of time here, James, I wanted you to talk a little bit about DSE. I, you know, what does your company do? You know, what are you, yeah. I want you to, I want you to plug your company here. Tell us about your work and what you guys are up to.

James Potter (44:49.775)
Oh, I guess I should talk about my company, shouldn’t I?

James Potter (45:01.443)
Well, DSC is an Active Directory focused security firm. As I mentioned, we do M&A and divestiture work, but the core, the meat and potatoes of what we do is Active Directory security. A lot of companies will do like an ADRAP and push CIS compliance out and then, hey, we’re good, we’re fine. There’s no other vulnerabilities in our Active Directory, but there inevitably are. So we use a lot of the same tools that threat actors leverage, right? Threat actors use Bloodhound to poke around and perform discovery.

We use the enterprise variant of that, which is much more powerful. And we do the same type of, uh, methodological discovery that threat actors will do. So whatever the bad guys are doing, we’re mimicking it as close as we can. Staying on top of their methodologies and attack paths. So we can help these larger organizations, you know, not show up in the news. That’s, that’s our goal. Make sure the CSO stays the CSO for as long as they want and, uh, no publicity in the news.

Manoj Tandon (45:57.878)
That’s a tough job, man. I wouldn’t be taking bets on that. That’s like the, that’s the shortest lived position in a company, right? I mean, you look at, see the average, these are the life.

James Potter (46:06.303)
And that’s a shame too, because once a security event happens to the company, the CISO is the blade of armor for the CIO, right? CISO gets let go and now they have this black stain on their career because, hey, they were at company X when they got hacked. We don’t want that CISO. They did a bad job. But my perspective on that is that CISO saw what can happen and how quickly it can happen. In my opinion, they’re more valuable because of that exposure, right?

they’re gonna give you a more realistic view of risk because they’ve been through it and that carries a lot of weight.

Manoj Tandon (46:43.694)
that’s words to go by. I don’t know how many people will listen to that, but that is really good words. You know, we’ve had people also say about, you know, moving the Sizzles office out from under the CIO, which I’m personally a big fan of, right? Because there’s a conflict of interest there. You know, the…

James Potter (47:04.028)
Yeah, it’s also money, right? And I think we’re going to see a lot of changes. I haven’t seen the latest developments on the SEC versus the SolarWinds CISO, but basically they’re publicly traded. The CISO knew about vulnerabilities, allegedly, and didn’t bubble those up to the CIO, so they didn’t show up on the quarterly reports and investors got hurt. Now, for publicly traded companies that have a CISO, all the CISOs are looking at that case. They want to know what’s going to happen.

because if they’re personally liable for not bubbling something up to the CIO, then a lot more traffic is gonna come into those CIOs. They’re gonna get a whole lot of data from those CISOs now because the CISOs don’t wanna be personally liable for it, misleading shareholders. And then the CIO is gonna have to take this data, figure out what bubbles up to the CEO and what bubbles up to the quarterly reports and what doesn’t. So it’s a shift in responsibility in my viewpoint.

Manoj Tandon (47:59.506)
Now, take the CSO out from under the CIO and make him directly responsible to the board for security risks, right?

James Potter (48:07.411)
Yeah, that would change the landscape dramatically for the better. It’ll create a lot more work short term, but long term, it’ll be a better security footprint for everybody.

Manoj Tandon (48:17.07)
Hey, so James, you should write a book. You. You know, I. Yeah, you have a lot of knowledge here, and we’re only we’re just scratching the surface of this in 45 minutes or so. We’d love to if you’re open to it, get you back and talk about.

James Potter (48:20.974)
HAHA

I appreciate that.

Manoj Tandon (48:40.074)
Some of the things that you have seen that have gone wrong, these real world use cases and real world examples, I think is what makes cybersecurity tangible and we don’t talk about them enough. You brought up some really good one. Yeah, I think.

James Potter (48:51.979)
I’d be happy to be back and talk about it. Yeah, just let me know when you want to chat. I’d be happy to.

Manoj Tandon (48:58.114)
I think that would be very enlightening for our audience. And do you have any, are you doing any talks? Are you speaking at any events? Anything coming up that you want everybody to know about?

James Potter (49:08.703)
I’m just, I am actually just recovering from surgery. I was supposed to speak at some conferences in the Southeast that I couldn’t make. The kind of usual gambit of B-sides, black hat talks that I’m hoping get accepted this year. So I can speak a little bit about Active Directory and security and some basically free ways to harden your Active Directory environment without buying any software or anything. It’s just configuration as we talked about, right? If you put these configurations in,

you’re going to be more secure. And it’s kind of a boring topic, but I’m hoping there’s a big enough audience at Black Hat to recognize the value there. So look out for me, of course, at Black Hat. Yeah. They get a lot of competition. They have about a 10% acceptance rates for talks. So they’ll, they’ll get a thousand and only a hundred, you know, get through. So it’s, it’s competitive to get in there. They, they like the new cutting edge vulnerabilities and stuff. For me, it’s just.

Manoj Tandon (49:46.026)
I think a black hat there will be.

James Potter (50:03.503)
baseline security and what you can do better seems more impactful because the big vulnerabilities always get patched fairly quickly. And as long as you’re patching, you’re all right there. But the foundational stuff is the real issue. Oh yeah, we could talk for hours about patching.

Manoj Tandon (50:13.75)
That’s another topic.

Manoj Tandon (50:18.338)
about that, right? But it’s, it’s still the basics. We’re not getting right. And I think having that discussion on what all the vulnerabilities are things that you see, especially making it tangible, like think real life stories of what’s happened. I think that would, that might make cybersecurity more tangible. And, and I think if even a couple people listen to your advice,

You did the world a favor. Now how do they get a hold of you? How do they get a hold of your company?

James Potter (50:52.619)
Oh, well, I mean, you can pop out to our website. It’s a dse.team. We’re still saving up for that.com. It’s a little on the Spindy side since it’s a three letter. And you can always reach out to us. We have contact information out there. You can call us, email us, kind of whatever you want to do. We’re happy to help. Even if you just have some questions that are looking for answers, we don’t mind. Just give us a ring, shoot us an email. We’ll give you some advice.

Manoj Tandon (51:19.146)
Well, James, thank you so much. We’ll put the links in the show notes and really appreciate you being here. Good stuff.

James Potter (51:27.304)
Oh yeah, happy to be here man. Thank you.

Manoj Tandon (51:30.05)
Thank you.