Techniques observed in security breaches and defending against them

The talk walks through three real intrusions the speaker investigated as an incident responder at a Finnish security firm. The attacks are organized using the MITRE ATT&CK framework, and details are kept high level to protect the affected companies. Across the cases, attackers reached publicly exposed remote access servers with stolen working credentials, then moved laterally, often over RDP, using manual work rather than automation. One intrusion began with a spreadsheet listing accounts, passwords and internal server details, and another ended with ransomware that encrypted backups hosted on the same ESXi hypervisors as production servers.

The common thread was identity. Every case involved valid accounts, excessive privileges such as domain admin or local admin rights on remote access servers, and remotely reachable accounts without multi-factor authentication. Malware appeared in each incident. In the first case, Cobalt Strike and a PowerShell-based remote access trojan were used, and endpoint protection stopped part of the activity before anything serious happened.

For defense, the speaker stresses enforcing MFA, training users against phishing, and applying least privilege, especially for accounts that can log in remotely. Other recommendations include a tiered administration model that separates tier zero, one and two assets, a local administrator password solution, blocking unneeded inbound ports on endpoints, application allowlisting, and attack surface reduction rules. The speaker notes that the reasoning behind each control was tied to how the specific intrusion would have been stopped.