GIAC GDSA — Zero Trust Architecture

NIST SP 800-207 Component Details:

• Policy Engine: Trust algorithm that evaluates all signals — identity attributes (MFA status, role), device health (patch level, compliance), network context (location, IP reputation), behavioral signals (time of day, resource access patterns). Outputs: trust/deny/no-access.
• Policy Administrator: Acts as control plane. Creates per-session tokens or credentials. Signals PEP whether to open/close communication path. No data plane role.
• Policy Enforcement Point: Data plane enforcer. Splits into PE-facing (non-enterprise) and internal (enterprise resource-facing) sides. All resource requests flow through PEP.

Credential Rotation Tools (Exam Priority):

• HashiCorp Vault: Open-source secrets management. Dynamic secrets — generates unique credentials per request with automatic expiration. Lease management, revocation. Supports AWS, database, PKI, SSH secrets engines.
• CyberArk: Enterprise PAM. Password vault for service accounts and privileged credentials. CPM (Central Policy Manager) rotates passwords automatically. Session Manager for jump box functionality.
• AWS Secrets Manager / Azure Key Vault: Cloud-native secrets rotation. Automatic rotation for RDS passwords, API keys. Application retrieves credentials at runtime via API — never stored statically.
• Just-in-Time (JIT) access: Privileged access granted only for specific work window, then revoked. Eliminates standing privileges that attackers can abuse.

Service Account Management: Service accounts should have unique passwords per system, rotated regularly. Never shared passwords. Constrained to specific source IPs/times. Monitored for out-of-baseline behavior.

Responding to Credential Compromise: When credentials are compromised: immediately revoke all sessions (invalidate tokens), rotate affected credentials, review all access logs for unauthorized use in review window, check for persistence (scheduled tasks, new accounts, SSH keys added).

Pass-the-Hash (PtH):

• Mechanism: Attacker captures NTLM hash from LSASS memory (Mimikatz sekurlsa::logonpasswords). Uses hash directly in NTLM authentication — doesn't need plaintext password.
• Detection: Unusual lateral movement patterns (workstation → workstation auth at unusual times), NTLM auth to many systems from single source.
• Defense: Protected Users security group (prevents NTLM auth for group members), disable NTLM network authentication entirely, Credential Guard isolates LSASS in VBS hypervisor.

Pass-the-Ticket (PtT):

• Mechanism: Steal Kerberos TGT or service tickets from memory (Mimikatz sekurlsa::tickets or kerberos::list). Import stolen ticket into current session (kerberos::ptt). Allows impersonation of legitimate users.
• Defense: Short Kerberos ticket lifetime (4-10 hour TGT), monitoring for unusual Kerberos ticket requests, Credential Guard.

Golden Ticket Attack:

• Mechanism: Attacker obtains krbtgt account's NTLM hash (full domain admin required). Forges TGTs offline (mimikatz kerberos::golden). Forged TGTs are valid for default 10 years and bypass normal authentication checks.
• Impact: Unlimited domain access as any user. Persists even after password resets of other accounts.
• Defense: Double-reset the krbtgt password (must reset twice — each ticket validation uses previous and current hash). Requires domain reconnection for all devices.

Silver Ticket: Forge service ticket (TGS) for specific service using service account hash. Doesn't require KDC interaction — harder to detect. Defense: service account password rotation, Privileged Account Management.

Kerberoasting:

• Mechanism: Any domain user can request service tickets (TGS) for any SPN. Ticket encrypted with service account password hash. Attacker extracts ticket and cracks offline with Hashcat/John.
• High-value targets: service accounts with weak passwords and SPNs (SQL Server, IIS, etc.).
• Defense: Service accounts with strong (25+ char) random passwords, use Group Managed Service Accounts (gMSA) with auto-rotating 240-char passwords, monitor for unusual TGS requests.

Tiered Administration Model: Tier 0 (DC/PKI), Tier 1 (servers), Tier 2 (workstations). Admin accounts for each tier used only from dedicated PAWs (Privileged Access Workstations). Prevents credential theft across tiers.

Single Packet Authorization Mechanism:

• Client sends a single encrypted UDP packet containing: timestamp (prevents replay), HMAC using pre-shared key, source IP address, requested port/protocol.
• Server-side: fwknop daemon processes UDP packet in userspace — never creates kernel state, invisible to port scanners.
• If HMAC validates and timestamp is fresh (within ±120 seconds): iptables rule is dynamically added opening the requested port for the specific source IP for 30-60 seconds.
• Client then connects within the window. After timeout, rule is removed. Default deny all other traffic.

SPA vs Port Knocking:

• Port knocking: sequence of connection attempts to specific ports — easily observed and replayed by network sniffers. Weak security.
• SPA: single encrypted packet with HMAC — cannot be replayed (timestamp), cannot be forged (HMAC without key), server-side processing is userspace (no state table exposure).

Domain Isolation (Windows):

• Uses Windows Group Policy to deploy IPsec policies: "Require inbound authentication for all connections."
• Domain members authenticate using Kerberos (domain credentials) or machine certificate.
• Unmanaged devices (non-domain, compromised, guest devices) that cannot present valid credentials are silently rejected — TCP connection refused at network layer, not application layer.
• Isolation persists even if attacker gains access to same physical network segment (VLAN traversal, connected to same switch).

Server Isolation: Additional IPsec policy layer above domain isolation. Specific high-value servers only accept connections from specific client groups. Example: HR server only accepts connections from computers in the "HR-Workstations" group. Both groups need IPsec policy deployed. Uses IPsec authentication header (AH) for authentication without encryption overhead — or ESP for full encryption.

Implementation Notes: Domain isolation uses Connection Security Rules in Windows Firewall with Advanced Security (WFAS). No third-party software required. Integrates with existing AD infrastructure.

Why Deception is High Value: Any interaction with a decoy is inherently malicious — legitimate users/systems never access fake resources. This produces near-zero false positives, unlike behavioral analytics or anomaly detection that struggles with legitimate traffic patterns. Single interaction = high-confidence alert.

Honeypot Types:

• Low-interaction honeypot: Emulates services (SSH, HTTP, Telnet) via software. Low risk — attacker can't escalate on a real OS. Lower intel — only captures initial exploitation attempts. Easy to deploy at scale (one per VLAN).
• High-interaction honeypot: Full real systems (VM or dedicated hardware). Attacker interacts with real OS. Rich intelligence on attacker TTPs. Higher risk — attacker may pivot to other systems if honeypot isn't isolated. Requires careful network segmentation.
• Honeynets: Full network of interconnected honeypots simulating production environment. Maximum intel. Requires significant operational investment.

Honey Credentials (Exam Favorite):

• Fake username/password combinations seeded in: password files (/etc/passwd look-alikes), memory (set in LSASS via logon), network shares, document files, backup configs.
• Credentials are monitored — any authentication attempt using them triggers high-confidence alert.
• Detects credential dumping and lateral movement: attacker runs Mimikatz, finds "admin123" credential, uses it — immediately triggers alert.

Canary Tokens (canarytokens.org):

• Fake files, URLs, API keys, DNS names, Word documents that "call home" when accessed.
• Examples: fake Word document with embedded tracking URL, fake AWS access key that triggers CloudTrail alert when used, fake SSH private key, honey email addresses.
• Place in: network shares (\\server\finance\Q4-Budget.docx), email archives, source code repos, desktops.
• Any access triggers alert: "Who opened the fake budget file at 2 AM?"

Deception Products: Attivo Networks (now SentinelOne Identity), Illusive Networks, TrapX, Cymmetria. Integrate with SIEM for centralized alerting.

Strategic Effect: Even if attacker evades deception initially, knowing decoys exist causes attacker uncertainty — slows them down, increases likelihood of error. Every system might be a honeypot. This psychological pressure is a defensive value beyond the technical alerts.

Remove Local Administrator Rights (Highest Impact):

• Majority of malware requires local admin to install, persist, or spread to other systems. Without local admin: attacker must perform privilege escalation (additional detectable step) before persistence.
• Implementation: Group Policy → Restricted Groups (remove all from local Administrators except BUILTIN\Administrators). Deploy just-in-time elevation for legitimate admin needs (CyberArk EPM, BeyondTrust Endpoint Privilege Management).
• User Account Control (UAC) is NOT a substitute for removing local admin — UAC can be bypassed by numerous published techniques.

Application Control:

• AppLocker: Windows application whitelisting by hash, publisher certificate, or path. Policy types: executable rules, script rules, packaged app rules. Default deny — only approved executables can run. Limitation: only available on Enterprise/Education editions.
• Windows Defender Application Control (WDAC): Kernel-level enforcement. Stronger than AppLocker — cannot be bypassed by local admins. Recommended for new deployments. Policy in XML, deployed via MDM/GPO/SCCM.
• Both support audit mode (log violations without blocking) for policy tuning before enforcement.

Disable LLMNR and NetBIOS (Critical):

• LLMNR (Link-Local Multicast Name Resolution) and NetBIOS are legacy Windows name resolution protocols. When DNS fails, Windows broadcasts LLMNR queries.
• Attack (Responder): attacker responds to LLMNR/NetBIOS broadcasts with malicious responses, capturing NTLMv2 hashes for offline cracking.
• Disable via GPO: Computer Configuration → Administrative Templates → Network → DNS Client → "Turn off multicast name resolution" = Enabled. Disable NetBIOS via DHCP option 001 or NIC properties.

Patch SLAs: Critical (CVSS 9.0+): 72 hours. High (CVSS 7.0-8.9): 7 days. Medium (CVSS 4.0-6.9): 30 days. These are exam-tested values. Automation via WSUS, SCCM, Intune, Ansible is required for large environments.

CIS Benchmarks: Industry-standard hardening baselines for Windows, Linux, macOS, browsers, cloud. Level 1 = practical security improvements. Level 2 = highly secure but potentially impacts usability. Use as baseline before additional custom hardening. Available free from cisecurity.org.

Secure Boot and TPM: Secure Boot prevents boot-level malware (bootkits) by verifying bootloader signatures. TPM stores encryption keys (BitLocker), provides platform attestation for device health checks in ZTA conditional access.

HIDS vs HIPS vs EDR:

• HIDS (Host Intrusion Detection): Monitors host state — file integrity monitoring (detects unauthorized changes to system files, rootkit installation), log monitoring, rootkit detection. Tools: OSSEC, Wazuh, Tripwire. Generates alerts, does not block.
• HIPS (Host Intrusion Prevention): Behavioral blocking before execution. Blocks suspicious actions (process injection, API calls indicative of shellcode). Can stop malware before it executes. Higher FP risk than HIDS.
• EDR (Endpoint Detection and Response): Next-generation endpoint security. Continuous telemetry collection (process creation, network connections, registry changes, file operations), cloud-based threat hunting, behavioral detection engines, automated response (process kill, isolation). Products: CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint (MDE), Carbon Black.

Critical Windows Event IDs (Memorize for Exam):

• 4624: Successful logon — logon type matters (2=interactive, 3=network, 10=remote interactive)
• 4625: Failed logon — multiple failures = brute force indicator
• 4688: Process creation — with command line logging enabled, reveals attacker commands
• 4698: Scheduled task created — common persistence mechanism
• 4720: User account created — new account = possible persistence
• 7045: New service installed — service installation = common persistence/escalation
• 4776: NTLM authentication attempt — lateral movement via PtH
• 4771: Kerberos pre-authentication failed — brute force or AS-REP roasting

Sysmon (System Monitor): Free Microsoft Sysinternals tool. Adds detailed process creation logging (parent PID, full command line, image hashes), DNS query logging, file creation time changes, network connections with PID attribution, driver loading, process injection detection. Config file controls what is logged (SwiftOnSecurity sysmon config is recommended baseline).

Windows Event Forwarding (WEF): Push Windows event logs from endpoints to a centralized Windows Event Collector (WEC) server. Uses WinRM (HTTP/S). No agent required — native Windows feature. Subscriptions define which events to forward. Centralized logs prevent local modification. Forward to SIEM from WEC.

Linux Logging: auditd monitors system calls, file access, user commands. /var/log/auth.log for SSH logins and sudo usage. /var/log/syslog for system events. Rsyslog or syslog-ng for centralized log forwarding.