Building Resilient Software: Mitigating LOTL Risks

Recommendations ‎for‏ ‎Software ‎Manufacturers ‎is ‎crucial ‎in‏ ‎reducing ‎the‏ ‎prevalence‏ ‎of ‎exploitable ‎flaws‏ ‎that ‎enable‏ ‎LOTL ‎tactics.

📌Minimizing ‎Attack ‎Surfaces:‏ ‎Software‏ ‎manufacturers ‎are‏ ‎urged ‎to‏ ‎minimize ‎attack ‎surfaces ‎that ‎can‏ ‎be‏ ‎exploited ‎by‏ ‎cyber ‎threat‏ ‎actors ‎using ‎LOTL ‎techniques. ‎This‏ ‎includes‏ ‎disabling‏ ‎unnecessary ‎protocols‏ ‎by ‎default,‏ ‎limiting ‎the‏ ‎number‏ ‎of ‎processes‏ ‎and ‎programs ‎running ‎with ‎escalated‏ ‎privileges, ‎and‏ ‎taking‏ ‎proactive ‎steps ‎to‏ ‎limit ‎the‏ ‎ability ‎for ‎actors ‎to‏ ‎leverage‏ ‎native ‎functionality‏ ‎for ‎intrusions.

📌Embedding‏ ‎Security ‎in ‎the ‎SDLC: ‎Security‏ ‎should‏ ‎be ‎embedded‏ ‎into ‎the‏ ‎product ‎architecture ‎throughout ‎the ‎entire‏ ‎software‏ ‎development‏ ‎lifecycle ‎(SDLC).‏ ‎This ‎proactive‏ ‎integration ‎ensures‏ ‎that‏ ‎security ‎considerations‏ ‎are ‎not ‎an ‎afterthought ‎but‏ ‎a ‎fundamental‏ ‎component‏ ‎of ‎the ‎product‏ ‎from ‎inception‏ ‎to ‎deployment.

📌Mandating ‎Multi-Factor ‎Authentication‏ ‎(MFA):‏ ‎Manufacturers ‎should‏ ‎mandate ‎MFA,‏ ‎ideally ‎phishing-resistant ‎MFA, ‎for ‎privileged‏ ‎users‏ ‎and ‎make‏ ‎it ‎a‏ ‎default ‎feature ‎rather ‎than ‎an‏ ‎optional‏ ‎one.‏ ‎This ‎step‏ ‎significantly ‎enhances‏ ‎the ‎security‏ ‎of‏ ‎user ‎accounts,‏ ‎particularly ‎those ‎with ‎elevated ‎access.

📌Reducing‏ ‎Hardening ‎Guide‏ ‎Size:‏ ‎The ‎size ‎of‏ ‎hardening ‎guides‏ ‎that ‎accompany ‎products ‎should‏ ‎be‏ ‎tracked ‎and‏ ‎reduced. ‎As‏ ‎new ‎versions ‎of ‎the ‎software‏ ‎are‏ ‎released, ‎the‏ ‎aim ‎should‏ ‎be ‎to ‎shrink ‎the ‎size‏ ‎of‏ ‎these‏ ‎guides ‎over‏ ‎time ‎by‏ ‎integrating ‎their‏ ‎components‏ ‎as ‎the‏ ‎default ‎configuration ‎of ‎the ‎product.

📌Considering‏ ‎User ‎Experience:‏ ‎The‏ ‎user ‎experience ‎consequences‏ ‎of ‎security‏ ‎settings ‎must ‎be ‎considered.‏ ‎Ideally,‏ ‎the ‎most‏ ‎secure ‎setting‏ ‎should ‎be ‎integrated ‎into ‎the‏ ‎product‏ ‎by ‎default,‏ ‎and ‎when‏ ‎configuration ‎is ‎necessary, ‎the ‎default‏ ‎option‏ ‎should‏ ‎be ‎secure‏ ‎against ‎common‏ ‎threats. ‎This‏ ‎approach‏ ‎reduces ‎the‏ ‎cognitive ‎burden ‎on ‎end ‎users‏ ‎and ‎ensures‏ ‎broad‏ ‎protection.

📌Removing ‎Default ‎Passwords:‏ ‎Default ‎passwords‏ ‎should ‎be ‎eliminated ‎entirely‏ ‎or,‏ ‎where ‎necessary,‏ ‎be ‎generated‏ ‎or ‎set ‎upon ‎first ‎install‏ ‎and‏ ‎then ‎rotated‏ ‎periodically. ‎This‏ ‎practice ‎prevents ‎the ‎use ‎of‏ ‎default‏ ‎passwords‏ ‎as ‎an‏ ‎easy ‎entry‏ ‎point ‎for‏ ‎malicious‏ ‎actors.

📌Limiting ‎Dynamic‏ ‎Code ‎Execution: ‎Dynamic ‎code ‎execution,‏ ‎while ‎offering‏ ‎versatility,‏ ‎presents ‎a ‎vulnerable‏ ‎attack ‎surface.‏ ‎Manufacturers ‎should ‎limit ‎or‏ ‎remove‏ ‎the ‎capability‏ ‎for ‎dynamic‏ ‎code ‎execution ‎due ‎to ‎the‏ ‎high‏ ‎risk ‎and‏ ‎the ‎challenge‏ ‎of ‎detecting ‎associated ‎indicators ‎of‏ ‎compromise‏ ‎(IOCs).

📌Removing‏ ‎Hard-Coded ‎Credentials:‏ ‎Applications ‎and‏ ‎scripts ‎containing‏ ‎hard-coded‏ ‎plaintext ‎credentials‏ ‎pose ‎a ‎significant ‎security ‎risk.‏ ‎Removing ‎such‏ ‎credentials‏ ‎is ‎essential ‎to‏ ‎prevent ‎malicious‏ ‎actors ‎from ‎using ‎them‏ ‎to‏ ‎access ‎resources‏ ‎and ‎expand‏ ‎their ‎presence ‎within ‎a ‎network.