Client
A UK engineering and infrastructure services group with around 6,000 staff, many working from client sites
Sector
Engineering & Infrastructure
Engagement
Remote-access architecture review, directory service-account redesign and detection engineering - eleven-week programme.
What the client needed
Field engineers reached internal systems through three VPN gateways from different vendors, installed at different times by different suppliers. Each held a directory bind account with wide read rights, certificates with long lifetimes and years of configuration nobody had reviewed. After a run of public advisories about gateway products being exploited before a patch existed, the IT director asked a plain question: if one of these boxes were taken over tonight, what would the attacker walk away with, and would we know?
How we worked
- Mapped what each gateway stored and could reach: bind accounts, shared secrets, certificates, and network paths to domain controllers and file servers.
- Replaced the broad directory bind accounts with narrowly scoped ones that can only verify a user, with no rights to read computer or recovery attributes.
- Moved the gateways into a restricted network segment, allowing only the specific directory and application ports each one needed.
- Added alerts for the bind accounts signing in from anywhere other than their gateway, for sudden spikes in failed logins, and for reads of local administrator password and disk recovery objects by non-administrators.
- Shortened certificate and secret lifetimes and wrote a rotation runbook, then rehearsed it so that rotating everything an appliance held took hours and not weeks.
- Agreed an emergency procedure for a gateway with an exploited advisory but no full fix, including who may switch access off and what field teams do in the meantime.
Measured results
Results confirmed with the client. Vendor names, headcounts and detailed configurations withheld in line with our standard confidentiality terms.
- A compromised gateway now exposes a service account that can only check passwords, not enumerate the directory.
- Each gateway sits in its own segment, and a scan from one can no longer reach domain controllers or file servers.
- Use of a gateway account from the wrong place was detected in a drill within minutes and reached an on-call person without anyone checking a mailbox.
- Full rotation of secrets and certificates for one gateway, which previously had no documented procedure, was completed inside a working morning during the exercise.
- The group now has a written decision on when a vulnerable gateway is switched off, agreed with operations before it was needed.
"We used to ask whether the gateway was patched. The better question turned out to be what happens on the day it is not. Now we have an answer, and it is a short one."
Working on something similar?
If this engagement looks like the kind of problem you are facing, we would be glad to compare notes by email.
Context and constraints
Field teams relied on remote access for site surveys and safety paperwork, so there was no appetite for downtime. Two of the three gateways were owned by suppliers under contract, which limited what we could change on the devices themselves. That pushed the work to the places the group did control: the directory, the network around the boxes, and monitoring.
Why we started with the service accounts
Vendor patches arrive on the vendor's timetable and occasionally with a gap. The directory account is the part an attacker takes away and uses elsewhere, so it was the part where the group could cut the damage regardless of what a future advisory said. Public reporting this month of a gateway chain that stole stored domain credentials and then went looking for administrator and recovery secrets made the case better than any slide of ours.
Where control really sits
We assumed the interesting question was how to detect an exploit. It was cheaper to make the result of one dull. A bind account that cannot read much, a network path that does not lead to domain controllers, and an alert on odd use of the account together took away most of what an intruder wants from a foothold on the edge.
Lessons learned
First, inventory what a device holds before debating how to defend it, because nobody had written it down. Second, a rotation procedure is only real once someone has run it against the clock. Third, agree the switch-off decision in calm weather; the middle of an incident with a partly fixed vulnerability is a poor time to find out who owns it.
If your remote-access gateways are trusted more than they have earned, we would be glad to talk. Email sales@halfteck.com.