Credential theft is how one stolen laptop turns into a full-blown breach. In this episode, Prasanna and I sit down with Dr. Mike Saylor to walk through how it happens and how to stop it.
Mike opens with a story that should make every IT person wince. A credit union employee had a logged-in laptop at a coffee shop, turned around, and it was gone. BitLocker didn’t help, because the machine was unlocked. The attackers harvested local credentials, learned how the credit union’s business processes worked, and then phished other employees from the inside while posing as the person who lost the laptop.
From there we get into how attackers think. Their first move is reconnaissance: what do I have, what’s it worth, and how do I keep access before somebody wipes it? Mike explains why the victim has about 30 minutes to respond, why a fear-based culture makes that window worse, and why you need a documented stolen-laptop playbook before you need it.
We also cover the stuff that makes credential theft so easy. Shared local admin passwords. Predictable new-user passwords with an exclamation point on the end (yes, really). Service accounts whose passwords never change. Default SNMP strings. Mike explains Kerberoasting in plain English and shares new research on how an unprotected printer can lead to a complete network takeover.
Then we talk about how to prevent credential theft. That means LAPS or a similar tool for unique local admin passwords, just-in-time credentials that expire on their own, tiered administration, and separate user and admin accounts for every admin. Mike tells the story of a database admin who deleted something in production because her test and production credentials were the same. We finish with alerting: what to alert on, why you’ll get a flood of false positives at first, and why my new freezer sensor proves the point.
If you manage credentials for anyone, this one’s worth your time.
Chapters
00:00 - Intro
01:49 - Welcome, Prasanna, and too many Reacher books
03:37 - Dr. Mike Saylor joins
04:07 - The stolen credit union laptop
05:42 - Reconnaissance and persistence: what attackers do first
08:31 - Privileged credentials that never change
10:36 - The 30-minute window after a stolen laptop
13:19 - Security culture and automated incident response
15:06 - Shared local admin passwords
17:23 - Predictable default passwords
18:20 - What attackers harvest: everything
19:01 - Kerberoasting explained
24:01 - Default credentials and the printer problem
25:22 - When the proof of concept becomes production
26:46 - The Brocade Silkworm story
28:07 - LAPS and just-in-time credentials
30:30 - Tiered administration and separate admin accounts
35:00 - Alerting on authentication events
36:10 - Expect false positives (and my freezer)
39:16 - Alert fatigue vs. alert annoyance
41:27 - Wrap-up
