Martin - SISR, 2024 session

Mission A1 - Risk analysis and reduction

a) The main risk of ransomware is the unavailability of data and services (encryption). For a clinic, this means lack of access to patient data → risk to continuity of care and personal safety.

b) Severity level EBIOS = G4 (CRITICAL): disastrous consequences for the organisation, severely degraded operations and personal safety threatened (healthcare institution).

c) Four measures:

1. Backups: regular, tested and offline/immutable (3-2-1 rule).
2. Updates/patches: systematic (OS, applications).
3. Antivirus/EDR + email filtering (primary vector: phishing).
4. Network segmentation + least privilege + MFA + awareness training.

a) An offline backup cannot be encrypted by ransomware (it is not accessible online) → data can be restored without paying. Hardware solution: tapes or external disks disconnected after backup (or immutable storage).

b) Stay informed through vulnerability monitoring: CERT-FR/ANSSI advisories, CVE database, vendor advisories.

c) A dedicated management VLAN isolates management traffic → a compromised workstation does not grant access to the management plane (limits propagation).

d) A management workstation without internet access reduces the attack surface: it prevents a privileged account from being exposed to phishing or malicious downloads.

Phase	Countermeasures
Intrusion (phishing)	email filtering + user awareness training
Execution	EDR/antivirus + privilege restrictions (no local admin)
Lateral movement	network segmentation + least privilege
Encryption	offline backups + abnormal behaviour detection
Extortion	backups for restoration + incident response plan

Mission A2 - HTTPS traffic decryption

Traffic over HTTPS is encrypted: the antivirus/IDS cannot inspect traffic content. Ransomware can therefore travel encrypted (download, command and control) without being detected → the clinic loses visibility over these exchanges.

The Stormshield firewall acts as an SSL proxy performing a legitimate 'man-in-the-middle': it decrypts traffic to inspect it, then re-encrypts it to the server. Zones:

• client → proxy: encrypted (with the proxy's internal CA certificate);
• inside the proxy: decrypted (antivirus/IDS inspection);
• proxy → external web server: encrypted (server certificate).

a) The warning message appears because the certificate presented by the proxy is signed by an internal CA not recognised by the workstation's browser.

b) In the second test, the internal CA certificate was installed (trusted) in the workstation's store → no further warning.

• Advantages: traffic inspection, detection of malware and data leaks in encrypted traffic.
• Disadvantages: privacy infringement (personal traffic), performance impact, complexity, and legal risk on sensitive traffic (healthcare, banking) that should not be decrypted.

a) The error message is caused by the absence of the proxy CA certificate in the client workstation's certificate store.

b) Remediation: deploy this root certificate to all workstations (via GPO).

Decryption must be proportionate, require prior employee notification (IT charter, CSE consultation), and exclude sensitive personal traffic (banking, healthcare). The CNIL prohibits excessive individual surveillance.

Mission B1 - PingCastle report (1)

For example: the presence of a centralised directory (AD) with single sign-on, and the enforcement of a password policy (complexity/expiry) - points to confirm in the report, which already structure security.

• Sound: sufficient minimum length, required complexity, lockout after failed attempts.
• Debatable: overly frequent expiry (encourages weak/reused passwords) and too short a history (rapid reuse of old passwords).

a) A password, even a complex one, becomes dangerous when reused across multiple sites: if leaked on one site (cf. HaveIBeenPwned), the attacker replays it everywhere (credential stuffing), as with Mr Brodier's account.

b) Tool for 'one site = one unique password': a password manager (which generates and stores a distinct, strong password for each service).

Mission B2 - PingCastle report (2)

a) An obsolete operating system no longer receives security patches: its known vulnerabilities remain exploitable.

b) PingCastle considers a machine vulnerable based on the operating system version and end-of-support date.

a) Caching administrator credentials on a client workstation is dangerous: an attacker who has compromised this workstation can retrieve these secrets (hashes) and carry out a pass-the-hash attack → compromise of a privileged account.

b) Solution: add administrative accounts to the 'Protected Users' group (which prevents caching), deploy LAPS, and do not log on as administrator on client workstations.

Mission B3 - Log centralisation (WEF)

a) The WEF service is not currently used in the infrastructure.

b) Using it is appropriate: centralising Windows logs allows events to be correlated and intrusions to be detected earlier.

c) Advantages: centralised collection, correlation, detection; limitation: it only covers the Windows environment (and generates a large volume to store/analyse).