Don't ditch PowerShell to improve security, say infosec agencies from UK, US, and NZ
(2022/06/23)
- Reference: 1655971091
- News link: https://www.theregister.co.uk/2022/06/23/keep_poewrshell_security_advice/
- Source link:
Windows PowerShell is enormously useful, extremely prevalent, and often [1]targeted by crooks because it offers an express route into the heart of Windows servers and networks.
Some have therefore suggested the tool is a liability that should be disabled in the interest of improved security.
But on Wednesday national cybersecurity agencies from the US, UK, and New Zealand decided that's a bit drastic. Instead, the agencies recommend securing PowerShell prudently.
[2]
"PowerShell is essential to secure the Windows operating system," the agencies argue. "Removing or improperly restricting PowerShell would prevent administrators and defenders from utilizing PowerShell to assist with system maintenance, forensics, automation, and security."
[3]
[4]
That opinion was offered in a [5]Cybersecurity Information Sheet [PDF] titled "Keeping PowerShell: Security Measures to Use and Embrace" that argues the security benefits of properly-protected PowerShell outweigh the risks it causes.
The document's first recommendation is ensuring use of PowerShell 7.2, because it improves on the previous version 5.x that shipped with some editions of Windows 10.
[6]Jeffrey Snover claims Microsoft demoted him for inventing PowerShell
[7]Expired cert breaks Windows 11 snipping tool, emoji panel, S Mode features, other stuff
[8]Microsoft emits more Win 11 fixes for AMD speed issues and death by PowerShell bug
Another piece of advice is to allow PowerShell remoting only from trusted endpoints and networks because Microsoft's defaults are a little loose.
The document also points out that not all anti-virus software is aware of Windows 10's Antimalware Scan Interface (AMSI), which PowerShell uses so it can scan scripts. Using AMSI-aware AV is therefore sensible.
[9]
Other recommendations include:
Using PowerShell's credential protection features during remote sessions because they work as advertised and ensure creds can't be accessed on remote hosts;
Enabling Deep Script Block Logging, Module Logging, and Over-the-Shoulder – three useful logging tools that can help to detect abuses of PowerShell. Microsoft does not enable the three by default;
Use SSH when remoting, because it's … secure by design.
"These recommendations will help defenders detect and prevent abuse by malicious cyber actors, while enabling legitimate use by administrators and defenders," the document concludes.
The document was penned by US's National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA), the New Zealand National Cyber Security Centre (NZ NCSC), and the UK's National Cyber Security Centre (NCSC-UK). ®
Get our [10]Tech Resources
[1] https://www.theregister.com/2022/05/27/chromeloader-malware-powershell/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YrQ5xMrRypeusn6@kK7tGQAAAAE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YrQ5xMrRypeusn6@kK7tGQAAAAE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YrQ5xMrRypeusn6@kK7tGQAAAAE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://media.defense.gov/2022/Jun/22/2003021689/-1/-1/1/CSI_KEEPING_POWERSHELL_SECURITY_MEASURES_TO_USE_AND_EMBRACE_20220622.PDF
[6] https://www.theregister.com/2022/05/10/jeffrey_snover_said_microsoft_demoted/
[7] https://www.theregister.com/2021/11/04/expired_certificate_windows11/
[8] https://www.theregister.com/2021/10/22/windows_11_fixes_windows_10_/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YrQ5xMrRypeusn6@kK7tGQAAAAE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
Some have therefore suggested the tool is a liability that should be disabled in the interest of improved security.
But on Wednesday national cybersecurity agencies from the US, UK, and New Zealand decided that's a bit drastic. Instead, the agencies recommend securing PowerShell prudently.
[2]
"PowerShell is essential to secure the Windows operating system," the agencies argue. "Removing or improperly restricting PowerShell would prevent administrators and defenders from utilizing PowerShell to assist with system maintenance, forensics, automation, and security."
[3]
[4]
That opinion was offered in a [5]Cybersecurity Information Sheet [PDF] titled "Keeping PowerShell: Security Measures to Use and Embrace" that argues the security benefits of properly-protected PowerShell outweigh the risks it causes.
The document's first recommendation is ensuring use of PowerShell 7.2, because it improves on the previous version 5.x that shipped with some editions of Windows 10.
[6]Jeffrey Snover claims Microsoft demoted him for inventing PowerShell
[7]Expired cert breaks Windows 11 snipping tool, emoji panel, S Mode features, other stuff
[8]Microsoft emits more Win 11 fixes for AMD speed issues and death by PowerShell bug
Another piece of advice is to allow PowerShell remoting only from trusted endpoints and networks because Microsoft's defaults are a little loose.
The document also points out that not all anti-virus software is aware of Windows 10's Antimalware Scan Interface (AMSI), which PowerShell uses so it can scan scripts. Using AMSI-aware AV is therefore sensible.
[9]
Other recommendations include:
Using PowerShell's credential protection features during remote sessions because they work as advertised and ensure creds can't be accessed on remote hosts;
Enabling Deep Script Block Logging, Module Logging, and Over-the-Shoulder – three useful logging tools that can help to detect abuses of PowerShell. Microsoft does not enable the three by default;
Use SSH when remoting, because it's … secure by design.
"These recommendations will help defenders detect and prevent abuse by malicious cyber actors, while enabling legitimate use by administrators and defenders," the document concludes.
The document was penned by US's National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA), the New Zealand National Cyber Security Centre (NZ NCSC), and the UK's National Cyber Security Centre (NCSC-UK). ®
Get our [10]Tech Resources
[1] https://www.theregister.com/2022/05/27/chromeloader-malware-powershell/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YrQ5xMrRypeusn6@kK7tGQAAAAE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YrQ5xMrRypeusn6@kK7tGQAAAAE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YrQ5xMrRypeusn6@kK7tGQAAAAE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://media.defense.gov/2022/Jun/22/2003021689/-1/-1/1/CSI_KEEPING_POWERSHELL_SECURITY_MEASURES_TO_USE_AND_EMBRACE_20220622.PDF
[6] https://www.theregister.com/2022/05/10/jeffrey_snover_said_microsoft_demoted/
[7] https://www.theregister.com/2021/11/04/expired_certificate_windows11/
[8] https://www.theregister.com/2021/10/22/windows_11_fixes_windows_10_/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YrQ5xMrRypeusn6@kK7tGQAAAAE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
veti
I guess now we know what the Five Eyes are using to spy on us.
Powershell 7.2 improves on 5.1?
DCdave
Hmm, not so sure about that, really. It's newer, but it has some compromises due to portability. If you're setting up a new environment from scratch, then maybe go for it. If you've got a mature environment with lots of scripts then you're likely going to need and want to keep using 5.1.
Also, just using 7.2 isn't enough anyway, you do actually need to disable 5.1 in some way, at least for remote access, otherwise all you're doing is stopping using 5.1 and leaving it open for anyone who wants to use it.
Good
PowerShell is my love language.