marcus-murrayIT security has come a long way, but every once in a while you see something that makes you think otherwise. Every day, internal and external hackers breach and traverse “secure” environments, making you wonder just how easy it is for attackers to completely compromise your network. In a new on-demand BeyondTrust webcast, Marcus Murray, Cyber Security Manager at TrueSec, demonstrates a live hack in which he uses a specially crafted JPEG picture to circumvent the security mechanisms of a Microsoft Windows 2012R2 Webserver. Murray uses this foothold to leverage elevated privileges, expand influence over the entire network, and compromise a Windows Server 2012 R2 Domain Controller – drawing the audience’s attention to the relationship between vulnerability management, privileged account management, and organizational security. Legitimacy and Your Network Throughout the presentation, Murray encourages IT administrators to carefully consider their approach to “legitimacy.” As evidenced in this live hack, attackers can use seemingly legitimate files as a foothold to open the door to your network and compromise your systems. Once an attacker has breached the perimeter, they can move laterally through the network leveraging user privileges gained during the initial compromise. This further exposes your environment to both internal and external threats seeking to download or destroy high-value information and assets. Countermeasures for Increased Security Murray mentions several countermeasures you can take to increase your security level against similar hacks, including a focus on more frequent, “low and slow” monitoring. This is where the real benefits of unified privilege and vulnerability management software become clear: consolidating these efforts allows you to monitor more of your environment with less energy and more granular control. You can proactively identify perimeter exposures while effectively shrinking your IT environment’s internal attack surface. See It for Yourself Curious to see just how dangerous a JPEG can be? Watch a live attack in the on-demand webcast below, and learn more about BeyondTrust solutions that can help.