{%CAPTION%}
As I advanced in my previous post talking about the weakest link in cybersecurity, with the 3 basic principles of cybersecurity: least privilege, defense in depth y limiting the area of exposureIf you always apply them as a rule, you will be reasonably well protected.
We will see what they consist of.
Principle of Least Privilege
**The Principle of Least Privilege **is undoubtedly one of your best shields against cyber-attacks.
The application of this foundation is crucial to block, for example, such dangerous hacking techniques as Juicy Potato, which remains a latent threat even on updated Windows.
Modern operating systems (OS), especially Windows, include legitimate services that attackers exploit to escalate privileges.
The ultimate goal? To convert basic user access to SYSTEM permissions (the maximum in Windows), which gives full control over the machine.
The problem is that these services - such as *SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege *- exist by design and in the case of servers with IIS or SQL services cannot be disabled.
Tools such as Juicy Potato or PrintSpoofer (which exploits the print service) take advantage of certain OS services to execute malicious code with elevated privileges.
Although Microsoft has released patches, new variants such as Rogue Potato or RogueWinRM continue to circumvent defenses.
But let’s focus on the mistake we all make: using the administrator account for everything.
When installing an OS, the first thing we do is to create an administrator (or root) account.
This user has unlimited powers: install software, modify critical settings or delete any file.
The risk arises when, due to convenience or lack of knowledge, we use this account for everyday tasks such as browsing, checking email, playing games, etc.).
A malware that manages to execute in this context will inherit administrator privileges and will end up acting without restrictions.
The solution is simple but powerful:
- Create a standard user account for day-to-day use.
- Use the administrator account only when strictly necessary (install programs, update the system).
Practical example: If a ransomware infects your standard user account, it will not be able to encrypt system files or spread easily.
If it attacks you while you were using the administrator account, the damage will be catastrophic.
This principle goes beyond personal accounts. It should apply to:
- Network resources: Limits access to shared folders.
- Applications: Why does a text editor need network permissions?
- Devices: Restrict the use of USB or sensitive peripherals.
Another practical case that we can apply in our homes, where each member of the family has his or her own account:
- Administrator account: can only be used by parents for specific tasks, such as installing software (SW), creating users, configuring settings, etc.
- Parents: apart from being able to use the previous account occasionally, everyone must have their own normal user account. The one they use for everything other than administration.
- Children: Like parents, each child has his or her own account. These accounts will have limited permissions that will allow them to make basic use of the computer, i.e. use the applications already installed. By setting parental control over these accounts, potentially dangerous or adult content can be restricted.
In the case of companies, it would consist of creating segmented accounts by department in order to avoid data leaks.
In addition, it is of utmost importance that administrators have a completely different account for each administrator task.
Never use the same administration account for everything, even if all these tasks are performed by the same person.
The reason is that if that single administration account were to be compromised, the entire organization would be put in check.
However, if you segment accounts by roles linked to specific tasks, if one account is compromised, at least we would know that the rest would still be safe and, therefore, only a portion of the organization would be at risk.
Conclusion: Less privileges = Less risks.
Next time you use your computer, think twice before clicking “Run as administrator”.
Principle of Defense in Depth
Defense in depth would be your best ally and an invisible shield against threats such as the zero days (zero days).
A zero day is a hidden vulnerability in software or hardware that attackers exploit before anyone else discovers it.
Imagine it as a crack in a wall that only hackers know about.
These failures are usually detected in two ways:
- By chance, during normal use of the system.
- In safety tests carried out by experts.
When an ethical hacker finds a zero day, he usually reports it to the developer for patching.
But if it falls into the wrong hands, the scenario becomes really dangerous:
- The zero day vulnerability is exploited for massive hacking.
- It is sold on the Dark Web or to companies like Zerodium, which pay up to millions of dollars for them.
- They are sold to governments or state hackers for use in covert operations. Are you familiar with the Israeli spying tool Pegasus?
The greatest danger is that these attacks can go undetected for years.
Only when the developer releases a security patch fixing the flaw does zero day cease to be zero day.
Herein lies the importance of defense in depth or the art of creating a layered defense (like a paranoid billionaire).
To understand this concept, let’s use a film analogy:
Imagine you are a multimillionaire who protects his mansion with:
- A 4-meter wall with concertinas.
- Guard dogs patrolling the garden.
- Armed guards 24/7.
- Thermal cameras and motion sensors.
- Armored doors and a panic room with an arsenal.
The result? A thief would need to bypass multiple layers of security.
Even if he jumps the wall or bribes a guard, the other barriers would stop him.
How to translate this to the digital world (without needing millions)?
With defense in depth based on interposing layers full of** technical and practical measures**:
- Updated Router: With automatic patches to close vulnerabilities.
- Secure Wi-Fi: Using WPA3 and strong passwords.
- Network segmentation: With VLANs to isolate critical devices (e.g. IoT devices in a separate network different from the one used by the rest of the family).
- Antivirus + Firewall + IDS/IPS: To detect, filter suspicious traffic and block intrusions.
- Constant updates: Patch all devices, not just the PC. (Even the plug or Wi-Fi bulb must be updated).
- Encryption: whenever possible, use reputable VPNs.
With these layers, even if a zero day bypasses the firewall (like the guard who fell asleep!), the attacker will run into the IDS, antivirus, VLANs or encryption.
No single layer is infallible, but together they are unstoppable.
Zero days are the favorite ammunition of cybercriminals.
Defense in depth does not prevent all attacks, but:
- Reduce the impact: A ransomware in an isolated VLAN will not infect the entire network.
- Save time: Detect anomalies before they escalate (e.g., IDS alerts for strange traffic).
- Mitigates human error: If an employee clicks on a phishing phish, the firewall will block malicious connections.
Conclusion: Don’t build walls, build fortresses.
Defense in depth is not a luxury for millionaires: it is accessible to anyone.
With simple layers - upgrades, network segmentation, strong passwords - you make your system a difficult target, even for the dreaded zero days.
Every barrier counts! ๐
Principle of Limiting the Exposure Surface
This last fundamental cybersecurity principle, known as “limiting the area of exposure,” raises an uncomfortable question:
do you really need all the features and apps you have activated?
Listen to this advice:
fewer applications = more security
As we have already seen, hackers not only exploit bugs in the software, but also in its configuration.
If applications can become a problem, the logic is simple: the fewer apps installed, the lower the risk.
And although it may seem obvious, few apply it.
Everyday (and dangerous) example: Imagine cell phones.
Many users suffer from a “digital Diogenes syndrome”: they install dozens of free apps “just in case” they need them one day, even though 90% of them are only used once a year.
Worse yet: each app is a master key that can open doors to features such as:
- Sending messages and location
- Access to microphone or camera
- Connections to external servers
** ๐ Technical Key:** To understand the risk, we first need to explain what TCP/IP ports are.
I am going to explain TCP/IP explained with pizzas (yes, pizzas):
- IP Address = Your building’s street number
- Port = Apartment number within the building
A device (building) can have up to 65,535 “virtual apartments”(ports) for network communication.
These are classified as follows:
- Ports 0-1023: The “VIP” ports reserved for critical services (e.g. port 80 for HTTP websites).
- Ports 1024-49151: Semi-private area for registered apps.
- Ports 49152-65535: “Free” area for user programs, such as your messaging app or your game.
The combination IP + port =*** socket***which is the mandatory and necessary channel for any network communication.
And here’s the problem: every installed app opens sockets as if it were handing out copies of your keys.
๐จ The invisible danger: An outdated application is already a big risk, but if it also has open ports, it becomes an unclosed window for hackers.
Tools such as **Nmap **scan networks to find exactly these vulnerabilities.
So let’s look at 3 golden rules (that almost nobody follows):
- Uninstall zombie apps: If you haven’t used it in 3 months, delete it - your phone is not a junk room!
- Always update: 60% of attacks exploit bugs in obsolete versions.
- Close ghost ports: Disable unnecessary services - do you use Remote Desktop on your Windows or bluetooth on your mobile? If not, disable it and seal that port or connection.
In summary, although different techniques and security tips to protect our digital life will be explained in different articles, by simply following the three basic security principles explained in this article, the reader can be convinced that the vast majority of the attacks they suffer will not be successful, hence the importance of prevention by putting these principles into practice.