Windows OS Security: Password and Credential Protection

Course details

Are you looking to learn more about securing your Windows environment? This course was designed for you. Join Windows security expert Paula Januszkiewicz as she provides a comprehensive exploration of password and credential security within the Windows operating system. Learn how to identify credential dumping techniques used by attackers, implement robust protection strategies using multifactor authentication and encryption, and securely manage secrets with the Windows Data Protection API (DPAPI). An ideal fit for intermediate- to advanced-level IT and cybersecurity professionals, this course also covers common credential-based attack vectors and offers strategies for detecting and mitigating these threats. With real-world examples and hands-on interactive labs, by the end of this course, you’ll be equipped with practical skills to protect Windows environments from credential-related vulnerabilities.

Learning objectives
Analyze credential dumping techniques used by attackers to extract sensitive information from Windows systems.
Design robust protection strategies incorporating multifactor authentication and encryption to secure Windows credentials.
Evaluate and implement secure password policies and management practices to prevent unauthorized access to Windows system credentials.
Apply the Windows Data Protection API (DPAPI) to securely store and retrieve user secrets within Windows environments.
Develop strategies to detect, mitigate, and respond to credential-based attacks using advanced tools and real-world scenarios.

Concepts

0. Introduction

01 - Password security in Windows OS
02 - Target audience and prerequisites

1. Introduction to Windows OS Credential Security

03 - Understanding the importance of credential security
04 - Overview of credential-based attacks
05 - Windows log-on architecture
06 - Windows security subsystems

2. Credential Dumping Techniques in Windows OS

07 - What is credential dumping
08 - Tools and techniques for credential dumping - CQSecretsDumper
09 - Tools and techniques for credential dumping - Web enrollment
10 - LSASS architecture and credential dumping
11 - SAM database and NTDS.dit extraction (DCsync)

3. Local and Domain Authentication in Windows OS

12 - Local vs. domain authentication
13 - Protecting local authentication credentials
14 - Safeguarding domain credentials
15 - Understanding NTLM authentication, Kerberos authentication, and NTLM relay

4. Password Management and Policy Enforcement

16 - Creating strong passwords
17 - Windows password policy settings
18 - Managing LSA secrets and gMSA accounts
19 - Secrets, credentials, and log-on data management

5. Windows Data Protection API (DPAPI)

20 - Understanding the Windows DPAPI
21 - Using DPAPI for protecting user secrets

6. Common Credential-Based Attack Vectors

22 - Phishing attacks and credential theft
23 - Brute force and dictionary attacks - NTDS.dit protection
24 - Lateral movement and credential theft - Basic password spray
25 - Pass-the-hash
26 - S4U2self privilege escalation
27 - Pass-the-ticket
28 - Kerberoasting and NTLM relay attacks
29 - DCShadow
30 - Golden ticket attacks
31 - Shadow credentials

7. Mitigating Credential-Based Threats - Detection and Response

32 - Detecting credential dumping attempts
33 - Responding to credential-based incidents
34 - Credential Guard and LSA protection
35 - Monitoring and analyzing AD infrastructure using PingCastle
36 - Certificates as credentials - Strong certificate mapping
37 - Certificates as credentials - Subject alternative name

Conclusion

38 - Course recap
39 - Applying knowledge in real-world scenarios