Cyber threats are growing more sophisticated, and attackers are increasingly exploiting
weaknesses that traditional vulnerability scanners simply aren’t designed to catch. In our recent
webinar, “Beyond Vulnerability Scanners: 10 Ways Attackers Exploit Healthcare Networks,” we
explored these blind spots and how adversaries take advantage of them. Watch the full webinar
here.

This blog post breaks down the top ten vulnerabilities discussed during the session, along with
actionable strategies your organization can use to close security gaps and harden your network
defenses.

1. Weak Passwords and Password Reuse
   Weak and reused passwords, especially in service accounts or legacy systems lacking two-
   factor authentication (2FA), are prime targets. According to Verizon’s DBIR, over 80% of
   breaches involve compromised credentials. Passwords like keyboard walks (Qwerty123!) are
   easily guessable yet frequently used.
   
   To reduce this risk:
   
   • Regularly audit passwords and utilize password cracking exercises.Implement Group Managed Service Accounts to automate password rotation.
   
   
2. Active Directory Certificate Abuse
   Misconfigured Active Directory certificate templates allow attackers to request certificates
   impersonating highly privileged users. Tools like Certify and CertiPy quickly identify vulnerable
   templates.
   
   Immediate action:
   • Regularly audit certificate template permissions.Restrict permissions strictly to essential accounts only.
   
   
3. Kerberoasting
   Attackers exploit weak passwords associated with Service Principal Names (SPNs) to retrieve
   hashes for offline password cracking, directly threatening Active Directory security.
   
   Recommendations:
   • Regularly review accounts with SPNs to minimize exposure.
   • Use strong passwords or Microsoft’s Group Managed Service Accounts.
   
   
4. Sensitive Data on Network Shares
   Sensitive data like PHI or system credentials often resides unnoticed on network shares.
   A free tool, Snaffler, can help quickly identify this exposure.
   
   Actions:
   • Regularly audit network shares.Remove or encrypt sensitive data promptly.
   
   
5. Internal Web Application Vulnerabilities
   Healthcare networks often host numerous internal web applications, many of which are
   unnoticed and insecure. Use tools like GoWitness to visualize web applications, and consider
   specialized assessments using tools like Burp Suite Professional.
   
   Steps:
   • Regularly identify and disable unnecessary web services.Conduct frequent, targeted web application assessments.
   
   
6. Active Directory Permission Misconfigurations
   Misconfigured permissions in Active Directory, such as excessive access via the ‘Everyone’
   group or improperly disabled accounts, pose significant risks. Tools like BloodHound and our
   custom-developed tool, AD Recon, provide detailed visibility into complex permission
   structures.
   
   Recommendations:
   • Conduct detailed Active Directory audits using tools like BloodHound and AD Recon.Regularly review disabled accounts and their permissions
   
   
7. Relay Attacks (SMB and LLMNR Poisoning)
   Common misconfigurations, like disabled SMB signing, allow attackers to intercept and relay
   authentication requests. Use Responder in analyze mode to safely identify vulnerable
   configurations.
   
   Mitigation:
   • Enforce SMB signing across your environment.Disable unnecessary protocols like LLMNR.
   
   
8. Default Credentials and Configurations
   Default credentials remain a pervasive issue, often found in IoT devices, printers, and legacy
   systems. Tools like Default HTTP Login Hunter help identify default credentials.
   
   Essential actions:
   • Regularly audit and change default credentials.Ensure rigorous device and system configuration management.
   
   
9. Lack of Effective Detection Capabilities
   Many organizations rely heavily on endpoint protection, leaving internal network monitoring overlooked. Common attacker techniques like DC Sync or Kerberoasting often go unnoticed.
   
   Recommendations:
   • Implement comprehensive network monitoring solutions.
   • Develop specific alerts for common attack techniques.
   
   
10. Weak Password Reset Procedures
    Social engineering remains highly effective, especially through weak help desk password reset
    processes. Attackers frequently exploit overly trusting help desk procedures.
    
    Immediate steps:
    • Implement and regularly test robust verification processes for password resets.Conduct frequent awareness and procedural training for help desk staff.
    
    

Key Takeaways

By understanding and addressing these ten common overlooked risks, organizations can
significantly strengthen their security posture beyond traditional vulnerability scanning. These
actionable insights offer a proactive path to defending your network and safeguarding sensitive
data from sophisticated attackers.

Stay tuned for follow-up content where we will dive deeper into the practical use of the tools
mentioned in the webinar.