Detecting and Mitigating Password Spraying Attacks on NetScaler Gateway
Andrew Scott
![Andrew Scott]()
Andrew Scott
NetScaler Pre-Sales Specialist - Trying to make the complex stuff accessible to all. Talks about #NetScaler #Application Security #Loadbalancing #Cloud
Hello everyone
One of the themes of 2024 is an increasing prevalence of brute force password attacks on the typical remote access solutions. Jaskirat posted a blog on the subject last week, you can read his article here, which I did share last week.
There has been a new article with some clever use of maps posted by Steven Wright last night. Full blog post is here. It is very detailed.
I posted a summary document in June which covered some of the options available to an administrator, the link is here
Have a good day!
NetScaler Pre-Sales Specialist - Trying to make the complex stuff accessible to all. Talks about #NetScaler #Application Security #Loadbalancing #Cloud
2 个月Wow, the longest comment in history! A webinar might be in my wheelhouse…thanks for this btw.
Business / Solutions Architect
2 个月In the world of the NetScaler, documentation, education content, and people focus on a feature or an action. In this case and by no means limited is the action to go to an Auth server / system. With Auth being one of the first steps. The next step is usually a session action. The power of NetScaler is not in the various actions. The power is in the expression or rule. This is getting to be known as conditional access. This is a very long conversation I have had regularly over time in all my training sessions. It is also the place most people fall asleep with the complexity. The policy expression or rule of ns_true or true works and is generally presented in training and documentation. This rule means any (any traffic) , in the case of auth , it means send everything to the auth server. This is a basic allow scripts, to hammer an auth system. The fall back has been well set up MFA. Short answer is build an expression that meets the access requirements. The first step is limiting based on application. This is the difference between a powershell app or a browser. The more detailed on what type of traffic goes to the action the lower the attack surface area is. Maybe Andrew can setup an event.