Monday to Friday 9:00 – 5:00    |    Call us +44 (0)1530 414 409

 

Insights

02 Oct 7 Hidden IT Risks Lurking in Your Network

Posted at 12:16h in Insights

Cyber threats evolve daily. Across the East Midlands — Nottingham, Derby, Leicester, Lincoln and Northampton — SMEs are being targeted by credential theft, lateral movement and outdated configurations. Digital Office Group helps you discover hidden risks, prioritise fixes, and harden your environment without slowing the business.

7 Hidden IT Risks Lurking in Your Network

What we typically uncover first during reviews in the East Midlands

1) Weak & Reused Passwords

Seasonal/guessable passwords and reuse across systems make credential stuffing trivial.

  • Missing MFA on email/VPN/admin
  • No password manager or policy controls

2) Roastable AD Service Accounts

Kerberoasting / AS-REPRoasting retrieves hashes for offline cracking.

  • Static passwords on service accounts
  • Excessive privileges; no rotation

3) Loose SQL Server Config

Defaults enable credential relays and privilege escalation.

  • Risky procedures exposed to Public
  • SQL services running with domain admin

4) Missing SMB Signing

Allows relay & man-in-the-middle attacks on Windows networks.

  • No enforced SMB signing via GPO
  • Legacy endpoints still in use

5) Legacy/Insecure Protocols

SMBv1, NTLMv1, old discovery protocols leak credentials.

  • Printer/scanner shares using obsolete auth
  • Old NAS devices and IoT left unpatched

6) Weak DC & Auth Policies

Old LAN Manager settings & NTLM fallback enable cracking/relay.

  • Unconstrained delegation in the domain
  • Unsigned LDAP; lax password policy

7) The Forgotten krbtgt Account

If compromised, attackers can mint “golden tickets” and persist indefinitely.

  • Never rotated; no breach runbook
  • Insufficient AD auditing & alerting

Quick Diagnosis: Are You at Risk?

Five yes/no checks you can run this week

  1. Is MFA enforced for email, VPN, and all admin accounts?
  2. Do service accounts use gMSA or at least rotating long passphrases?
  3. Is SMB signing required via GPO on clients and servers?
  4. Have you disabled SMBv1/NTLMv1 and audited legacy devices?
  5. Can you prove the krbtgt password was rotated in the last 12 months?

How Digital Office Group Mitigates These Risks

Pragmatic controls that balance security with productivity

Identity & Access

  • MFA everywhere (email, VPN, admin)
  • Password manager rollout + policy
  • Privileged Access Management basics

Active Directory Hardening

  • gMSA migration for service accounts
  • Secure LAN Manager/NTLM policy
  • DC baseline & AD auditing

Server & Data

  • SQL hardening & least privilege
  • Patch orchestration & reporting
  • Secure backups with immutability

Network Protection

  • Enforce SMB signing via GPO
  • Disable legacy protocols
  • Segmentation for high-risk devices

User Resilience

  • Phishing simulation & bite-size training
  • Joiners/movers/leavers automation
  • Clear incident reporting paths

Governance & Continuity

  • Risk register & remediation roadmap
  • DR runbooks & recovery testing
  • ISO 27001-aligned processes

Mini Case Study: Leicester Manufacturing SME

From frequent credential prompts to a hardened, documented environment

Challenges

  • Service accounts with stale passwords
  • SMB signing disabled
  • Legacy scanners using NTLMv1

What We Did

  • gMSA migration + privileged review
  • GPOs to enforce SMB signing
  • Replaced legacy protocols & devices

Outcomes (90 days)

  • Reduced attack surface by 62%
  • Faster logon and fewer prompts
  • Documented DR & security runbooks

FAQs

Quick answers to common questions from East Midlands organisations

How long does an IT Review take?

Typically 1–2 weeks end-to-end, including discovery, analysis, and a prioritised action plan.

Will this disrupt our users?

No. Reviews run in the background. Changes are scheduled and communicated to minimise downtime.

Do you cover our locations?

Yes — Nottinghamshire, Derbyshire, Leicestershire, Lincolnshire, Northamptonshire and nearby.

Are you ISO-accredited?

Digital Office Group operates with ISO 27001 practices and documented controls.

Book an IT Security Review

Get a clear risk snapshot, a prioritised remediation roadmap, and quick wins you can deliver this month — without derailing BAU.

Book Now

Serving Nottingham, Derby, Leicester, Lincoln, Northampton and the wider East Midlands.