Ravi Sir's Cyber Security Cards › Interview Cards
What is NTLM and why do defenders still care?
What is NTLM and why do defenders still care? NTLM is an older Windows login method still used in some compatibility paths. It has known relay and hash-theft problems in attacker playbooks. “I reduce NTLM where I can and monitor where it’s still used.” Old NTLM paths are a quiet way for attackers to
Read card text
What this card says
Short answer
NTLM is an older Windows login method still used in some compatibility paths.
Example
It has known relay and hash-theft problems in attacker playbooks.
Say it in the interview
“I reduce NTLM where I can and monitor where it’s still used.”
Why it matters
Old NTLM paths are a quiet way for attackers to steal or reuse credentials.
Learn more in the lesson: 47.5 Identity Attacks Awareness (Kerberos / PTH – defensive talking points only)