Cyber Defense eMagazine December Edition for 2021

Getting Started with Active Directory Security
Evaluating, Benchmarking and Creating a Strategy
By Justin Kohler, Director of BloodHound Enterprise, SpecterOps
Over 90% of the Fortune 1000 use Microsoft Active Directory (AD) for identity and access management.
This ubiquity makes AD a prime target for attackers because compromising it almost always gives them
the access they need to achieve their goals. Additionally, attackers can compromise AD easily by
manipulating common errors in user identity and privilege.
Consider this scenario: An attacker gets an employee’s credentials through a phishing attack. That user
is a member of the “Help Desk” security group in AD with a low level of privilege. But the Help Desk group
has been nested inside another group that has privileges over a PCI server. Our hypothetical employee
is not supposed to have control over that server, but the group nesting has given them privilege over it
accidentally. That server also has a service account logged in, and it’s simple for an attacker to steal
those credentials now that they have control over the server. That service account happens to have the
“Add Member” privilege to the Domain Administrators group, so now the attackers can make themselves
a domain admin. This chain of steps that allows an adversary to escalate privilege and move laterally
through Active Directory is an example of an Identify Attack Path (referred to as “Attack Path” for the rest
of this article). Multiple Attack Paths just like this exist in nearly every environment my colleagues and I
examine.
Improving AD security to prevent these attacks requires IT Operations, Security Operations, and Identity
and Access Management (IAM) teams to work together since each owns a portion of securing AD. A
successful strategy must 1) be understandable and defensible to management, 2) give practical solutions
that can realistically be implemented by AD administrators, 3) be measurable so that the organization
can track progress over time, and 4) cannot require changes that greatly interfere with normal business
operations.
Cyber Defense eMagazine – December 2021 Edition 130
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.