Cyber Defense eMagazine December Edition for 2021
Will you stay one step ahead of Cyber Scrooge this year? Learn new ways to protect your family, job, company & data. December Cyber Defense eMagazine: Cyber Deception Month is here...Defeat Cyber Scrooge! Cyber Defense Magazine December Edition for 2021 in online format #CDM #CYBERDEFENSEMAG @CyberDefenseMag by @Miliefsky a world-renowned cyber security expert and the Publisher of Cyber Defense Magazine as part of the Cyber Defense Media Group as well as Yan Ross, US Editor-in-Chief, Pieruligi Paganini, International Editor-in-Chief and many more writers, partners and supporters who make this an awesome publication! Thank you all and to our readers! OSINT ROCKS! #CDM #CDMG #OSINT #CYBERSECURITY #INFOSEC #BEST #PRACTICES #TIPS #TECHNIQUES See you at RSA Conference 2022 - Our 10th Year Anniversary - Our 10th Year @RSAC #RSACONFERENCE #USA - Thank you so much!!! - Team CDMG CDMG is a Carbon Negative and Inclusive Media Group.
Will you stay one step ahead of Cyber Scrooge this year? Learn new ways to protect your family, job, company & data. December Cyber Defense eMagazine: Cyber Deception Month is here...Defeat Cyber Scrooge!
Cyber Defense Magazine December Edition for 2021 in online format #CDM #CYBERDEFENSEMAG @CyberDefenseMag by @Miliefsky a world-renowned cyber security expert and the Publisher of Cyber Defense Magazine as part of the Cyber Defense Media Group as well as Yan Ross, US Editor-in-Chief, Pieruligi Paganini, International Editor-in-Chief and many more writers, partners and supporters who make this an awesome publication! Thank you all and to our readers! OSINT ROCKS! #CDM #CDMG #OSINT #CYBERSECURITY #INFOSEC #BEST #PRACTICES #TIPS #TECHNIQUES
See you at RSA Conference 2022 - Our 10th Year Anniversary - Our 10th Year @RSAC #RSACONFERENCE #USA - Thank you so much!!! - Team CDMG
CDMG is a Carbon Negative and Inclusive Media Group.
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
How can this strategy be implemented? Let’s look at a practical, actionable approach to securing AD<br />
security with these four steps:<br />
Step One: Define High-Value Assets<br />
First, think like an adversary and focus on what they’ll focus on. Define the high-value assets in Active<br />
Directory that most attackers will target. A great place to start is the objects in Active Directory that enable<br />
full control over the domain. Commonly referred to as “Tier Zero” or “Control Plane” in Microsoft’s new<br />
Enterprise Access Model, these include the Domain, Enterprise, and Schema Admins, and Domain<br />
Controllers groups, plus the domain head object, and applicable group policies. Adversaries want to get<br />
privilege on these assets because they enable additional access required to accomplish their objectives.<br />
IT may also consider including other critical systems that would have a significant payoff <strong>for</strong> attackers,<br />
such as privileged access management (PAM) solutions.<br />
Step Two: Map Attack Paths<br />
Next, map out all of the ways an adversary could compromise those high-value assets. Un<strong>for</strong>tunately,<br />
AD’s interface and built-in tooling do not provide the necessary visibility to audit privilege effectively. This<br />
lack of visibility makes it very difficult to see users’ privileges, which groups they are members of, etc.,<br />
which causes Attack Paths to build up over time. Surfacing these paths will require specialized tools like<br />
BloodHound (an open-source Attack Path mapping tool), which gives visibility into AD to map out how<br />
attackers can use misconfigurations to control high-value assets.<br />
Step Three: Start with Critical Paths<br />
An enterprise AD environment can easily have tens of thousands of potential Attack Paths. For an AD<br />
security plan to be practical, it must prioritize which ones to fix first. Without the ability to measure the<br />
exact risk of each path in your environment, two manageable areas present a significant risk to any<br />
environment. 1) attack paths from large groups in the environment to critical assets and 2) Kerberoastable<br />
critical assets. Here is a full explanation of how to find and fix these specific issues.<br />
These two areas represent a significant risk because each may be executed by effectively any member<br />
of the organization through the use or abuse of AD configurations. Another area the security or IAM team<br />
may consider reviewing is any permissions granted to the large default groups such as Domain Users,<br />
Authenticated Users, or Everyone. These permissions can create large beachheads <strong>for</strong> attackers to move<br />
laterally within the environment, even if they don’t grant full access through a critical asset.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>December</strong> <strong>2021</strong> <strong>Edition</strong> 131<br />
Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.