Cyber Defense eMagazine December Edition for 2021

How can this strategy be implemented? Let’s look at a practical, actionable approach to securing AD
security with these four steps:
Step One: Define High-Value Assets
First, think like an adversary and focus on what they’ll focus on. Define the high-value assets in Active
Directory that most attackers will target. A great place to start is the objects in Active Directory that enable
full control over the domain. Commonly referred to as “Tier Zero” or “Control Plane” in Microsoft’s new
Enterprise Access Model, these include the Domain, Enterprise, and Schema Admins, and Domain
Controllers groups, plus the domain head object, and applicable group policies. Adversaries want to get
privilege on these assets because they enable additional access required to accomplish their objectives.
IT may also consider including other critical systems that would have a significant payoff for attackers,
such as privileged access management (PAM) solutions.
Step Two: Map Attack Paths
Next, map out all of the ways an adversary could compromise those high-value assets. Unfortunately,
AD’s interface and built-in tooling do not provide the necessary visibility to audit privilege effectively. This
lack of visibility makes it very difficult to see users’ privileges, which groups they are members of, etc.,
which causes Attack Paths to build up over time. Surfacing these paths will require specialized tools like
BloodHound (an open-source Attack Path mapping tool), which gives visibility into AD to map out how
attackers can use misconfigurations to control high-value assets.
Step Three: Start with Critical Paths
An enterprise AD environment can easily have tens of thousands of potential Attack Paths. For an AD
security plan to be practical, it must prioritize which ones to fix first. Without the ability to measure the
exact risk of each path in your environment, two manageable areas present a significant risk to any
environment. 1) attack paths from large groups in the environment to critical assets and 2) Kerberoastable
critical assets. Here is a full explanation of how to find and fix these specific issues.
These two areas represent a significant risk because each may be executed by effectively any member
of the organization through the use or abuse of AD configurations. Another area the security or IAM team
may consider reviewing is any permissions granted to the large default groups such as Domain Users,
Authenticated Users, or Everyone. These permissions can create large beachheads for attackers to move
laterally within the environment, even if they don’t grant full access through a critical asset.
Cyber Defense eMagazine – December 2021 Edition 131
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.