Cyber Defense eMagazine March Edition for 2022
The view from the Publisher’s desk is very encouraging, based on celebrating 10 years of growth and success at Cyber Defense Magazine! When our tiny team began our journey at Cyber Defense Media Group (CDMG) together in January 2012, we were happy to help smaller, lesser-known innovators of infosec, get their message out there and Rise Above the noise. Now, after 10 years, we’re even helping multi-billion-dollar companies and governments around the globe with our offices in DC, London, FL, NY and other locations in play, as we continue to scale, thanks to you – our readers, listeners, viewers and media partners. Beyond the magazine, in response to the demands of our markets, the scope of CDMG’s activities has grown into many media endeavors. They now include Cyber Defense Awards; Cyber Defense Conferences; Cyber Defense Professionals (job postings site being revamped); Cyber Defense TV, Radio, and Webinars; and Cyber Defense Ventures (partnering with investors). Please check them out and see how much more CDMG has to offer! Very respectfully and with much appreciation, Gary Miliefsky, Publisher
The view from the Publisher’s desk is very encouraging, based on celebrating 10 years of growth and success at Cyber Defense Magazine! When our tiny team began our journey at Cyber Defense Media Group (CDMG) together in January 2012, we were happy to help smaller, lesser-known innovators of infosec, get their message out there and Rise Above the noise. Now, after 10 years, we’re even helping multi-billion-dollar companies and governments around the globe with our offices in DC, London, FL, NY and other locations in play, as we continue to scale, thanks to you – our readers, listeners, viewers and media partners. Beyond the magazine, in response to the demands of our markets, the scope of CDMG’s activities has grown into many media endeavors. They now include Cyber Defense Awards; Cyber Defense Conferences; Cyber Defense Professionals (job postings site being revamped); Cyber Defense TV, Radio, and Webinars; and Cyber Defense Ventures (partnering with investors).
Please check them out and see how much more CDMG has to offer!
Very respectfully and with much appreciation,
Gary Miliefsky, Publisher
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
systems to manage identity and access: Azure Active Directory, Azure Resource Manager, and the Azure<br />
API Apps permissions system. Un<strong>for</strong>tunately, these systems can often conflict and make it unclear which<br />
system is the source of truth. This makes it more difficult <strong>for</strong> security teams to audit who has access to<br />
valuable systems, which in turn makes it harder <strong>for</strong> them to find and close down Attack Paths.<br />
The more difficult it is to assign permissions, the more likely that Cloud or AD engineers will give blanket<br />
permissions to large groups of users or give a problem user admin access to just make everything work.<br />
After all, their main task is to ensure employees have access to the systems they need to do their jobs.<br />
This complexity creates additional attack paths and undermines the expertise of security and Identity<br />
Access Management engineers.<br />
4. Attacks can move from Azure to on-prem AD<br />
Attack Paths in AD don’t just stay on-premise or in the cloud; they can cross between environments. For<br />
example, adversaries can move laterally from on-premise AD to Azure AD, escalate privilege within<br />
Azure, and then move back from Azure to on-premise. They can do this by abusing Microsoft Endpoint<br />
Manager to move laterally from an Azure tenant to an on-prem AD domain. This abuse becomes possible<br />
when Windows devices have been Hybrid-Joined to both the Azure tenant and the on-prem Active<br />
Directory domain. This attack can be carried out by Azure tenant authenticated user — no special<br />
privileges or roles needed. Abusing one of the three endpoint management systems to execute<br />
PowerShell scripts on hybrid-joined devices requires either the “Global Admin” or “Intune Administrator”<br />
roles. This is why it’s vital to protect Active Directory both on-premises and in the cloud - because both<br />
of them give attackers a way in.<br />
5. Attack Paths open orgs up to dangerous attacks like ransomware<br />
Attack Paths are a way <strong>for</strong> adversaries to get powerful access that lets them steal sensitive data, deploy<br />
ransomware or other malware, achieve persistence in the network or add backdoors that will allow them<br />
to instantly re-gain privileged access in the future. An adversary that is well versed in attacking AD (and<br />
most adversaries are) can gain privileges and move freely across Attack Paths leaving minimal risk of<br />
discovery from defenders, achieve persistence, and gain the keys to the kingdom. Ransomware is a<br />
particularly active threat at the moment; approximately 37% of global organizations said they were the<br />
victim of some <strong>for</strong>m of ransomware attack in 2021, according to IDC's "2021 Ransomware Study." The<br />
FBI's Internet Crime Complaint Center received 62% more ransomware reports year-over-year in the first<br />
half of 2021. To reduce their vulnerability to all these attacks and stop problems like ransomware at their<br />
source, organizations should work on eliminating the Attack Paths in their AD environment.<br />
Identity and access management on-premises and in the cloud are two sides of the same coin.<br />
Organizations with a hybrid infrastructure model must protect both in order to keep their users and data<br />
safe.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>March</strong> <strong>2022</strong> <strong>Edition</strong> 69<br />
Copyright © <strong>2022</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.