this is susan bradley for cso online active directory has been included in windows server
operating system since windows 2000 it's the foundation for many many businesses
it allows firms to authenticate and authorize all users and computers in a windows domain
group policy provides centralized management and configuration of operating systems
applications and user settings in an active directory environment it allows
administrators to set many security policies settings enforce certain actions preferences
in other words it allows firms to set standards in an organization it also allows attackers to
identify patterns in a network as well as use the features of group policy to gain more rights
i haven't joked that attackers know how to better manage and maintain our networks than we do
ourselves recently i spoke with darren mar elia vice president semperus who have known for many
years as guru group policy initially his focus was ensuring that it professionals used and understood
the power of active director and group policy but over time he's realized just like attackers have
that group policy allows you to silently gain more rights into a network and better attack an active
directory network in a recent microsoft security document they showcase that attackers don't
necessarily immediately launch attacks rather they gain initial access gain credential theft start
to do lateral movement persist in a network and in particular as you see right over there they do gpo
changes they want to make sure they stay in the network they hide in the network and make changes
so that they have more access and more rights in the system recently there was a public attack on
twitter that did the same kind of techniques they specifically targeted administrators took over
those roles and then made sure they had control over certain tasks and took over those duties
and functions darren talked about a number of parsing tools that allowed networks to determine
what policies in active directory were active and what policies are deployed tools like power split
are well known in the attacker community along with bloodhound and mimikats
they allow the attacker to better understand your network as well as review the relationships of
users and assets we often name our organizational units with very descriptive names that identify
what the group does and has rights to the attacker can wiggle in identify these organizational units
and start to evaluate who has rights who has asset rights and start to look at more
things in the network bloodhound in particular gives attacker key information to better target
and damage your firm the tool uses graph theory to identify relationships inside the network
with the tool you can identify the shortest attack paths and identify weak points in your environment
it allows you to see those places that you need extra attention as well as have a quantitative way
to evaluate possible mitigations or changes and compare your security posture between two points
in time microsoft even talked about talked about this in basal loader that once the attackers gain
credentials for domain administrator accounts or other highly privileged accounts they often stage
a ransomware payload on a domain controller using ps exec or group policy in several attacks they
replayed ransomware in a variant known as darren talked a couple of times about how ransomware
attacks uses various techniques such as inserting the ransomware into the ad logging script
affecting anyone who logged into the adc server they also observed that the cis fall share on an
active directing domain controller was infected and used to propagate throughout the environment
attacking the cis falls share typically requires elevated privileges and
indicates a very serious ad compromise one of the key ways you can better protect your network
is to audit and review who has the ability to edit and link to group policy objects
too often in organizations we don't segregate and protect our administrative assets we don't flag an
audit when group policy changes are made if you have not already done so i urge you to set up
ds objects and file system auditing and make sure you have this set up on your domain controller
in those audit policies you want to click on ds access and set up that logging you
want to make sure that you're alerted when someone's elevated to a domain
administrator that's a very specific action you need to be alerted when that happens you also
need to be alerted when app locker protection is changed that's not a normal process that normally
goes through a change management process you need to make sure that you have alerts in place
so that when those two events in particular occur that you're immediately notified
darren and i also talked about the impact of ransomware on how firms set up protection
and backups too often especially with domain controllers we consider that another domain
controller in the environment is the proper backup for domain controller there's not an
offline backup made we consider domain controllers to be expendable and recoverable yet the infamous
ransomware attack maersk network they had no viable recovery of their active
director and domain structure other than an offline domain controller in a remote
location they literally had to physically bring a solitary clean domain controller
back into the network to recover the domain so think about that think about when and not if you
will get hit with some sort of ransomer or some other attack that goes after your credentials
do you have the necessary tools and techniques to first determine when changes were made inside your
active directory infrastructure and two recover your domain controller or other domain information
without rein introducing the infection or can you recover to alternative infrastructure
do you have the answers to those questions if you don't it's time to step back and say hmm
i need a recovery plan i need to know that should my active directory totally burn to the ground
i can rebuild it i can recover it you don't want to be like mirrors can have to spend weeks
recovering that domain structure so remember when it comes to your active directory infrastructure
make sure attackers are not using it better than you are make sure there's logging make sure you
know who has access to add organizational units make adjustments to group policy and get immediate
notifications when changes are made until next time this is susan bradley for cso online
see you online at the youtube channel at igg tech talk until the next time stay safe stay
secure you