5 Facts You Must Know about Active Directory Privilege Escalation

Folks,

Last month, we declassified the #1 cyber security risk to Active Directory deployments - Active Directory Privilege Escalation.

Active Directory Privilege Escalation based on identification and exploitation of unauthorized access grants in Active Directory deployments.

Today, I wanted to share with you 5 things that we all must know about Active Directory Privilege Escalation –

#5 – Domain Admin accounts only account for 1% of the attack-surface. Accounts of delegated admins, executive and regular employees, and all other Active Directory content (i.e. all group memberships, GPOs, OUs etc. ) accounts for 99% of the attack surface

#4 – We may not know it or realize it yet, but most Active Directory deployments worldwide are currently exposed to this risk today. In fact, most domain user and computer accounts, domain security groups, GPOs, OUs, SCPs etc are potentially at risk of compromise.

#3 – This risk is far more damaging and easier to carry out than even the risk posed by the Pass-the-Hash (PtH) attack vector, because unlike Domain Admins, the likelihood of a non-admin user logging on to the attacker’s machine is quite low. (Consider this - what is the likelihood that your organization's CEO will logon to your machine, whether for legitimate reasons, or even if social engineered into doing so?)

#2 – This risk exists because Active Directory lacks the ability to help IT personnel precisely assess and verify provisioned access. Active Directory does let us precisely provision access, but it is unable to help us precisely assess/verify/audit effective provisioned access.

#1 – The presence of an Auditing solution does nothing whatsoever to mitigate this risk. It merely helps detect its occurrence. By the time an associated event shows up in the audit log, it is already too late, because the damage has been done. (E.g. - if a malicious entity has been able to reset a Domain Admin's password, or the CEO's password, even though the event may show up in the audit log, by the time you react to it, the damage is already done.)

In days to come, I will share with you how organizations can assess whether they're at risk, and how they can mitigate this risk.

For now, perhaps its worth asking yourself a simple question – “Do we know exactly who can do what in our Active Directory, especially in light of the fact that anyone with a domain user account can find this out on any object within minutes?”

Best wishes,
Sanjay

PS: This is a very simple and fundamental problem that stems from the lack of verifiable implemented least privilege access (LPA) in a major foundational technology. Frankly, I’m really surprised that over 80% of organizations worldwide still do not realize this simple fact! The only thing more concerning is that based on our intelligence, the Chinese have most likely already figured this out.

Active Directory Security - A Top Cyber Security Priority Today

Folks,

As you may know, today Active Directory is at the very foundation of enterprise security and cyber security worldwide.

Given Active Directory's foundational role in enterprise security worldwide, based on the principle of adequate protection, it is only logical that the security of the Active Directory itself is paramount to organizational security worldwide.

As logical as it may sound, based on what we have seen in our vast experience over the last decade, we are deeply concerned to see that most organizations today across the world do NOT yet realize just how important Active Directory security really is.

I suppose the only thing more concerning is that not only do so many organizations not realize this yet, they also do not seem to possess the level of technical skill-set and expertise that is required to adequately protect their underbelly.

(You'd be surprised if we told you just how many government agencies are still looking for mere account lockout status tools.)

In addition, so many organizations believe that the presence of an Active Directory auditing solution is generally sufficient to provide adequate security for Active Directory because it can help them audit the enactment of a malicious task.

Little do they realize that auditing is merely a reactive security measure, that at best, aids in potentially detecting the occurrence of a malicious action and determining the identity of the perpetrator. The key word here is REACTIVE. The fact that the occurrence of a malicious task showed up in an audit log indicates that the malicious task has already been performed.

The keyword here is ALREADY. In such a situation, although auditing could potentially help identify the perpetrator, depending on the perpetrator's skill, the opportunity to enact a single malicious task could be (/have been) sufficient to inflict substantial, and often irreversibly damage to not just the Active Directory, but the entire Windows Server based IT infrastructure. (The first thing a smart perpetrator would do is disable all the admin accounts so no one can even login to try and stop him/her.)

The point is that the presence of any one single security measure such as reactionary auditing, is hardly sufficient to provide adequate security for an Active Directory deployment. Providing adequate security for Active Directory requires and involves the presence of numerous procedural, policy and technical security controls, that work together to provide adequate protection.

So many organizations today seem to be substantially deficient in providing adequate protection for their Active Directory deployments, and the #1 reason for this is that Active Directory security does not appear to be a high enough priority for them.

Thus, in the best interest of all organizations, we've put together a simple succinct document that unequivocally communicates the importance of protecting foundational Active Directory deployments. You can download it by clicking the image below, or clicking here.

 

The Importance of Active Directory Security

 

We do hope that this simple document helps organizations unequivocally understand just how important the security of their foundational Active Directory is to their security, and in their own best interest, ensure its adequate protection at all times.

As the very foundation of enterprise security worldwide, Active Directory security is not just important, it is paramount.

What else could be more important?

Best wishes,
Sanjay