The Top-5 Cyber Security Risks to Active Directory Deployments (Day-5)

Dear Microsoft,

Today is Day-5 of our advanced Active Directory Security school for you. Since you've been busy trying to address risks posed by credential-theft attacks, and making paradigm shifts, you may likely have forgotten about the top risks to Active Directory.

So, today, I'll educate you about the Top-5 security risks that most Active Directory deployments are likely vulnerable to today.



The Top-5 Security Risks to Active Directory Deployments

The following are the Top 5 security risks that most Active Directory deployments are likely exposed to today -

1. The complete and instant compromise of the credentials of all domain user accounts, including those of all privileged users, enactable via Mimikatz DCSync, by any intruder/insider that has sufficient effective permissions to replicate secrets from Active Directory.


2. The complete and instant compromise of all default Active Directory privileged user accounts and groups, enactable via any AD mgmt. tool, by any intruder/insider that has sufficient effective permissions on the AdminSDHolder object.


3. The complete and instant compromise of most* IT assets stored in Active Directory, enactable via any AD mgmt. tool, by any intruder/insider that has sufficient effective permissions, resulting from wide-scoped insecure inheritable permissions.


4. The complete and instant compromise of all Domain Controllers in the domain, enactable via any AD mgmt. tool, by any intruder/insider that has sufficient effective permissions to link a malicious GPO to the default Domain Controllers OU.


5. The complete and instant compromise of specific IT assets stored in Active Directory, such as the CEO's user account, enactable via any AD mgmt. tool, by any intruder/insider that has sufficient effective permissions to do so.

[ Sufficient reasoning for what makes these risks the top 5 risks, as well as technical details, are furnished below. ]

It is vital to understand that a SINGLE occurrence of risks #1, #2 and #4 above (, and depending on the target, also of risks #3 and #5) could result in the compromise of the ENTIRE Active Directory deployment. This fact CANNOT be overstated enough.




But First, 5 Notable Points About These 5 Risks

Organizations that care about their foundational security may find the following points interesting to note -

1. Not a single one of these risks either requires or involves the use of any credential-theft technique (such as Pass-the-Hash, Kerberos Golden Tickets etc.) and none of these band-aids can prevent an attacker from enacting these risks.


2. Not a single one of these risks requires the attacker to compromise any computer whatsoever i.e. he/she need not compromise even a single Domain Controller, admin workstation, member server, employee laptop etc.


3. Not a single one of these risks requires the attacker to have physical or system access to even a single Domain Controller, data center, admin workstation, or for that matter even a single copy of an Active Directory backup.


4. Not a single one of these risks requires the attacker to possess tooling that is not freely available. Microsoft's native Active Directory management tools, and Mimikatz DCSync, all of which are freely available, are amply sufficient.


5. Not a single one of these risks requires the attacker to be at a specific location. Each one of these risks can be enacted from anywhere in the world (HQ, branch, offshore) as long as the attacker has network access to your Active Directory.

All that an attacker needs to enact these risks is sufficient effective access i.e. Active Directory Effective Permissions.

Oh and , 2 Other Quick Points

For those who may wonder why these risks are higher than risks posed by the compromise of a Domain Controller or an admin workstation, or the risks posed by credential-theft techniques involving the compromise of Active Directory privileged users -

1. For those wondering as to why these risks are higher than the risk posed by the compromise of a Domain Controller (DC) or an admin workstation, it is because to compromise a DC or an admin workstation, one typically requires either unrestricted physical access to it, and/or the ability to breach its system security, both of which are almost always more difficult to obtain than mere network access to Active Directory, which (obviously in addition to sufficient effective permissions) is all that a perpetrator needs to successfully enact any or each of these 5 risks to Active Directory.


2. For those wondering as to why these risks are higher than the risk posed by predominant credential-theft techniques involving the compromise of Active Directory privileged users, we're focused on mature defendable IT environments, wherein organizations have been able to either largely eliminate or minimize the possibility of credential-theft attacks involving the compromise of Active Directory privileged users in their environments, or be in a position to detect their occurrence (via technologies such as Microsoft ATA) and thwart them. Speaking of which, may I suggest reading this.

And now...



An Objective, Formal Risk-Management based Substantiation of these Top-5 Risks -



1. Complete and Instant Compromise of the Credentials of All Domain User Accounts -

• Asset at Risk – Credentials of all Active Directory domain user accounts (including those of all privileged users)
• Threat Source – Any sufficiently privileged intruder (hacker, APT etc.) / insider (disgruntled, rogue or coerced user)
• Attack Surface – Active Directory domain root object
• Enabler - Anyone who possesses Get-Replication-Changes-All extended right effective permissions on the domain root object is allowed to, and thus can, replicate all data including secrets (i.e. passwords) from Active Directory
• Exploitation Procedure – DCSync feature of the Mimikatz tool
• Difficulty – Minimal
• Impact – Very high
• Likelihood / Probability of Occurrence – High
• Physical / System Level Access to DC Required – No
• Resources Required – Network access to Active Directory + Sufficient Effective Permissions in Active Directory
• Mitigation / Prevention – Ensure (at all times) that only the smallest number of most highly trustworthy IT personnel have the Get-Replication-Changes-All effective permissions granted on the domain root object in Active Directory
• Risk Assessment – To find out exactly who can enact this risk, audit Active Directory effective permissions on the domain root object to find out exactly who all effectively have the Get-Replication-Changes-All right granted today
• Detection – Potentially possible via use of Active Directory auditing. However, detection is hardly useful because by the time an audit event/notification is generated / acted upon, substantial damage will likely already have been done
• Additional Info - Here

2. Complete and Instant Compromise of All Default Active Directory Privileged Domain User Accounts and Groups -

• Asset at Risk – All default Active Directory privileged/administrative domain user accounts and security groups (e.g. Administrators, Domain Admins, Enterprise Admins, Server Operators, Print Operators, Account Operators etc.)
• Threat Source – Any sufficiently privileged intruder (hacker, APT etc.) / insider (disgruntled, rogue or coerced user)
• Attack Surface – AdminSDHolder object in Active Directory
• Enabler - Anyone who possesses any one of various modify (WP, WD, CR, FC) effective permissions on the AdminSDHolder object is allowed to, and thus can, manage all default Active Directory domain accounts and groups
• Exploitation Procedure – Use native Microsoft Active Directory management tooling (e.g. ADUC etc.) to maliciously enact an authorized administrative task such as a password reset or a group membership change
• Difficulty – Minimal
• Impact – Very high
• Likelihood / Probability of Occurrence – High
• Physical / System Level Access to DC Required – No
• Resources Required – Network access to Active Directory + Sufficient Effective Permissions in Active Directory
• Mitigation / Prevention – Ensure (at all times) that only the smallest number of most highly trustworthy IT personnel have modify (WP, WD, CR, FC) effective permissions granted on the AdminSDHolder object in Active Directory
• Risk Assessment – To find out exactly who can enact this risk, audit Active Directory effective permissions on the AdminSDHolder object to find out exactly who all effectively have various modify effective permissions granted today
• Detection – Possible via use of Active Directory auditing. However, detection is hardly useful because by the time an audit event/notification is generated / acted upon, substantial damage will most likely already have been done.
• Additional Info - Here

3. Complete and Instant Compromise of Most IT Assets Stored in Active Directory -

• Asset at Risk – Almost all Active Directory content (i.e. all Active Directory objects except those whose ACLs are not marked Protected), such as all domain user accounts, security groups, computer accounts, OUs, SCPs etc. 
• Threat Source – Any sufficiently privileged intruder (hacker, APT etc.) / insider (disgruntled, rogue or coerced user)
• Attack Surface – The entire Active Directory
• Enabler - Anyone who ends up being entitled to any one of various modify (WP, WD, CR, FC) effective permissions on any object in Active Directory is allowed to, and thus can manage that Active Directory object. A single incorrectly specified (whether accidentally or intentionally) inheritable security permission specified at the domain root or at a top-level OU could impact the effective permissions on thousands of Active Directory objects in that domain/OU. 
• Exploitation Procedure – Use native Microsoft Active Directory management tooling (e.g. ADUC etc.) to maliciously enact an authorized administrative task such as a password reset or a group membership change
• Difficulty – Minimal
• Impact – High to Very high
• Likelihood / Probability of Occurrence – High
• Physical / System Level Access to DC Required – No
• Resources Required – Network access to Active Directory + Sufficient Effective Permissions in Active Directory
• Mitigation / Prevention – Ensure (at all times) that all access provisioned in Active Directory adheres to the principle of least privilege, so as to ensure that net resulting effective permissions / effective access on all Active Directory objects only permits authorized personnel to enact administrative tasks on these objects
• Risk Assessment – To find out exactly who can enact this risk, perform a domain-wide Effective Privileged Access Audit in Active Directory to find out exactly who can enact which privileged/admin tasks where in Active Directory
• Detection – Possible via use of Active Directory auditing. However, detection is hardly useful because by the time an audit event/notification is generated / acted upon, substantial damage will most likely already have been done.
• Additional Info - Here

4. Complete and Instant Compromise of All Domain Controllers in the Domain -

• Asset at Risk – All Domain Controllers in an Active Directory domain 
• Threat Source – Any sufficiently privileged intruder (hacker, APT etc.) / insider (disgruntled, rogue or coerced user)
• Attack Surface – The default Domain Controllers organizational-unit (OU) in Active Directory
• Enabler - Anyone who has sufficient effective permissions to be able to modify the list of Group Policy Objects (GPOs) linked to the default Domain Controllers OU in Active Directory is allowed to, and thus can link a GPO to that OU. The linking of a single weak or malicious GPO to the default Domain Controllers OU could weaken the System security of all DCs in that domain, and be used to easily obtain administrative command and control over all DCs. 
• Exploitation Procedure – Use native Microsoft Active Directory management tooling (e.g. ADUC etc.) to link a weak or malicious GPO to the default Domain Controllers OU
• Difficulty – Minimal
• Impact – Very high
• Likelihood / Probability of Occurrence – High
• Physical / System Level Access to DC Required – No
• Resources Required – Network access to Active Directory + Sufficient Effective Permissions in Active Directory
• Mitigation / Prevention – Ensure (at all times) that only the smallest number of most highly trustworthy IT personnel have sufficient effective permissions to be able to link GPOs to the default Domain Controllers OU in Active Directory
• Risk Assessment – To find out exactly who can enact this risk, audit Active Directory effective permissions on the default Domain Controllers organizational unit (OU) object to find out exactly who can link GPOs to this OU
• Detection – Possible via use of Active Directory auditing. However, detection is hardly useful because by the time an audit event/notification is generated / acted upon, substantial damage will most likely already have been done.
• Additional Info - Here

5. Complete and Instant Compromise of Specific IT Assets Stored in Active Directory -

• Asset at Risk – Almost all Active Directory content, such as and including as all domain user accounts (including any executive and non-default privileged user accounts), security groups, computer accounts, OUs, SCPs etc.


• Asset Examples –  The following are a few simple illustrative examples of such assets:
  
  
  
  1. The domain user account of a non-default highly privileged user, one that is not protected by AdminSDHolder, yet possesses Domain-Admin equivalent privilege in Active Directory based on custom access provisioning
  2. The domain user account of an organizational executive (e.g. Chairman, CEO, CFO, CIO, CISO, VP etc.)
  3. A large membership domain security group such as All Employees, or (all) Domain Computers etc.
  4. The domain computer account of a specific computer, such as a high-value email, app or database server
  5. A top-level Organizational Unit that contains thousands of users, computers, groups and other objects
  6. A service connection point of a mission-critical Active Directory integrated service/app, e.g. this one (; here)
  
  
• Threat Source – Any sufficiently privileged intruder (hacker, APT etc.) / insider (disgruntled, rogue or coerced user)
• Attack Surface – The entire Active Directory
• Enabler - Anyone who ends up being entitled to any one of various modify (WP, WD, CR, FC) effective permissions on any object in Active Directory is allowed to, and thus can manage that Active Directory object. A single incorrectly specified security permission (inherited or explicit) in an Active Directory object's ACL could substantially impact the actual resulting effective permissions entitled on that object, resulting in unauthorized effective access on the object.
• Exploitation Procedure – Use Microsoft's Active Directory management tooling (e.g. ADUC etc.) to enact an (un-)authorized administrative task such as a malicious password reset, a group membership change, a user account creation, a computer account delegation change, an OU deletion, a service connection point keyword change etc.
• Difficulty – Minimal
• Impact – High to Very high
• Likelihood / Probability of Occurrence – High
• Physical / System Level Access to DC Required – No
• Resources Required – Network access to Active Directory + Sufficient Effective Permissions in Active Directory
• Mitigation / Prevention – Ensure (at all times) that all access provisioned in Active Directory adheres to the principle of least privilege, so as to ensure that net resulting effective permissions / effective access on all Active Directory objects only permits authorized personnel to enact various administrative tasks on those objects
• Risk Assessment – To find out exactly who can enact this risk, either audit Active Directory effective access on all vital objects in Active Directory (e.g. all exec accounts, sensitive groups large OUs etc.) one-by-one, or perform a tree-wide effective privileged access audit to find out exactly who all can enact which admin tasks on these objects
• Detection – Possible via use of Active Directory auditing. However, detection is hardly useful because by the time an audit event/notification is generated / acted upon, substantial damage will most likely already have been done.
• Additional Info - Here

So Microsoft, there you have it. These are the actual and REAL Top-5 cyber security risks that almost all Active Directory deployments worldwide (including possibly yours) are likely exposed to today. You may want to read this many times over.

BTW, for anyone who needs it, an Executive Summary of the above (in PDF format) can be downloaded from here.

Summary

Today I just wanted to share with Microsoft and the whole world the actual Top-5 cyber security risks that most Active Directory deployments worldwide are substantially exposed to today (; most organizations may not even know that they're exposed.)

In light of the above, I would also encourage folks worldwide to first read the above (with attention to detail, and in its entirety) and then read the following 3 insightful posts, and you'll see why I believe Microsoft doesn't seem to have a clue -

1. 30 Days of Advanced Active Directory Security School for Microsoft


2. A Trillion $ Cyber Security Question for Microsoft regarding Defending Active Directory


3. How Well Does Microsoft Really Understand Cyber Security?

If you still need a hint, I'll give you one - in factually and objectively describing  the Top-5 security risks to Active Directory, how many times did I need to use the term "effective permissions" above? In contrast, when you read the 3 linked posts pointed to above make a note of and compare how many times Microsoft has educated the world about the term "effective permissions."


Microsoft, you'll want to read this (50 times) and absorb it like a sponge absorbs water - Active Directory Effective Permissions.

Alright, Microsoft, this is it for today. Later this week we shall continue with Day-6 of our advanced Active Directory Security school for you, during which I'll cover another fascinating trillion $ topic for you and the world - you likely won't want to miss it.

Best wishes,

Sanjay

PS: I've been meaning to do this on a daily basis, but given my responsibilities (i.e. a global cyber security company to head), time is difficult to take out, thus the delay. That said, if this weren't vital to global security, I wouldn't be wasting my time on it.

Top-5 Active Directory Security Risks & How to Adequately Mitigate Them

Folks,

Starting May 22, 2017, I will be most respectfully taking Microsoft to advanced Active Directory Security School. Today I'll share with you the Top-5 security risks to Active Directory deployments, and how organizations can swiftly and adequately mitigate them. There are times when less is more, so though I can share volumes, since this is paramount, I'll keep this short and to the point.


The Top-5 Active Directory Security Risks

The following are the Top-5 cyber security risks that most Active Directory deployments worldwide are likely exposed to -

1. Instant compromise of the credentials of all domain accounts, enactable via Mimkatz DCSync, made possible by the presence of unauthorized/excessive Get Replication Changes All effective permissions on the domain root.

2. Instant compromise of all default Active Directory privileged (administrative) domain user accounts and groups made possible by the presence of unauthorized/excessive effective permissions on the AdminSDHolder object. 

3. Instant compromise of all IT assets stored in Active Directory (whose ACLs are not marked Protected), made possible by the presence of a single inheritable unauthorized/excessive effective permission on the domain root. 

4. Instant compromise of all domain controllers via linking of a single malicious group policy, made possible by the presence of unauthorized/excessive effective permissions on the default Domain Controllers OU. 

5. Instant compromise of any IT asset stored in Active Directory, such as the CEO’s domain user account, made possible by the presence of unauthorized/excessive effective permissions on Active Directory objects.

It is imperative to understand that the materialization of risks 1, 2 and 4 risks above would be tantamount to a complete and systemic compromise of the entire Active Directory. The materialization of risks 3 and 5 could also have the same outcome.

It should also be noted that not a single one of these ways involve using pass-the-hash or Kerberos ticket meddling techniques. In fact, not a single one of these ways requires the victim to logon to any computer, let alone one owned by the perpetrator.

These risks pose a very real threat to most organizations since they likely remain unmitigated at most organizations worldwide, and since their materialization could result in the compromise of the entire Active Directory, their impact could be colossal.




How to Adequately Assess and Mitigate These Risks

These risks can be expeditiously assessed and mitigated by enacting the following risk assessment and mitigation measures -

1. Target Identification: Organizational IT personnel must identify all those Active Directory objects that constitute the targets upon which excessive or unauthorized access could result in the materialization of these risks. 

• Examples - The domain root object, the AdminSDHolder object, the default Domain Controllers OU, all large/vital OUs, all Active Directory objects representing specific high-value targets such as the domain user accounts of all executive (C*O) accounts as well as all high-value and large membership domain security groups, such as a Secret Project-X Group, the Corp Sec group, the All Employees group etc.

2. Risk Assessment: They must then proceed to accurately determine Active Directory effective permissions on each one of these objects to identify all those individuals who currently possess sufficient effective permissions / effective access to be able to perform those tasks which when enacted would result in the materialization of these risks. The correct methodology to enact this step is described in and called an Effective Privileged Access Audit.

3. Risk Mitigation: The must then proceed to identify all those individuals who currently possess such effective permissions/access but should not be in possession of such effective permissions/access per the organization's existing access policies. They should then determine how these individuals are entitled to such effective permissions / effective access and apply that information to revoke their access. Revocations should be verified.

For each of the five security risks enumerated above, the details of the target Active Directory objects as well as the specific effective permissions that need to be determined, can be found in slides 15 - 20 of this slide deck.

An example that illustrates this step-by-step can be found here - How to Prevent a Perpetrator from Using Mimikatz DCSync.

(Neither detection nor other security measures can adequately mitigate these risks because from the minute they are enacted, the perpetrator would have sufficient access to immediately be able to prevent everyone else from logging-on to stop him/her.)

In this manner, organizations worldwide can adequately assess and mitigate each one of these Active Directory security risks.





One Essential Necessity

Each of the five Active Directory security risks enumerated above primarily exist because organizations have traditionally lacked the means to accurately and adequately determine effective permissions in Active Directory i.e. on Active Directory objects.

(Effective permissions are so important that Microsoft's native Active Directory management tooling has an entire tab for them -

The Effective Permissions Tab

Unfortunately, Microsoft's Effective Permissions Tab is neither accurate nor adequate. In fact it is substantially inadequate.)


In essence, organizations require the ability to accurately and adequately determine Active Directory Effective Permissions.

While accuracy is paramount for obvious reasons, adequacy is equally essential, and it entails the following -

1. IT personnel must be able to efficiently (and of course accurately) determine the identities of all individuals that possess a specific effective permission on a specific Active Directory object.

2. IT personnel must also be able to determine how a specific individual possesses a specific effective permission on a specific Active Directory object, i.e. they must be able to identify the specific underlying security permission in the object's access control list (ACL) that entitles an individual to that specific effective permission.

The former (#1) is required to be able to efficiently determine the identities of all individuals that possess a sufficient effective permission on a specific Active Directory object, and the latter (#2) is required to be able to lockdown those security permissions that end up entitling a specific individual to those effective permissions that have been deemed excessive/unauthorized.

Again, this essential necessity is best illustrated with an example - How to Prevent a Perpetrator from Using Mimikatz DCSync.


Organizations can use any Active Directory Effective Permissions Tool that is provably accurate and sufficiently adequate.




Further Reading

You may find the following technical resources to be helpful and valuable -

1. An insightful presentation on Active Directory Security, titled Defending Active Directory Against Cyberattacks
2. An simple yet insightful overview and an illustrative example of Active Directory Effective Permissions
3. Specific details and options on how to perform an Active Directory Effective Privileged Access Audit
4. An online resource center dedicated to and focused on various aspects of Active Directory Security
5. Specific details on five cyber security capabilities that are essential for defending Active Directory

On behalf of our entire team at Paramount Defenses, I wish you, your team and your organization the very best in your efforts to adequately secure and defend your foundational Active Directory deployments. It is an honor and a privilege to help the world.

Best wishes,
Sanjay

Active Directory Privilege Escalation based on Exploitation of Unauthorized Grants in Active Directory - The #1 Cyber Security Risk to Active Directory

Folks,

The #1 cyber security risk to Active Directory deployments is summarized in the following Executive Summary document (which can be downloaded by clicking the image below, or by clicking here) -

Active Directory Privilege Escalation Executive Summary - 
 

  To access this Executive Summary, click image above, or here.
 

Those who understand it, know that it is powerful enough that it can be used to instantly compromise any Active Directory deployment in the world. (We can demonstrate its enactment in any production Active Directory deployment in the world.)

Those who don't understand it yet may wish to ramp up their Active Directory Security skills. A good starting point is to research "Active Directory Effective Permissions" and "Active Directory Privilege Escalation".

In days to come I will shed light on its various aspects, such as what makes it substantially more critical than the Pass-the-Hash attack vector, etc. Until then, here are some thoughts, some details, and a concrete example.

Best wishes,
Sanjay

PS2: For those of you who downloaded the password-protected version of the document this past week, the password to that document was "SkyFall"

The Active Directory Security Resource Center

Folks,

I hope this finds you all doing well. As you may know, the Cyber Security temperature around the world continues to rise, and as it does, it potentially threatens organizational Active Directory deployments worldwide.

In an effort to help organizations worldwide adequately secure and defend their Active Directory deployments from compromise, I recently commissioned the development of an Active Directory Security Resource Center.

Active Directory Security

The intention was to help organizations better understand the risks to which their Active Directory deployments may be exposed, as well as to help them determine how to assess and mitigate risks to their Active Directory deployments, measurably, efficiently and reliably.

It thus provides valuable information on numerous aspects of Active Directory such, including the Top Security Risks to Active Directory, as well as a set of adequate risk mitigation measures that can be enacted to protect Active Directory from these risks.

It thus touches upon numerous aspects of Active Directory Security, including Domain Controller Security, Administrative Account Reduction, Active Directory Audit, Active Directory Auditing, Active Directory Security Tools, Active Directory Checklists, as well as other Active Directory Resources.

One of the main reasons for commissioning it was that, based on what we're seeing, most organizations around the world, are substantially deficient in their ability to successfully thwart potential cyber security attacks aimed  at Active Directory deployments. The only part more worrisome is that most of these organizations don't actually even realize the ramifications of an Active Directory compromise. That's a worrisome situation, and one that we intend to help improve to the extent we can.

The Active Directory Security Resource Center is thus one of many ways in which we intend to help organizations.

Its over at -  http://www.paramountdefenses.com/active-directory-security

Kindly note that it is not intended to be a comprehensive source of information, as we expect Microsoft Corporation to be that source. It is however, intended to provide highly actionable and valuable guidance, as well as pointers to other resources, so organizations can better understand the threats to Active Directory, as well as determine how to mitigate those threats in a timely manner.

In days to come, we will also declassify the #1 cyber security risk to Active Directory deployments today. Before we do so, we will also share valuable additional information on this vital subject, so that organizations can better understand how to protect their Active Directory deployments from harm.

Best wishes,
Sanjay.