Active Directory Auditing Tools: Building Blocks or just a Handful of Dust?
1 like•425 views
The document outlines the significance of active directory auditing tools and the potential vulnerabilities within active directory systems due to identity management issues. It emphasizes critical mitigations needed to protect against various attack methods, such as credential theft and privilege escalation, while also providing a roadmap for enhancing security practices. Additionally, it discusses the importance of proactive measures, including the use of privileged access workstations and time-bound privileges, to safeguard administrator activities.
Active Directory Auditing Tools: Building Blocks or just a Handful of Dust?
- 1. Active Directory Auditing Tools: Building Blocks or Just a Handful of Dust? @paulacqure @CQUREAcademy CONSULTING Paula Januszkiewicz CQURE: CEO, Penetration Tester; Security Expert CQURE Academy: Trainer MVP: Enterprise Security, MCT www.cqureacademy.com [email protected]
- 3. What does CQURE Team do? Consulting services High quality penetration tests with useful reports Applications Websites External services (edge) Internal services + configuration reviews Incident response emergency services – immediate reaction! Security architecture and design advisory Forensics investigation Security awareness For management and employees [email protected] Trainings Security Awareness trainings for executives CQURE Academy: over 40 advanced security trainings for IT Teams Certificates and exams Delivered all around the world only by a CQURE Team: training authors
- 4. Chasing the obvious: NTDS.DIT, SAM The above means: To read the clear text password you need to struggle!
- 5. Identity is the new security “perimeter” under attack One small mistake can lead to attacker control Attackers Can • Steal any data • Encrypt any data • Modify documents • Impersonate users • Disrupt business operations Active Directory and Administrators control all the assets
- 6. Tier 2 Workstation & Device Admins Tier 0 Domain & Enterprise Admins Tier 1 Server Admins 1. Beachhead (Phishing Attack, etc.) 2. Lateral Movement a. Steal Credentials b. Compromise more hosts & credentials 3. Privilege Escalation a. Get Domain Admin credentials 4. Execute Attacker Mission a. Steal data, destroy systems, etc. b. Persist Presence Compromises privileged access 24-48 Hours Phase 1 Critical Mitigations: Typical Attack Chain
- 7. Making and Measuring Progress against Risk 2-4 weeks 1-3 months 6+ months Detect Attacks Harden ConfigurationDomain Controller (DC) Host Attacks Credential Theft & Abuse Reduce Agent Attack Surface Attacker Stealth Prevent Escalation Prevent Lateral Traversal Increase Privilege Usage Visibility AD Attacks Assign Least Privilege Attack Defense Securing Privileged Access Three Stage Roadmap http://aka.ms/privsec
- 8. Protecting Active Directory and Admin privileges 1. Separate Admin account for admin tasks 3. Unique Local Admin Passwords for Workstations http://Aka.ms/LAPS 2. Privileged Access Workstations (PAWs) Phase 1 - Active Directory admins http://Aka.ms/CyberPAW 4. Unique Local Admin Passwords for Servers http://Aka.ms/LAPS 2-4 weeks 1-3 months 6+ months First response to the most frequently used attack techniques
- 9. First response to the most frequently used attack techniques 2-4 weeks 1-3 months 6+ months DC Host Attacks Credential Theft & Abuse Attacker Stealth AD Attacks Top Priority Mitigations Attack Defense Detect Attacks Harden DC configuration Reduce DC Agent attack surface Prevent Escalation Prevent Lateral Traversal Increase Privilege Usage Visibility Assign Least Privilege
- 10. Protecting Active Directory and Admin privileges 2. Time-bound privileges (no permanent admins) http://aka.ms/PAM http://aka.ms/AzurePIM 1. Privileged Access Workstations (PAWs) Phases 2 and 3 –All Admins and additional hardening (Credential Guard, RDP Restricted Admin, etc.) http://aka.ms/CyberPAW 4. Just Enough Admin (JEA) for DC Maintenance http://aka.ms/JEA 987252 1 6. Attack Detection http://aka.ms/ata 5. Lower attack surface of Domain and DCs http://aka.ms/HardenAD 2-4 weeks 1-3 months 6+ months Build visibility and control of administrator activity, increase protection against typical follow-up attacks 3. Multi-factor for elevation
- 11. Build visibility and control of admin activity 2-4 weeks 1-3 months 6+ monthsAttack Prevent Escalation Defense
- 12. Protecting Active Directory and Admin privileges 2. Smartcard or Passport Authentication for all admins http://aka.ms/Passport 1. Modernize Roles and Delegation Model 3. Admin Forest for Active Directory administrators http://aka.ms/ESAE 5. Shielded VMs for virtual DCs (Server 2016 Hyper-V Fabric) http://aka.ms/shieldedvms 4. Code Integrity Policy for DCs (Server 2016) 2-4 weeks 1-3 months 6+ months Move to proactive security posture
- 13. Move to proactive security posture 2-4 weeks 1-3 months 6+ monthsAttack Prevent Escalation Prevent Lateral Traversal Defense
- 14. What is the most successful path for the attack right now?
- 15. :) THE ANATOMY OF AN ATTACK Healthy Computer User Receives Email User Lured to Malicious Site Device Infected with Malware
- 16. HelpDesk Logs into Device Identity Stolen, Attacker Has Increased Privs :) Healthy Computer User Receives Email User Lured to Malicious Site Device Infected with Malware
- 17. User Lured to Malicious Site Device Infected with Malware HelpDesk Logs into Device Identity Stolen, Attacker Has Increased Privs ceives il
- 19. “PASS THE HASH” ATTACKS Today’s security challenge
- 21. User: Adm... Hash:E1977 Fred’s Laptop Fred’s User Session User: Fred Password hash: A3D7… Sue’s Laptop Sue’s User Session Pass-The-Hash Technique Malware Session User: Administrator Password hash: E1977… Malware User Session User: Adm… Hash: E1977 User: Sue Hash: C9DF User: Sue Password hash: C9DF… File Server User: Sue Hash:C9DF 1 3 4 1. FRED RUNS MALWARE, HE IS A LOCAL ADMINISTRATOR 2. THERE IS A PASS THE HASH SESSION ESTABLISHED WITH ANOTHER COMPUTER 3. MALWARE INFECTS SUE’S LAPTOP AS FRED 4. MALWARE INFECTS FILE SERVER AS SUE 2
- 22. Pass-The-Hash Solution: Virtual Secure Mode VSM uses Hyper-V powered secure execution environment to protect derived credentials – you can get things in but can’t get things out Decouples NTLM hash from logon secret Fully randomizes and manages full length NTLM hash to prevent brute force attack Derived credentials that VSM protected LSA Service gives to Windows are non- replayable
- 23. Summary: Best Practices Vulnerability Management Continuous vulnerability discovery Context-Aware Analysis Prioritization Remediation and Tracking Put on the Hacker’s Shoes External + Internal + Web Penetration tests Configuration reviews Prevention
- 25. PowerBroker Auditing & Security Suite Real-time Change Auditing and Recovery for AD and Windows environments
- 26. PowerBroker Auditing & Security Suite Centralized real-time change auditing of Active Directory, File Systems, Exchange, SQL and NetApp Entitlement reporting for AD and File Systems Continuous backup and recovery for AD
- 27. How does it work?
- 28. Demonstration
- 29. Quick Poll + Q&A Thank you for attending today’s webinar.