Do threats against your infrastructure’s Active Directory security keep you up at night? Honestly, it should. Active Directory is critical as it controls access to your systems and data. Ensuring that your Active Directory is secure should be one of your main priorities. In this blog I have listed some of the most common Active Directory security issues that an organization most often faces.
Do any of these look familiar to you? If so, you should start addressing these issues.
In this case “more” is not a good thing. When it comes to your AD system, if you have an overly long list of Active Directory users with Administrative rights and excessive privileges, it’s likely that there is the potential for privilege abuse, which is one of the leading causes of lateral movement for hackers.
Delegating tasks to users who have no real need to be in a power position like an administrator happens, but it’s a bad way to do business. By delegating tasks to non-administrators, without proper oversight is a massive risk. One misstep or account failure and the entirety of an enterprise might be compromised. Don’t allow your tasks to be delegated, especially in an unmanaged way.
Passwords are the main avenue of compromise in roughly ¾ of attacks on AD systems. One weak password, or already compromised account that is bought on an underground site is the only thing a hacker needs to become an administrator on your network. That single, simple thing can literally invalidate your entire security strategy and technology portfolio. Don’t fall down the password rabbit hole. Fix them and always mandate MFA.
Inactive accounts often seem to be harmless, bu. Inactive accounts usually hold administrative privileges and will be used as a platform for a hacker to gain access to your infrastructure. Inactive accounts should be removed entirely and audited regularly to make sure you are actively mitigating those risks.
Be careful that your Guest and Anonymous accounts are not granted the same open access as regularly managed and authenticated users.
Not seeing or knowing who is logging into your Domain Controller makes it almost impossible to protect administrative accounts and privileged access. Ensure that you have a continuous and proactive way of auditing and controlling those logins, so that you can quickly react to anomalies.
Members of security groups like Domain, Enterprise and Schema Administrators have the highest levels of privileges, they are the ultimate power player in your network to be sure. If one of those users has bad credentials the damage to your organization’s security could be catastrophic.
To help minimize these risks, you should only grant membership to those accounts that need it, and withdraw group memberships the minute they are no longer required. Do not leave those accesses or accounts live any longer than is absolutely necessary.
One of the main principles of a good Zero Trust policy dictates that users should only log on with an account that has the absolute minimum permissions required for their job, that’s it.
You should be consistently tracking changes to privileges to ensure that the right users have the right levels of access to the right data, and nothing more is present. Doing this reduces your risk profile, increases visibility and accuracy of account management and will help you better respond to anomalies.
GYTPOL offers Next Generation Active Directory assessment. Providing continuous assessment 24×7. These days, this is a must as the AD is a critical component. GYTPOL is able to detect real-time AD attacks and supports automatic remediation.