Cloud Application Blog

Active Directory was compromised, now what?

May 16th, 2012 Posted in Cloud

Re-constituting Active Directory after a critical compromise or detection of an Advanced Persistent Threat

Microsoft’s Active Directory (AD) provides a secure and stable directory service on which many organizations depend to provide user authentication and authorization. Because AD represents the preverbal keys to the kingdom it typically receives the appropriate level of care and feeding required maintaining it. Despite proper upkeep, there is still a chance that an Advanced Persistent Threats (APT) may be successful and compromise your Active Directory. Because of the nature of APTs a wide range of attacks vectors may be tried that may or may not attempt to subjugate AD directly. The result is that a successful compromise may go undetected for some time until the attacker decides to exploit the compromise by stealing data or making critical systems unavailable.

Most administrators are now resigned to the fact that their network will be hacked. It’s just a matter of time. It’s no secret that there is a lot of activity around cyber security, and the most serious (damaging?) breach that could happen to any organization is a compromise of their Active Directory (AD) environment. AD is at the heart of many missile critical services, including desktop logins, file print sharing, email other communications and collaboration. And once the compromise happens, it can have far reaching effects. Plus, attackers are much more sophisticated, using many (various?) tactics to penetrate and then stay hidden within your environment. At this point, it is an arms race, and the “bad guys” only have to win once to get in where you must win everyday.

Reducing the immediate threat – Domain Admins role

A quick way to reduce the threat to Active Directory is to reduce the number of privileged accounts that can make major changes to Active Directory. This is especially important for AD users who have the Domain Administrators privilege. Because of the Active Directory design, many organizations have dozens or many dozens of users who hold this role. There are several management solutions on the market today that will allow administrators to perform day-to-day tasks without requiring the Domain Administrator’s role. Another critical way to reduce the threat to your production environment is to ensure your directory auditing and monitoring solutions are up to the task.

Why re-establishing AD after a critical compromise goes beyond normal recovery

Because a critical compromise may only be uncovered long after it was introduced the validity and security of backup data because changes made via. the compromise may be indistinguishable from day-to-day administrative changes. The sheer volume of changes made from the time of the compromise’s introduction to the current state of the directory data make it virtually impossible to identify the changes intentional vs. non-intentional. The best option and certainly the fastest option is to remove the compromise and maintain your directory data is to migrate the data to a new sanitized directory on clean servers.

More on Advanced Persistent Threats

An Advanced Persistent Threat (APT) typically refers a conspiracy by a group of foreign government attempt or complete some a cyber attack. What makes these threats particularly scary is after the group or foreign government perpetrating these attacks the compromise may not be exploited until such time as maximum damage can be achieved or when the highest value theft can be achieved. For more information on Advanced Persistent Threats see: http://en.wikipedia.org/wiki/Advanced_persistent_threat

Windows Credential Editor

If you don’t think people can get past your complex AD password, check out http://www.ampliasecurity.com/research/wcefaq.html.

Bob posted at 2012-5-16
Category: Active Directory, Cloud, Identity, Microsoft | Tags: Active Directory Experts, Active Directory Help, Active Directory Tools, AD Auditing, Advanced Persistent Threat, Privilege Account Management, Robert Bobel, Windows Credential Editor

Article source: http://www.bobbobel.com/active-directory-was-compromised-now-what/

Cloud, SaaS

Just-in-Time Access Provisioning

March 8th, 2011 Posted in Cloud

No Comments

While I was in college I worked summers for a glass company. My job was in the engineering drafting department where I drafted furnace parts, conveyor belts and paint bands that hides the goo they use to stick your windshield to your car. During this time American automakers struggling cope with the explosion of Japanese imported cars. Japanese cars had a reputation of low cost and good quality, but the Japanese automakers also had a secret weapon that made them more efficient – Just-in-Time manufacturing.

Just-in-Time manufacturing is a simple concept – rather than keep all the unassembled car parts in expensive warehouses, have them delivered to the factory at the time they are needed to assemble a car. This idea stuck with me and has been rattling around in the back of my mind for the past twenty years. Dell later used a similar concept steal market share away from IBM and Gateway who were building huge numbers of PCs and storing them until they were sold – while Dell built PCs that were already sold.

A project I have been working on for the past year or so was applying Just-in-Time concept to the process of granting users access to applications or data. The idea is that when a user attempts to access a resource for which they have not been granted access – the access attempt kicks of a self-service process or an automatic grant of access.

While I have seen other applications perform similar activities, many people have seen Microsoft SharePoint’s basic request access feature. The challenge I see with SharePoint is that it only allows generic requests that don’t allow the user to select the level of access they wish nor does it tell the user the state of their access request. Both are needed and both must be components of any more complete solution. A more complete solution must also provide access to more than just SharePoint; files, folders and applications access are also desperately needed.

Today, we posted a technical preview of Just-in-Time Access Provisioning called the ActiveRoles AuthX Provider The provider not only integrates authentication using SAML between AD users and Google Apps, it also can trigger a self-service access request through ActiveRoles if the user does not yet have an account. Once the request is approved a Google account is created. The next time the user points his/her browser to Google Apps URL the Provider seamlessly authenticates the user by doing an account mapping of AD user to the Google account and creates a SAML token that automatically signs the user into their Google Apps account. We created a 2 minute video showing the process so you can see how this works. The video was a little long and choppy at some points so I cut it down to about 2 minutes.

Video:ActiveRoles Access Provider