How to Build Resilient In-Depth Active Directory Security Defences

Listen to this article! Audio Long Read

The trend to rationalise the tech stacks currently deployed to reduce technical debt is also transforming how enterprises approach the multifaceted security environment they now operate within. Rationalisation, though, must take place within a strong security framework.

Essential technologies will remain, with AD continuing to form the core of communications and network access. However, as a primary source of an attack, AD exposure to threat actors must be addressed with not only new technical protections but also by closely considering the human factor, as often, the users of AD can become the  attackers favourite target.

Businesses are looking for comprehensive solutions to the threats they face today and how they can be proactive to protect themselves in the future. A continuous program of attack path awareness with defined actions is forming the basis of new security policies.

Threats rapidly morph and evolve, presenting enterprises with a moving target. However, with a strategic security stance, all companies can protect their more valuable assets from within their companies, as robust AD security begins by understanding the risk.

If there is one technology that forms the keystone of many enterprises, it is AD. The Active Directory is the hub around which multiple services orbits. From file access, applications, and, of course, email, AD connects users to them all. The interconnected nature of AD is also why it is the focus of cyberattacks. If an attacker can control your AD, then they can control your entire enterprise.

How businesses organise their workforces has massively changed. Mass remote working is now the norm. This presents a unique challenge for enterprises that can no longer see their threat perimeter. With workers able to connect to their network from any location – without a clearly defined security envelope – businesses are open to attack from several threat vectors. And, of course, AD is also vulnerable as it plays a central role in many business processes.

As the threat perimeter needs to be clearly defined, how can digital assets, including the AD, be adequately protected? Here, data is the key. If your enterprise has robust and comprehensive views of AD, and user access credentials, this raises the quality of digital security as your company can identify any anomalies and take appropriate action. Strong AD security begins with an audit of your most important assets. This discovery phase enables your business to build access profiles and vulnerable attach paths, to understand which areas of AD are most at risk.

Protect your hybrid AD environment and mitigate risk with the NIST Framework

Just because you’re secure today, doesn’t mean you will be tomorrow. The perimeter defence is no longer enough, and you should always take the approach of “assume breach.” Adopting a new, more proactive approach to AD security also requires a reduction in technical debt. This is particularly critical for Azure AD when this is a SaaS solution. Additionally, shedding technical debt is a deliverable when migrating to cloud services. Ultimately, this puts your business on a secure foundation for more advanced and comprehensive cyber defences.

The constantly changing and complex nature of AD environments makes AD security difficult. To combat today’s advanced and evolving threats, you need a layered defence that protects your business against every phase of an attack lifecycle. NIST (National Institute of Standards and Technology) has become a proven means to create a comprehensive approach to cybersecurity. The five pillars, Identify, Protect, Detect, Respond and Recover, define risk and the practical actions necessary to mount an effective defence. However, they are not intended as a roadmap but as a definition of what robust digital security should evolve into.

At Quest, we offer an approach that tackles defence in depth at every layer of the NIST Framework, which can be developed independently towards an end goal of integration. As a result, a business can quickly move through each pillar or stage to identify a potential penetration and then move towards recovery if the attack has adversely impacted systems.

Using NIST to develop a practical and effective defence against AD attacks is proven. As attack vectors become more sophisticated, identifying, and quantifying anomalous activity is critical. By compromising an ordinary user account, an adversary is likely to be able to leverage an attack path that will get them to your Tier 0 assets in just a handful of steps. By understanding indicators of exposure (IOEs) and prioritizing the attack paths, an adversary could take to own your environment. Quest provides the foundation and proactive measures necessary to detect and protect against the next incident, attempt, outage, or disaster.

Be prepared for attacks with AD disaster recovery planning

Often, businesses will approach their cybersecurity – particularly as it relates to their AD – as simply an exercise in defence. However, many enterprises that have suffered an attack lament their lack of clearly defined recovery and restoration policies. With ransomware attacks on the rise ensuring your business can recover quickly is imperative.

Think about your business’s current AD infrastructure. If your company also has migrated to Azure AD, is the synchronisation with the cloud and on-prem robust enough and backed up to aid seamless recovery? An audit will reveal where objects and attributes are located. Often access policies, MFA settings and core applications are divided between each AD deployment. The backup system must consider this to ensure that no data is lost if a recovery is needed.

Building a secure and resilient policy to protect AD and Azure AD is multifaceted. AD is often likened to a living organism that evolves and changes daily. Therefore, AD and Azure AD security must also be continually assessed to ensure that the security systems are active and effective. Automation can indeed be implemented, but this complements training and education across your workforce to develop a cybersecurity awareness and behaviour culture.

AD and Azure AD are at the core of the business process and communications. Recognising that a comprehensive and integrated security infrastructure must be in place to deflect today’s and tomorrow’s threat actors will put your enterprise on a path that can minimise successful attacks but also have systems in place to recover quickly. Intelligent cybersecurity has two faces: defence and recovery.

Cyberattack resilience has recovery at its core. Every minute counts when it comes to bringing AD back online. Securing your enterprise’s AD or Azure AD is essential. However, no security system is one hundred per cent effective. Attack vectors are constantly evolving, which means a successful attack must be mitigated. Quest sees recovery from an attack as just as necessary as comprehensive defence and works to ensure an AD disaster will not become a business disaster by slashing AD recovery time from days or weeks to just hours.

To learn more about how QUEST can help your business gain Active Directory cyber resiliency with in-depth defence, visit Cybersecurity risk management solutions | Quest