Sababa AD Hardening

As we have moved to the post-pandemic era, we can’t count only on the endpoint protection. Employees are spread between corporate, mobile and home networks, thus making protecting endpoints – the main entry point to corporate networks – not enough. According to a recent survey by Deloitte, today there are on average up to 25 devices connected to the home network, more than doubled from 2019. Therefore, it requires other ways to detect a security breach and spot out an attack.

Let’s look at a common cyberattack kill chain to see that privilege escalation is the key passage. After gaining access to the infrastructure, attackers need to get administrator privileges for identifying and gaining control over the crucial resources. Massive attacks like NotPetya and Maze used the Active Directory to move around the victim’s infrastructure.

What is AD?

For over 20 years, Active Directory has been used to structure a corporate network and manage the resource allocation in line with the group policies. In other words, it is a key system that defines what a user can or can’t do or see within the organization infrastructure.

As a company matures and changes, its Active Directory ages too. Mergers, acquisitions, personnel turnover often result in blind areas, misconfiguration and confusion that could be exploited by malicious actors. On the contrary, a well-structured Active Directory increases the essential capability of a network to resist and slow down the development of an attack, making it harder for malicious actors to remain hidden in the network, escalate privileges, take over hosts and backups, and exploit them for the attack.