Legacy auditing approach to evaluate the entire active directory ecosystem will create various challenges for enterprises. Here are some thoughts on how to meet them.
Organizations do not get a comprehensive view of the activity, search, notify and retain data, which restricts the enterprise from various opportunities. Moreover, in a legacy tool, data is not even structured throughout the various workloads making it even more difficult. There are various advanced tools that enterprises can leverage to get a centralized dashboard to keep closely monitor activity and changes in the hybrid IT ecosystem to enhance AD security and compliance.
Here are a few tips that IT leadership can consider to audit the Microsoft active directory:
Detect all the unsupported operating systems in the domain
It is crucial for businesses to keep track of all the unsupported server operating systems in domains. Organizations need to keep track of all windows servers that drop out of support. Many organizations might have an unsupported operating system and many unpatched surfaces in the domain. Such unsupported and older platforms will lead to weaker protocols.
Spot all the old and unused accounts
SecOps teams should consider implementing the right tools that execute an audit in the active directory to determine all the stale or inactive accounts in the business network.
It is essential to look out for accounts that have not been logged in for a long time. These stale and inactive accounts have weak or insecure passwords that cybercriminals can leverage to infiltrate the system.
Also Read: Top Four Implementation Impediments for Password less Authentication
Audit all the accounts with non-expiring credentials in the active directory
CISOs should consider evaluating the entire domain to spot all the accounts with non-expiring passwords in that domain. Enterprises can implement Multi-factor Authentication (MFA) or Two-factor Authentication (2FA) through vendor keys or software solutions to add an extra layer of security, especially while the user is accessing the active directory remotely. While the SecOPs are evaluating credentials, they should also ensure that administrator or privileged user accounts have intricate and difficult passwords.
Change Kerberos credentials constantly
Businesses tend to overlook disabled Kerberos accounts in the domain. CISOs should consider implementing effective password governance and update policies that force users to update KRBTGT account credentials regularly. Enterprises can execute a Microsoft script that ensures the domain executes a correct replication of the sensitive credentials. Changing the password once in three days is one of the most effective ways to ensure the credentials are no longer leveraged by the golden ticket attack.
Also Read: Key Questions CISOs Should Ask to Safeguard Their Organization’s Sensitive Data
Once the cybercriminal hacks into the active directory account, organizations can expose sensitive data and increase the risks of it getting stolen. Such kinds of infiltrations can be avoided by enforcing stringent password policies. There are many tools in the market that enterprises can leverage to audit all password changes and attempts to ensure the security of the active directory.
Restrict access to particular templates
Attackers leverage certificates as vectors to deploy attacks. They utilize these certificates as request templates to infiltrate the system. In organizations that allow users to edit before issuing the certificate, the cybercriminal can assign the certificate to themselves by setting the subject to an administrator account. CISOs should consider restricting such templates to a specific group to minimize the risk in the active directory.
For more such updates follow us on Google News ITsecuritywire News. Please subscribe to our Newsletter for more updates.
