How to stop attackers from owning your Active Directory

Abstract

More than 90 per cent of organisations use Active Directory (AD) as their identity management system, which serves as a master directory and the means to control access to enterprise services. Its central role in governing user identity and authentication means AD is a primary target for threat actors. Compromising AD means attackers can access the most critical systems and assets on the network or gain administrator privileges to take over the domain. Many traditional security solutions will not notice this activity because the user account appears to be operating within the scope of its privileged access rights. The tactics the attackers use can evade traditional detection systems since they are not designed to detect credential theft, privilege escalation and lateral movement. Identity visibility solutions reduce the attack surface by identifying exposed credentials, domain controller vulnerabilities and cloud overprovisioning. Identity detection and response (IDR) solutions add detection of attempts to exploit AD and credential protection from theft and misuse. This paper will discuss how threat actors attack and exploit AD, and what organisations can do to protect their AD environments.