Active Directory Security Best Practices

Size: px

Start display at page:

Download "Active Directory Security Best Practices"

Norman Davis
6 years ago
Views:

1 Active Directry Security Best Practices Friedwart Kuhn Digital unterschrieben vn Friedwart Kuhn Datum: :51:31 +02'00' Adbe Acrbat Reader-Versin:

2 Agenda 2

3 Wh We Are 3

4 Intr 4

5 Mistake N. 1: Lack f AD Gvernance 5

6 The Prblem: Lack f AD Gvernance 6

7 The Slutin: Dedicated AD Gvernance 7

8 The Slutin: Dedicated AD Gvernance 8

9 Mistake N. 2: Admins (and Service Accunts) Lgging n Everywhere 9

10 The Prblem: Admins Lgging n Everywhere Org. Prv1 Org. Org. Prv3 Prv1 Prv2 Prv2 Prv2Prv1 Prv1 Prv2 Prv1 Org. Prv2 Prv1 Prv2 Org. Prv1 Prv3 10

11 Pwer: Dmain Cntrllers Result f Mistake 2 Data: Servers and Applicatins Access: Users and Wrkstatins This slide is frm: Mark Sims, Nichlas DiCla; TWC: Pass-the- Hash and Credential Theft Mitigatin Architectures 11

12 The Slutin: Implement Administrative Tiers Tier 0 Dmain Cntrllers, Dmain Admin Wrkstatins, Special Tier 0 Systems (Patch, AV, Mgmt) Enterprise & Dmain Admins BUILTIN\Administratrs General: Tier 0 Admins Tier 1 Tier 2 Applicatin Servers Server/App Admin Wrkstatins, Tier 1 Mgmt Systems Internet Cnnected Wrkstatins f Standard Users Server Admins, Server Services Applicatin Admins General: Tier 1 Admins Wrkstatin Admins (Tier 2 Admins) Tier 3 Standard Users 12

never lg n t a resurce n a lwer tier ( Implement lgn restrictins) Restrict Cntrl: Security

13 Tier Mdel Principles Classify: Every single security principal, system, r applicatin has t be classified as belnging nly t ne tier Restrict Lgns: Security principals f a higher tier must never lg n t a resurce n a lwer tier ( Implement lgn restrictins) Restrict Cntrl: Security principals f a lwer tier must never cntrl resurces f a higher tier ( Implement cntrl restrictins) 13

14 Cntrl Restrictins vs. Lgn Restrictins 14

15 Implementatin Guidelines 15

16 Summary 16

17 Mistake N. 3: Using Dirty Surces 17

18 The Prblem: Security Dependencies OS r Applicatin Install Infect Media Cmprmise Vectr Infect Wrkstatin Installatin Media User Wrkstatin Administratin Task Cmprmise Vectr 18

19 The Slutin: Clean Surce Principle Subject Cntrl Relatinship Object 19

20 Clean Surce Principle: Installatin 20

21 Clean Surce Principle: Administratin 21

22 Clean Surce Principle: PAWs PAW User VM PAW 22

23 Clean Surce Principle: ESAE/PRIV Frest ESAE Frest Tier 0 PRIV Frest Tier 1 Tier 2 Standard Users Prductin Frest 23

Exemplary Secure Administratin Envirnment Mdels Tier 0 managed via PAWs PAWs Trust fr identities f Shared Services Accunt Frest(s) Accunt Frest(s) Accunt Frest(s) Tier 0 managed via Lcal ESAE Frest

24 Exemplary Secure Administratin Envirnment Mdels Tier 0 managed via PAWs PAWs Trust fr identities f Shared Services Accunt Frest(s) Accunt Frest(s) Accunt Frest(s) Tier 0 managed via Lcal ESAE Frest Trust fr identities f Shared Services Tier 0 managed via Glbal ESAE Frest Lcal ESAE Frest Trust fr identities f Shared Services 24 Glbal Resurce Frest Glbal Resurce Frest Glbal ESAE Frest Glbal Resurce Frest

25 Exemplary ESAE Frest Implementatin AD(s) ESAE FOREST TIER 0 App OS AD OS Firewall AD PKI DNS WSUS Hyper-V AV/ Mnitr/ Vulnerability PAM Shares OS (DCs/Member) Jump Vault Strage HW HW Management Hardware Management Hypervisr NW Switches Firewall Firewall Switches VPN TIER 1 Cntent Management Exchange PKI Identity & Access Management Web Apps DBs TIER 2 Virtual Clients Hardware Clients PAWs Physically in Tier 2 Lgically in Tier 0 25

26 Mistake N. 4: (AD) Brders Nt Under Cntrl 26

27 The Prblem: AD Brders Neither Well-defined Nr Cntrlled: Trusts 27

28 T many trusts 28

29 Trusts are t pen Authenticatin Requests (with Dmain- and Frest-wide Authenticatin) All requests cming ver the trust are authenticated and ruted by DC1 Trusted Frest DC 1 Authenticated Users Trusting Frest 29

30 The Prblem: AD Brders Neither Well-defined Nr Cntrlled: DMZ 30

31 The Slutin: AD Brder & Trust Management 31

32 Trusts 32

33 DMZ AD 33

34 Mistake N. 5: Best Practices Lst in Time 34

35 The Prblem: Basics Are Overlked 35

36 The Slutin: D the Basics 36

37 AdminSDHlder Object 37

38 The Slutin: D the Basics 38

39 Mistake N. 6: T Many and T Privileged Service Accunts 39

40 The Prblem: Overabundance f Service Accunts 40

41 The Slutin: Service Accunt Huse Keeping 41

42 Mistake N. 7: T Many Admins 42

43 The Prblem: Over-privileged Accunts 43

44 The Slutin: Remve Privileges 44

45 Mistake N. 8: Using Bad Passwrds 45

46 The Prblem: Bad Plicies & User Awareness 46

47 Example I Really? 47

48 Example II Better? 48

49 The Slutin: Update Passwrd Plicies 49

50 Recmmended Passwrd Requirements Type Min Age Max Age Min Length Histry Cmplexity Requirements Lckut Threshld 50

51 Mistake N. 9: Running Outdated Operating Systems 51

52 The Prblem: Outdated Operating Systems 52

53 The Slutin: Use Mdern Operating System Versins 53

54 The Slutin: Use Mdern Operating System Features 54

55 Mistake N. 10: Vulnerable Systems and Applicatins Everywhere 55

56 The Prblem: Insufficient Patch Management 56

57 The Slutin: Patch and Vulnerability Management 57

58 The Slutin: Patch and Vulnerability Management 58

59 Mistake N. 11: N Active Directry- Specific Security Lgging & Mnitring 59

60 The Prblem: N AD-Specific Security Lgging & Mnitring 60

61 The Slutin: AD-Specific Security Lgging & Mnitring 61

62 The Slutin: AD-Specific Security Lgging & Mnitring 62

63 Thank yu fr yur time! 63

64 Surces 64

65 Additinal Material & Infrmatin 65

Cntrl/Lgn Restrictins Example 1 fr Admin Tiers As the user is a tier 1 admin, he

limited NTFS permissins) Tier 0 File Share Tier 0 As required by his rle, the Tier

(well-defined and strictly mnitred) Tier 1 admin must access a Tier 0 file share t

66 Cntrl/Lgn Restrictins Example 1 fr Admin Tiers As the user is a tier 1 admin, he cannt cntrl the file share system /the resurce (he can nly access a share with limited NTFS permissins) Tier 0 File Share Tier 0 As required by his rle, the Tier 1 admin can lgn t a higher-tier resurce t access a share and stre files (well-defined and strictly mnitred) Tier 1 admin must access a Tier 0 file share t stre certain files Tier 1 Admin Tier 1 Nte: A similar scenari is the access t the Netlgn share 66

67 Cntrl/Lgn Restrictins Example 2 fr Admin Tiers Tier 0 admin manages the identity stre (Active Directry database). He can define grup membership f Tier 0, Tier 1 (and Tier 2) accunts and he can define security settings fr Tier 0 und Tier 1 servers (and even Tier 2 cmputers) in GPOs. Tier 0 Admin! Tier 0 Tier 0 DC Tier 1 Therefre, the Tier 0 admin must access dsa.msc and gpmc.msc n a DC (where he lgs n). Thus, as required by his rle, the Tier 0 admin can cntrl lwer-tier resurces, but he never lgs n t a lwer-tier system. 67

68 The Prblem: AD Brders Neither Well-defined Nr Cntrlled: AD Extensin Int the Clud 68

69 Azure (Clud) 69

Active Directory Core Security Principles & Best Practices

Active Directory Core Security Principles & Best Practices Active Directry Cre Security Principles & Best Practices INSIGHT SUMMIT SERIES 2018 Friedwart Kuhn & Heinrich Wiederkehr signed by Friedwart Digitally Friedwart Kuhn Date: 2018.11.15 Kuhn 22:05:03 +01'00'