Active Directory Security
Categories
- Active Directory Backup & Recovery (69)
- Active Directory Security (243)
- AD Security 101 (18)
- Community Tools (26)
- Crisis Management (5)
- Directory Modernization (10)
- From the Front Lines (70)
- Hybrid Identity Protection (92)
- Identity Attack Catalog (32)
- Identity Security Research Library (4)
- Identity Threat Detection & Response (173)
- Our Mission: Be a Force for Good (14)
- Purple Knight (6)
- Semperis University (5)
- The CISO's Perspective (18)
- Threat Research (85)
- Uncategorized (3)
The Weaponization of Active Directory: An Inside Look at Ransomware Attacks Ryuk, Maze, and SaveTheQueen
- Thomas Leduc
Like never before, Active Directory (AD) is in the attackers’ crosshairs. In this blog, we'll examine how ransomware attacks are abusing AD and how enterprises can evolve their defensive strategies to stay ahead of attackers. First, a quick note about the recent privilege escalation vulnerability dubbed Zerologon, which allows an unauthenticated attacker with network access to…
Takeaways from Zerologon: The Latest Domain Controller Attack
- Thomas Leduc
If there was ever a time to re-examine the security of your Active Directory, it’s now. In response to rising concerns about the notorious Zerologon vulnerability (CVE-2020-1472), the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an "Emergency Directive" to federal agencies to apply Microsoft's patch immediately. Enterprises would…
New survey reveals dangerous gaps in crisis management plans
- Thomas Leduc
When a storm hits, the one who is most prepared is the one who will weather it best. For IT, this storm is digital, a flurry of cyberattacks that routinely touches down on the shores of Microsoft Active Directory (AD). AD is a juicy target, and we all know why.…
Vulnerabilities in Active Directory: The CISO’s Achilles Heel
- Darren Mar-Elia | Principal Security Strategist
Understanding how compromises occur is a fundamental part of forming a cybersecurity defense. With that in mind, I recently joined Andy Robbins, co-creator of the open source attack path discovery tool, BloodHound, for a webinar that outlined how attackers target Active Directory (AD). During the presentation, we spotlighted an uncomfortable truth: the center of enterprise identity services…
Why I’m Hanging Out With the Semperis Crew
- Chris Roberts
Let's start with a little history lesson... Back in 2014, there were a series of articles calling for the dismantling and death of Active Directory (AD) for various reasons. Fast forward to 2018, and we made calls for its demise, or simply that companies should take their AD servers, throw…
Understanding Group Policy Privilege Escalation in CVE-2020-1317
- Darren Mar-Elia | Principal Security Strategist
Last month, Microsoft released an advisory for CVE-2020-1317 which describes a privilege escalation vulnerability in Group Policy. This was further detailed by the discoverer of the vulnerability on the Cyberark website. The nature of this issue is interesting and worth understanding. For years, Group Policy has had this dichotomy built into its…
The Dos and Don’ts of AD Recovery
- Gil Kirkpatrick
Last month I was able to catch up with my long-time friend Guido Grillenmeier, who is currently Chief Technologist at DXC Technology. In 2007-2008, Guido and I worked together, developing and delivering the “Active Directory Masters of Disaster” disaster recovery workshops at the Directory Experts Conference. It was, at the…
Take Back the Keys to Your Kingdom with the Latest Release of Semperis Directory Services Protector
- Darren Mar-Elia | Principal Security Strategist
Active Directory is foundational to everything you do and the #1 new target for attackers. Since it wasn’t originally built with today’s threats in mind, Active Directory is riddled with inherent soft spots and risky configurations that attackers are readily taking advantage of. We, here at Semperis, are excited to announce a new release of Directory Services Protector (DS Protector) and the powerful features it includes to detect dangerous vulnerabilities, intercept…
