It is very well known that Active Directory credentials can be compromised quite easily. It is therefore vital for companies to better secure those credentials in order to avoid a network breach.
Active Directory – One Identity Source for all Access
Today, 90% of companies still rely on Active Directory as the primary source of trust for identity and access.
Developed by Microsoft for Windows domain networks, Active Directory provides ‘authentication services’ to verify the user is who they say they are, ‘authentication and authorization’ to access resources on the network and ‘group policy processing’ to enforce security settings across clients and servers in the organization.
Nowadays, as more and more businesses extend their architecture outside of traditional perimeters, many more users depend on RDP connections and a VPN access strategy for remote access. VPNs rely upon an on-premises corporate identity source – usually Active Directory – to authenticate users who are accessing the company network.
How Access is Crucial to Prevent Attacks
Cyber-attacks on Active Directory are not a question of if, but rather a question of when. In most successful attacks, Active Directory is manipulated, encrypted or destroyed. The reason is simple: there are very few vital IT assets that allow attackers to spread after an initial breach, and one dominates them all: Active Directory.
More than 80% of hacking related breaches involve the use of lost or stolen credentials. They represent an entry point into a company’s network and its data. Without compromising a set of corporate Active Directory credentials, a hacker is powerless to do anything.
It’s important to understand that this first access is only a way to gain access to your network. It’s often a low-level endpoint with no rights to access anything valuable. However, it acts as an initial foothold and allows the hacker to start lateral movement within the network to find valuable data.
Actually, except for perimeter attacks (where attack methods like SQL injections need no credentials to access data), all layers of access within your environment require a logon at some point. Endpoints require logons for access, lateral movement requires authentication to access a target endpoint, and access to data itself first requires an authenticated connection.
Simply put, no logon, no access!
Why Access Management?
You may ask yourself, why Access Management and not Next Gen Antivirus or Endpoint Security for example. It’s a reasonable question. Unlike many security solutions, which attempt to reside at the point of malicious actions, Access Management seeks to seamlessly insert itself into the process, stopping the threat action before it occurs.
- The logon is at the core of every cyber attack
As stated before, the need to logon is common to every type of attack. Whether accomplished using a remote session, via PowerShell, leveraging a mapping of a drive, or by logging on locally to a console, your network requires that a user authenticate themselves before he can get any kind of access.
- Automated access controls actually stops an attack
This is a really important aspect of your security strategy. Almost every security solution on the market pretend they stop attacks. However, you have to be careful here – many solutions only alert IT to a threat potential (which only stops an attack once IT intervenes) whereas some actually take action and stop the attack.
Many security solution require a hacker to do some kind of malicious action such as an attempt to access sensitive data or a copy to a USB stick for example. Identifying a potential breach with Access Management happens before any access is achieved, so before any damage is done.
With Access Management, if a logon falls outside a set of established rules, you can automatically block the access or prompt again for a second factor of authentication. Or if already connected, you can immediately for the logoff and lock the account, putting a stop to the attack before any real malicious actions are taken.
- Accuracy to limit false positives
The dreaded part of any security solution is the potential for a storm of alerts that turn out to be false positives. With so many users logging on and at just about any time of the day, it’s critical that IT have solutions in place that are certain about the attack potential.
Using customized policy-driven controls, Access Management is configured based on the normal use of the environment, only providing alerts when a logon is out of policy.
- Seamless integration with Active Directory for IT Teams
Access Management integrates with the existing logon process to extend, not replace its security. Solutions that work along the existing Active Directory infrastructure don’t frustrate IT teams. They are simple to implement and intuitive to manage.
- Easy adoption by end users
If security is overwhelming and stifles productivity, employees can’t do their job and the solution is not going to be adopted. Access management happens behind the scenes, protecting the employees and the network until the moment the user is truly conflicting with security protocol.
- Training-less Implementation
It would be way too time-consuming if you had to train every single user on how to use some new security solution? Doing this would be a complete non-starter. Access Management should be requiring zero training, making implementation easy in any type of company.
- Supports the Zero Trust Model
The principle of Zero trust is ‘never trust, always verify’; it recognizes the need to see and verify everything that’s accessing and going on in the company network. Customized two factor authentication and granular access restrictions can be created to specifically put more strict limits, alerts, and responses on those with high risk.
- Cost Effectiveness
Security doesn’t have to be expensive – but it does have to be effective in relation to its cost. Access management makes sure you have the most security protection with the least amount of money spent.
Securing Organizations at the Logon
Effective access management solutions provide companies with the ability to seamlessly secure logins on their entire Windows Active Directory network. It allows business to continue as normal but adds the scrutiny and control necessary to automatically shut down suspicious activity at the point of entry.
About the Author
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.
