Tip

Designing Active Directory security through risk analysis

When designing and ultimately deploying any environment, you need to take the time to perform a risk analysis or a threat evaluation. This focused activity will help in guiding your security efforts towards those areas in greatest need of immediate attention. Your security planning process should result in a detailed outline of procedures for dealing with risk mitigation as well as problem resolution.

Risk mitigation or proactive security deals with problems before they are exploited against your environment. It is the task of evaluating your deployment designs, determining the weaknesses, and selecting countermeasures and safeguards to reduce those weaknesses. Problem resolution or reactive security (also known as contingency planning) deals with problems once they occur in a production environment. Problem resolution is an ordered procedure on how to deal with security violations. Problem resolution manages the issues when a threat was not preempted, when a threat is not fully mitigated, and when security mechanisms were not implemented.

The first step toward establishing a security solution for AD is to identify threats to Active Directory. The second step is to identify the sources of those threats. Then the third step is to establish a proactive or reactive strategy for dealing with the threat.

As for identifying threats to Active Directory, there are several. They include:

  • Object spoofing
  • Bypassing login restrictions to spoof

    Requires Free Membership to View

  • a user
  • Using stolen credentials
  • Data manipulation
  • Users performing authorization elevation attacks to gain access to restricted data
  • Disabling or interfering with event logging
  • Altering a log file
  • Violating data confidentiality
  • Capturing data in transit
  • Using social engineering against users
  • Implementing denial of service attacks to exploit software flaws or consume bandwidth
  • Running untrusted code
  • Users failing to comply with written scurrility policies and best practices

Sources of these and other threats come from at least five different roles or types of people:

  • Anonymous users (includes external hackers)
  • Authenticated users
  • Service administrators
  • Data or storage administrators
  • People with physical access to systems

Some of the general principles that can be put into practice to provide proactive protection against these threats include:

  • Establishing Secure Active Directory Boundaries
  • Deploying Secure Domain Controllers
  • Strengthening Domain and Domain Controller Policy Settings
  • Establishing Secure Administrative Practices
  • Securing DNS

Some of the general principles that can be put into practice to provide reactive protection against these threats include:

  • Manage and control privileged AD operations
  • Monitor and detect potential AD attacks
  • Deploy defenses against future repeat of discovered AD attacks
  • Recovery and restore AD after an attack

In later tips we'll discuss each of these proactive and reactive means in your efforts to deploy a more secure AD environment.


James Michael Stewart is a partner and researcher for ITinfopros, a technology-focused writing and training organization.


This was first published in January 2004

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.