1. Best Practices to Protect Active Directory and other Critical IT Applications
Russell Rice
Senior Director, Product Management
Skyport Systems
February 11, 2016

2. Critical IT Systems Identity and Authentication
Active Directory / Kerberos / SAML
Network Support Services
DNS / IPAM / RADIUS
Infrastructure Management
VM Management / App Cluster Management
Automation / DevOps
Puppet / Chef / SW Distribution

3. Keys to the Kingdom VM Orchestration Network Config Users & Data DNS
Active Directory
VM Controller
Software Dist
DevOps/ SDN
VM Orchestration
Network Config
Users & Data

4. Common Techniques to Compromise Infrastructure
EXPLOIT
Steal Admin Credentials
Remotely Exploitable Vulnerabilities
Spoof & MITM
(ex: DNS Cache Poisoning)

5. AD Threat #1: Admin Credential Theft
Admin Workstation 2
Compromise admin system via phishing/etc
Steal cached AD server admin credential
Attacker 3
Login to DC, compromise system, get golden ticket
Active Directory

6. Nightmare Scenario: Stolen AD Credential DB1 2 3
AD DC is compromised
Credentials siphoned to innocuous compromised “staging” system
Credentials send to attacker’s over approved comms path
AD Database / SYSVOL
Comprised intermediate “staging” system
Attacker’s system
How do you know your AD database has not been exfiltrated?
Validate & make it look good
Do we want to show the FW being bypassed in step 3?

7. Break the Cyber Kill Chain
Infiltrate
Control
Exfiltrate
Recon
Disrupt external scans, enforce strict microsegmentation
Verify and update system security & patch posture
Reduce attack surface area: block unauthorized connections and malware insertion
Verify infrastructure and application / VM integrity
Secure privileged access with credential management (OS & app)
Ensure a forensic audit trail of admin and events in a tamper-proof log
Stop exfiltration of covert or unauthorized channels
Encrypt in motion and at rest data an executable

8. Microsoft: Securing Privileged Access Protect Active Directory
Attack
Defense
Adversaries gain control of privileged access using a variety of methods
Mitigating this risk requires a holistic and detailed technical approach
Microsoft recommends a roadmap:
Quickly mitigate most frequently used attack techniques
Build visibility and control of admin activity
Continue building defenses to a more proactive security posture
Credential Theft & Abuse
Prevent Escalation
Prevent Lateral Traversal
Increase Privilege Usage Visibility
DC Host Attacks
Harden DC Configuration
Reduce DC Agent Attack Surface
AD Attacks
Assign Least Privilege
Attacker Stealth
Detect Attacks

9. Secure AD Administrative Enclave “ESAE” or “Red Forest”
Production Forest
Red Forest
Physical Vault
Domain Users
Tier 2
Domain Servers
Tier 1
Domain Control
Tier 0
RO Prod DC
Server SAW
Production Forest SAW
Red Forest SAW
Domain Controller
Domain Controller

10. Application Security Guides: The Fine Print
Active Directory
vCenter

11. Best Practices for Securing Critical IT Systems
Network Security
Microsegmentation
Per-VM Firewall Policy
Traffic visualization & audit
Prevent data exfiltration
Diagnostics and forensics
Secure the Application
Secure the Communication
Platform Security
Trusted Hardware Platform
Remote management & telemetry
Systems lifecycle mgmt & audit
Policy lifecycle mgmt & audit
Secured administrative access
Secure the Platform

12. Protect All Levels of the Platform Stack
Ctrl/Mgmt Plane
Protect against insider threat
Protect against infrastructure attacks
Defend against credential compromise attacks
Defend against data exfiltration
Protect against protocol level attacks
Protect against lateral attacks
Protect against covert channels
VM Environment (Compartment)
Hypervisor & OS
Protect against hypervisor break-out attacks
Protect against OS and process-level attacks
Firmware
Protect (and remediate) against firmware compromise Integrity verification (TPM or equiv)
Hardware
Protect against physical attacks
Trusted platform for anchor of trust

13. Services are a Mandatory Ingredient
Authentication / Secure Enclave
HSM
Key Mgmt
Credential
Mgmt
Remote Attestation
Security Data Warehouse
Policy & Management

14. Ultimate Goal: Private DMZ per VM with a Clean Source
Network Zone-Based DMZ
DMZ Network Zone
Coarse grain protection for the entire zone
No protection between systems in DMZ
Complex integration and management
Per-VM DMZ
Private DMZ with custom protections per VM
Trusted compute for a Clean Source
Must be easy to operate and scale
DMZ VM
Security Controls
DMZ VM
DMZ VM