Microsoft Active Directory (AD) is currently used by over 90% of large organizations. It functions as the ‘keys to the kingdom’ – a critical identity system that controls user authentication and permissions for the entirety of an organization’s resources and operations. The level of access Active Directory provides is immense, and unsurprisingly, it’s a hacker favorite. Case in point: 88% of Microsoft customers impacted by ransomware didn’t apply AD security best practices, according to Microsoft’s 2022 Digital Defense report.
Traditionally, security has been perimeter-based, i.e., the bad guys are outside the building, and the good guys are in. But this no longer works – given the prevalence of hybrid environments, perimeters effectively no longer exist. It’s nearly impossible to contain an attack, especially in a hybrid environment, as hackers find the weakest spot and spread laterally.
The Zero Trust approach aims to significantly reduce these risks. With Zero Trust, those who are ‘inside’ are no longer implicitly trusted. Active Directory is the foundational system of ‘who’s who’ in most organizations, and is thus the primary system involved in large-scale attacks. This means AD needs to be a core component of any Zero Trust strategy.
The following outlines a step-by-step guide to implementing a Zero Trust approach using Active Directory.
Phase 1: Assessment
First, take stock of which systems you have, and which rely on your AD, both cloud and on-premises. This includes assessing where your accounts are, how different systems interact, access protocols for both administration and business applications, where users and groups are located, and how permissions and access are granted. It’s also important to understand which authentication and SSO platforms your organization employs. The goal of the assessment phase is to get a clear picture of where your identities and permissions live, and how they are related.
Phase 2: Governance
Governance entails defining, developing, monitoring and enforcing policies, including automated accounts and permissions provisioning and deprovisioning to build repeatable processes that can be continuously monitored and assessed. In the context of Zero Trust, identity governance makes trust explicit, rather than implicit. This enables an organization to explicitly grant employees access to systems and data based on their job role, while avoiding overprivileged access and automatically deprovisioning access when an employee changes roles or leaves the company. Clearly defined governance models that are enforced through automated identity governance also enable organizations to satisfy and demonstrate compliance requirements.
Phase 3: Granular Delegated Administration
Active Directory was designed decades ago using a standing administrative privileges model, which no longer applies today. To implement Zero Trust, you must remove all native AD administration permissions and replace them with granular permissions granted to specified personnel for specific tasks within a specific scope, including temporary just-in-time access for unique circumstances. The more you limit standard access privileges, the more you limit the attack surface.
Phase 4: Automation
Automation eliminates manual and error-prone administrative processes and thus the requirement to grant and manage access rights for these. By automating processes and removing manual steps, less trust is given to individual humans, and the attack surface is reduced further. Automation is also tied to governance, as automating access enables you to explicitly define your organization’s governance process. Explicit processes can be assessed, monitored, reviewed, and shared with compliance auditors. Anomalous behavior can be more easily detected.
Phase 5: Monitoring and Threat Detection
Once you’ve designed the system, you need to make sure it runs the way it’s supposed to. Monitoring how your planned Zero Trust processes run in reality enables you to catch any red flags and suspicious behaviors for continual improvements.
Threat detection takes monitoring to the next level, enabling you to track for specific behaviors and patterns that indicate your organization is vulnerable, has been compromised, or is under attack. This includes common identity attacks such as password spraying, Golden Ticket and Silver Ticket attacks, modified administrative access, group policies, and others. Threat detection can also use machine learning to fine-tune attack and anomaly detection over time.
Phase 6: Recovery
While recovery is not always considered part of implementing Zero Trust, you need a plan for when things go wrong. When AD goes down, everything comes to a halt. Employees log in through AD, and it often controls the authorization for all directory-enabled applications across line of business, accounting, marketing, product and other departments, as well as printers, file shares and other core resources. An AD outage impacts all parties connected to your organization including employees, customers, partners and suppliers. Should an attack occur, you need to be able to get back to an operational state quickly. Develop a recovery plan that will enable you to restore AD as quickly as possible.
Additional Best Practices
The following are additional considerations in implementing Zero Trust for Active Directory:
- Identity verification: Ensure authentication methods such as MFA are in place for accessing AD resources, including the ability to monitor and track for multiple failed MFA login attempts.
- Incident response plan: Develop an incident response plan specific to Active Directory security incidents to ensure a swift and coordinated response to any security breaches or anomalies detected within the AD environment. Be sure to test it daily in an automated way, and factor in rollback capabilities in the event that an attack spurs an outage.
- Endpoints: Endpoints and devices need to be part of the Zero Trust framework as well, as employees use their Active Directory accounts across their devices. Remove local administrative privileges on employee devices and implement centralized and automated device protection and management policies.
Active Directory is the core identity and access management system for the majority of enterprises. As such, it is the perfect attack target – a critical risk vector that must be addressed in any effective Zero Trust strategy. Active Directory’s security posture directly impacts an organization’s cyber resilience and business continuity. Implementing robust Zero Trust principles with Active Directory in mind enables organizations to protect core IT infrastructure from identity-based attacks. Ultimately, safeguarding this foundational system should be a cornerstone of every organization’s cyber defense strategy.
About Dmitry Sotnikov
Dmitry Sotnikov is Chief Product Officer at Cayosoft, which offers the only unified solution enabling organizations to securely manage, continuously monitor for threats or suspect changes, and instantly recover their Microsoft platforms, including on-premises Active Directory, hybrid AD, Entra ID, Office 365, and more.
Dmitry spearheads the vision, strategy, design, and delivery of Cayosoft’s software products, ensuring they resonate with market demands and offer unmatched value to users. With over two decades in enterprise IT software, cloud computing, and security, Dmitry has held pivotal roles at esteemed organizations like Netwrix, 42Crunch, WSO2, Jelastic, and Quest Software. His academic credentials include MA degrees in Computer Science and Economics, complemented by Executive Education from Stanford University Graduate School of Business. Beyond his corporate endeavors, Dmitry serves on the Advisory Board at the University of California, Riverside Extension, and has been recognized with 11 consecutive MVP awards from Microsoft.
