Cyber Security | Active Directory Security Assessment

Active Directory Security Assessment

Active Directory is backbone of windows servers in an organization. It stores all the data related to accounts. Active Directory stores data as objects. An object is a single element, such as a user, group, application, or device. It categorizes directory objects by name and attributes.  

Organizations often face challenge to properly maintain configurations and keep up to date security improvements of Active Directory. As well poorly configured AD policy can expose the environment into potential threats. Sometimes misconfiguration is also critical to security. Many Windows security subsystems are integrated with it, and many of them can be used to secure it.

There is a series of repetitive tasks that can be considered to continually improve the basic security posture and respond to variations in threats, knowledge, infrastructure and requirement. 

While doing security assessment, there are three basic phases of the assessment. 

1. Gather data from on site of remote.
2. Analyze the result
3. Complete assessment and provide recommendations

The Active Directory Assessment focuses on several parameters, such as;

• Site Topology and Subnets
• Operational processes
• Active Directory Replication
• Domain Controller Health
• Active Directory Database
• Account Information
• OS Information and Networking
• Infrastructure design and defense, Security boundary
• SYSVOL and Group Policy Health
• Name Resolution (DNS)
• File & registry permission
• Administrative role and structure

The following checklist may help organizations to assess and maintain the security of their Active Directory deployments: 

• Ensure that the logical (forest, domain and trust-relationship) structure of your Active Directory is conceptually secure. 
• Ensure that all Active Directory configuration (e.g. Schema, Replication, FSMOs, Backups) data is sound and secure. 
• Ensure that adequate Active Directory management, security and disaster-recovery plans are in place and implemented. 
• Ensure that adequate physical, system and network security is provided for all Domain Control Ensure that the number of IT personnel who possess unrestricted administrative access in Active Directory is minimal. 
• Ensure that all non-critical administrative tasks (e.g. password resets) are delegated based on the principal of least privilege. 
• Ensure that IT personnel can audit all administrative delegations (i.e. assess and verify effective access) in Active Directory. 
• Ensure that auditing mechanisms are in place to capture the enactment of all admin/delegated tasks in Active Directory.
• Ensure that all applications and tools used by IT personnel are trustworthy (i.e. verifiably safe, reputable and secure).
• Ensure that security and effective access audits are performed on a regular basis to consistently ensure security.

- DR