![\"Active](\"https:\/\/solutionsreview.com\/identity-management\/files\/2023\/09\/The-Best-Defense-Against-Insider-Threats-Securing-Active-Directory.jpg\")
<\/p>\n<\/p>\n
Solutions Review\u2019s\u00a0Contributed Content Series<\/u><\/a> is a collection of contributed articles written by thought leaders in enterprise software categories. Igor Baikalov of Semperis<\/a> walks us through the ins and outs of an insider attack and why preventing it starts with protecting the Active Directory.<\/strong><\/em><\/p>\n Cybersecurity protections tend to focus on external threats. This approach is understandable, considering the increased sophistication and activity of both nation-state and criminal actors. However, organizations shouldn\u2019t overlook the rise of insider threats, which \u2014 whether intentional or unintentional \u2014 pose just as much danger as external threats to an enterprise, its data, and its ability to operate.<\/p>\n Thinking of malicious outside actors as the enemy, at least in cybersecurity terms, is reasonable. Yet insider threats pose a serious risk to businesses precisely because they are trusted sources. By design, insiders have access to the organization\u2019s critical resources and sensitive data to fulfill their work duties.<\/p>\n Although external malicious actors receive most media attention, insider threats are on the rise, having increased by 44 percent over the past two years. Negligence by employees or contractors accounts for 56 percent of those threats; 26 percent of the threats result from malicious intent. For two-thirds of companies, insider-related incidents occur up to 40 times per year, with each incident incurring an average cost of $484,931\u2014 a high price to pay for those who are unable to catch insider threats in time.<\/p>\n Regardless of intent, many organizations lack the ability to identify vulnerabilities that can result in insider abuse. Furthermore, many are unable to perform post-breach forensics to close backdoors left by malicious insiders. It\u2019s clear that businesses need to improve their defenses against these growing and costly attacks.<\/p>\n Access abuse is at the core of most insider threats, whether from employees, contractors, vendors, or partners. Anyone with permission to access critical business assets can potentially abuse that privilege, either through negligence or malicious intent.<\/p>\n A good place to start shoring up identity and access controls is by securing and monitoring Active Directory (AD). AD is a prime target for attackers and is involved in nine out of ten cyber-attacks. Not coincidentally, AD is also the primary identity store for 90 percent of organizations worldwide. A recent survey of IT and security leaders found that 16 percent of enterprises use on-premises AD as their primary data store, and 80 percent use a hybrid of AD and Entra ID (previously Azure AD) or other systems. Only four percent don\u2019t use AD or Entra ID at all.<\/p>\n AD\u2019s prominence in the enterprise means that its weaknesses can be exploited at any point that an employee, contractor, or other user has access. If an AD administrator doesn\u2019t follow all employee offboarding policies, for example, the departing employee\u2019s account could remain active after they\u2019ve left the company. An attacker could exploit that account\u2019s credentials to gain access, escalate privileges, and move through the network. The damage can be serious: 77 percent of the survey respondents classified the impact of AD being down as severe or even catastrophic.<\/p>\n Such findings indicate that organizations need to adopt an identity-first security strategy that involves threat intelligence, behavioral signatures, continuous monitoring, and other techniques to address every phase of the attack cycle\u2014 before, during, and after an attack.<\/p>\n Security teams looking to bolster their AD defenses should start with a thorough, realistic view of the identity attack surface. The goal is to uncover security vulnerabilities, such as accounts with expired passwords or accounts that are no longer active. As part of this effort, organizations should scan their IT environment for indicators of exposure (IOEs).<\/p>\n IOEs refer to weaknesses in an organization\u2019s IT environment that an attacker could exploit. These indicators attempt to answer questions such as:<\/p>\n For instance, an AD misconfiguration could grant administrative privileges to every member of a team or grant privileged access to a vendor that doesn\u2019t need it. IOEs can help an organization find vulnerabilities that increase its susceptibility to an attack.<\/p>\n Continuous monitoring is also incredibly important to an organization\u2019s ability to identify indicators of compromise (IOCs). In most cases, handling or containing IOCs is more urgent than mitigating IOEs; IOCs can indicate a successful intrusion. These indicators attempt to identify whether any behavior in an organization\u2019s system might indicate an attack in progress. For example, 50 password reset attempts within one minute are atypical behaviors that could indicate an ongoing attack. Overall, IOCs enable organizations to identify whether they are under attack and even the path of the attack.<\/p>\n If you think of an attack as a process rather than as a binary condition, you can better understand the benefits of uncovering these indicators. Launching a full-scale attack is not a one-step leap. An attacker must start from point A to reach point D. Attackers require several steps to, for example, compromise one system, then a security account, then a computer object, and so on, until finally gaining administrative control in Active Directory\u2014 the crown jewel for attackers. Identifying an attack in progress enables an organization to freeze the compromised identity, thus stopping the attack in its tracks.<\/p>\n If an IOC flags an attack underway, organizations should continuously monitor for other IOCs, track risky changes to on-prem AD and Entra ID, and automatically roll back specific changes that could signal an attack. Among the actions to monitor for:<\/p>\n Continuous monitoring of the AD environment is critical, enabling an organization to promptly address potential security issues as they occur and helping to ensure the ongoing security of the environment.<\/p>\n In the wake of an attack, post-breach forensics are essential to understand the attack\u2019s behaviors and the weaknesses exploited as part of the attack. This step can also help organizations find and fix vulnerabilities, thus preventing them from being exploited in future attacks.<\/p>\n By conducting a thorough post-attack analysis, organizations can answer questions that will help them understand how the attack occurred and where they might need extra protection:<\/p>\n \u00a0<\/strong>The insider threat is real and on the rise. The best security strategy is to address threats across the entire attack lifecycle\u2014 before, during, and after an attack. Because most advanced attacks use identity-based techniques, it\u2019s essential to continuously and proactively monitor AD to uncover threats and misconfigurations within the IT environment. Doing so will help you prevent insider threats\u2014 and enable you to quickly detect and respond should an attack happen.<\/p>\n Solutions Review\u2019s\u00a0Contributed Content Series is a collection of contributed articles written by thought leaders in enterprise software categories. Igor Baikalov of Semperis walks us through the ins and outs of an insider attack and why preventing it starts with protecting the Active Directory. Cybersecurity protections tend to focus on external threats. This approach is understandable, […]<\/p>\n","protected":false},"author":918,"featured_media":6850,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5,1],"tags":[],"acf":[],"yoast_head":"\n
Widget not in any sidebars
\nThe Best Defense Against Insider Threats: Securing Active Directory<\/strong><\/h2>\n
\nStart by Securing Active Directory<\/strong><\/h3>\n
Before an Attack<\/strong><\/h3>\n
\n
During an Attack<\/strong><\/h3>\n
\n
After an Attack<\/strong><\/h3>\n
\n
Widget not in any sidebars
\n","protected":false},"excerpt":{"rendered":"