Skip to main content

Securing Active Directory with the Least Privilege Principle

Securing AD with Least Privilege Principle

I have been working for the last number of weeks on a project to secure AD, and to reduce the Attack Surface of AD.

If you are not on board with why you need to secure AD from compromise, and to establish good security work habits, please view one or more of the following videos.  These show how incredibly easy it is for a hacker to break in to your systems.

From Microsoft Ignite 2015.

Next step is to review and become familiar with Microsoft's Best Practices for Securing AD.
http://www.microsoft.com/en-ca/download/details.aspx?id=38785

Some of the key components of these documents and video's are:
  • Set up your Active Directory so that there are normally ZERO members of the privileged groups.
    Use Role-Based "Least Privileged Principle" and elevate the role of your senior Admin to Domain Admins just for the duration required to perform the task.
  • Never assign a Service Account to the Privileged Groups (Domain Admin).
    It is easy for a hacker to ask a server what Service Accounts exist, and then they can focus their attack on those accounts.
  • Never log in to a workstation with a Domain Admin ID.
  • Set up Alerts for logins to workstations from any members of the AD Privileged groups.
  • Restrict access to back-end servers from anything but their corresponding front-end servers.
  • Enable Filewall and IPSEC rules to only allow access to important servers from trusted hosts using trusted ID's.  
  • ...
Labels:

Comments

Post a Comment

Popular posts from this blog

"Blinky" TDOA RDF Detector

Our local Amateur Radio club is building a Radio Direction Finding TDOA (Time Difference of Arrival) detector that has LED's to indicate the direction (Left or right) of the fox.  Here are the build instructions.   (Note: this project was originally presented by NZ1J.  See his video:   https://www.youtube.com/watch?v=mNqUKYkifOo&t=68s   ) Here is the completed project: We start with the schematic:   Note that you either install PIN Diode pairs s D3 and D2, or Diodes pair D1 and D4.   The difference between these is the packaging.  If you are ok with Surface mount, then install D1/D4.  If you want discrete components use D3/D2. Next is the PCB.   The PCB can be ordered using the GRBR files available from the author.  The BOM for the electronic parts is as such: Doppler Direction Finder Bill of Materials   11/12/2021        Qty Part Digi-key Part Numbe...
5 comments
Read more

Radio Direction Finding - TDOA

This article describes a few projects that I built from plans for Amateur Radio Fox Hunting. Basically, the hobby/sport is for someone to hide a few low power "Foxes", which are small transmitters that beep or send Morse Code, and then have a bunch of HAM's try to find them. The first project that I built was a Yagi Antenna (Directional receiver) and a 4MHZ Offset Attenuator.  The attenuator is needed when you get close to the fox and you need to reduce the power of the received signal.  I struggled with this setup because, on my first 2 fox hunts, there was too much reflection and multi-path interference.  This causes false direction detection and if you are not mentally prepared for this, you want to throw all of your equipment into a garbage can and take up a different hobby.   There are some truly strange individuals who find this frustration fun and enjoy making other people suffer, but I will leave that discussion for another day.  Anyw...
Post a Comment
Read more

Repetier host "Exception during socket read:Too many items in the combo box" - Solved!

I purchased a new BoXZY (3D printer, laser and CNC Mill) and have been pretty pleased so far. See https://boxzy.com/ One little issue though is that I have been trying to configure it so that I can 3D print from my laptop without having to connect a USB cable to the printer. The layout in my office is not convenient for the cable to span across the room.  Also, when I start using it for CNC Milling, I do not want to necessarily have my laptop too close to the router making all the dust.  My first attempts to install Repetier Server on various platforms was less than successful. I found that I often would get the error message "Exception during socket read:Too many items in the combo box" when I connected the application to whatever server that I configured. What confused me is that it would work perfectly on one of several computers,. but I could not find a root cause. In addition, I received a Smart Controller (Beta) from BoXZY which came with Windows 10 H...
1 comment
Read more