Active Directory (AD) Security Review

We perform various checks and reviews to ensure that your Active Directory (AD) instance has been set up in a secure fashion in order to defend against various latest cyber attacks and threat vectors.

What is Active Directory?

Active Directory (AD) is a technology used on Microsoft Windows-based servers and systems. AD enables system administrators to create and manage domains, users and objects within an organisation’s network.

Active Directory Security

By using a standardised methodology for performing the assessment, it can be easily integrated into a regular testing cycle enabling you to regularly assess your AD installation for common problems and providing assurance that the core of your organisation’s network is secure.

Key benefits of this service includes:

• Test the core of your organisation’s AD installation and the corporate network.
• Covers all top vulnerabilities and commonly found issues.
• Less complex than using dedicated teams or performing a penetration testing exercise.
• Get a quick assessment report that is easily comprehensible.

Methodology

The following is an example of what we will typically cover when performing this assessment:

• Configuration review 
  Due to a large number of objects (such as groups and organisational units, etc.) involved in an AD, it is common to find unused or old accounts which result in the creation of a path for an attacker to gain domain administration level access. We identify these so they can be addressed and the paths removed.
• Password control
  To test an enterprise’s effectiveness at password management, we would attempt to crack as many passwords as possible using an offline approach and assess password change practices. We then identify and report on any improvements and recommendations in relation to password setting and usage.
• Harvesting user credentials
  Credentials are often found unsecured on network shares within an organisation. In this assessment, we search your networks for these and any similar privileged information that we can harvest as part of the test.
• Exploitation & Privilege Escalation
  Escalation can occur via taking advantage of unpatched privilege escalation vulnerability. For example finding local administrator credentials in SYSVOL.

For more information please contact us.