Detecting & Mitigating Cyber Attacks

Identity systems continue to be a prime attack vector for cyber criminals despite well-known vulnerabilities, especially in Active Directory, the core identity store for 90 percent of businesses worldwide. Indeed, Mandiant FireEye researchers have reported that 90% of the incidents they investigate involve Microsoft's Active Directory in some way. 

Since the surge in identity-related attacks and vulnerabilities like the Colonial Pipeline breach there has been a lot more  expert advice available and now the identity protection experts at Semperis have released their Active Directory Security Halftime ReportThis is the first in a periodic series of insights and practical skill-building resources for preventing and mitigating identity-related cyber-attacks. 

“Cybersecurity programs, big and small, are on the front lines of a new war that has virtually no boundaries and no rules of engagement,”said Mickey Bresman, CEO at Semperis. “If you think about hospitals that can’t access their systems to save a life, or cities that get held hostage, we have a responsibility to help organizations take back control. That’s what drives us... Active Directory remains the beating heart of identity management, the core of the identity platform for most organisations, but everything around it has changed rapidly.”

“AD secure configuration was not as much of a concern 15 years ago, and many recommendations that were provided at the time turned out to be insecure and have been completely revised since, so a lot of the mistakes that were made then are the problems organisations now need to address,” Bresman said.

Bresman also calls out lagging skill sets at a time when conversations about protecting the business from cyber attack are converging for identity and security teams.

“You have people that know AD extremely well, but their thinking is more operationally related,” said Bresman. “Or you have people that know red-teaming and security extremely well, but they are not AD experts. It's not that simple to find that combination of skills in a single person.” 

The Semeperis Report highlights the essential areas of focus for identity and access management (IAM) teams, security teams, and CISOs responsible for guarding organisations’ identity systems. More than two-thirds of the Halftime Report provides how-to guidance from highly experienced identity experts (including longtime recognized Microsoft MVPs) for preventing, mitigating, and recovering from identity system cyber-attacks.

With an emphasis on fast-track skills-building for identity and security professionals, the Active Directory Security Halftime Report consolidates:  

  • Practical guidelines for hardening AD security by closing common gaps that can be uncovered with the free security assessment tool Purple Knight, built by Semperis identity and access management (IAM) experts 
  • New perspectives on building a cyber-resilient organisation by breaking down silos between identity and security teams 
  • Tips for managing security in increasingly complex hybrid identity systems, particularly across on-premises Active Directory and Azure Active Directory environments 
  • Trends in cyber criminals’ tactics for compromising identity systems, as highlighted in the monthly Semperis Reports.  
  • The Active Directory Security Halftime Report, will be updated on a periodic basis to serve as a timely, concise index of resources for organisations that have prioritised hardening their Active Directory and Azure Active Directory defenses against escalating cyber-attacks. 

Although the threat landscape is continually expanding, organisations can improve their security posture by methodically identifying and addressing the well-known identity-related vulnerabilities covered in the Semperis Active Directory Security Halftime Report.

“Regardless of the particular mix of on-premises and cloud systems and assets, every organisation will need to protect the identity store,” said Bresman. “Identity is going to continue to play a huge role in the protection game that we are playing against the adversaries.”

Semperis:          Mandiant FireEye:

You Might Also Read:

Hackers Delight: Poor Password Security:

 

« NSA Warning - Avoid Public Wi-Fi
Pakistan’s New Cyber Security Policy »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Perforce Software

Perforce Software

Perforce helps companies build complex software products more collaboratively, securely, and efficiently.

Datiphy

Datiphy

Datiphy's data-centric security platform uses behavioral analytics, and data-centric auditing and protection capabilities to mitigate risk.

BlueID

BlueID

BlueID is an IDaaS technology product which enables your objects to securely connect and interact with your users’ smart phones and smart watches.

Wayra UK

Wayra UK

Wayra UK, part of Telefónica Open Future, has been chosen to run a new cyber accelerator facility to help UK start-ups grow and take the lead in producing the next generation of cyber security systems

Smarttech247

Smarttech247

Smarttech247 deliver a range of cyber security solutions, including cognitive security services using IBM Watson for Cybersecurity, SIEM, Compliance & Governance, and Penetration Testing.

Recovery Point Systems

Recovery Point Systems

Recovery Point is a leading national provider of IT secure and compliant infrastructure and business resilience services.

Novastor

Novastor

NovaStor® is an award-winning, international data backup and recovery software company with solutions supporting physical, virtual and cloud environments.

aDolus Technology

aDolus Technology

aDolus delivers a robust solution for safeguarding against counterfeit or malicious software and firmware in mission-critical systems.

Inflexor Ventures

Inflexor Ventures

Inflexor Ventures is a technology focused venture capital firm that invests in early stage companies from seed to Series-A+ stages.

RMRF Tech

RMRF Tech

RMRF is a team of cybersecurity engineers and penetration testers which specializes in the development of solutions for early cyber threat detection and prevention.

HEQA Security

HEQA Security

HEQA Security (formerly QuantLR) offer the world’s most cost-effective, easy-to-integrate, and secure Quantum Key Distribution (QKD) solution

Cyware

Cyware

Cyware is the only company building Virtual Cyber Fusion Centers enabling end-to-end threat intelligence automation, sharing, and unprecedented threat response for organizations globally.

Traceable

Traceable

Traceable was founded to protect applications from next-generation attacks.

Prompt Security

Prompt Security

Prompt Security provides an LLM agnostic approach to ensure security, data privacy and safety across all aspects of Generative AI.

TisOva

TisOva

TisOva is an innovative cybersecurity startup dedicated to addressing the growing issue of online scams targeting students.

GlitchSecure

GlitchSecure

GlitchSecure helps companies secure their products and infrastructure through real-time continuous security testing.