Bootstrapping Trust – A Billion Dollar Cyber Security Problem (Responding to a Domain Admin Account Compromise)

Folks,

A few days ago I posed a seemingly simple question to the world's foremost global community of Active Directory Security Professionals – How does one respond to a Domain Admin Account compromise?

 

I say "seemingly simple" because in fact it is a "very difficult" question. (Strictly speaking, it is not the answer that is difficult, but rather the implementation of the measures suggested by the "right" answer that is "very difficult".) 

 

Before I can answer the question, perhaps I should establish context.

Establishing Context - What does a Domain Account Compromise have to do with Cyber Security?

 

You see, at the very foundation of cyber security at 85+% of all organizations worldwide lies Microsoft’s Active Directory.

 

Consequently, in these organization, the entirety of their IT resources are ultimately protected by Active Directory. 

 

I think Microsoft's CISO, Bret Arsenault stated this most eloquently in a recently released white paper titled Best Practices for Securing Active Directory. Quoting Bret - "Active Directory plays a critical role in the IT infrastructure, and ensures the harmony and security of different network resources in a global, interconnected environment.”

 

In other words, Active Directory plays a critical role in ensuring the proper functioning of and the security afforded to every account, group, laptop, desktop, server, application, etc. deployed in the IT infrastructure.

Consequently, it also follows that the compromise of an organization's Active Directory could potentially be used to compromise any account, group, laptop, desktop, server, any file stored on any server, any application, LOB server etc.

(By the way, given the substantially high potential impact of an Active Directory compromise, it is increasingly becoming a very lucrative target for malicious entities. This point too is made in that white paper.)

 

NOW, in every organization's Active Directory deployment, there are designated Domain Admin accounts that are all-powerful and have virtually complete and unrestricted access to Active Directory and by extension to all computers joined to the Active Directory, and thus realistically, by extension to the entire IT infrastructure.

 

By default, a Domain Admin account holder has complete unrestricted access to all resources in the entire IT infrastructure. This is because every system needs at least one admin account for administration purposes.

 

A consequence of this is that a rogue / coerced Domain Admin could also access, tamper, divulge and destroy virtually any organizational IT resource (i.e. he/she can also subvert virtually any existing security policy as well as disable / control / destroy auditing evidence of virtually any action on any domain-joined machine/system, directly / indirectly.) 

 

In other words Domain Admins hold the proverbial "Keys to the Kingdom" and thus control the very foundation of cyber security in the IT infrastructures of their respective organizations.

 

Impact of a Domain Admin Account Compromise

 

In light of the above, its worth considering the scenario wherein a Domain Admin account was either compromised, or a Domain Admin turned rogue, or whether his/her account was hijacked without his/her knowledge.

In such a situation, as indicated above, the Domain Admin account could basically be used to access, tamper, divulge and destroy virtually any organizational IT resource. His/her account could be used to create any number of accounts and grant them administrative access on any resource in the Active Directory, such as on OUs, admin accounts/groups, GPOs etc.

ONE MORE THING. A Domain Admin's account could also be used to potentially place time-bombed malicious software on ANY domain-joined machine (i.e. any laptop, desktop or server) that could do anything from letting the perpetrator back in from the outside, to automating the destruction of  large parts of the IT infrastructure from the inside, or allowing him/her to easily regain administrative control in the Active Directory itself at a later point in time.

As a result, ONCE a Domain Admin account has been compromised, the entire fabric of TRUST across the IT infrastructure is potentially compromised.

Again, I'm not the only one saying this. Here's a snippet from Microsoft IT's white paper -

"It is generally well-accepted that if an attacker has obtained SYSTEM, Administrator, root, or equivalent access to a computer, regardless of operating system, that computer can no longer be considered trustworthy, no matter how many efforts are made to “clean” the system. Active Directory is no different. If an attacker has obtained privileged access to a domain controller or a highly privileged account in Active Directory, unless you have a record of every modification the attacker makes or a known good backup, you can never restore the directory to a completely trustworthy state."

It continues to read -

"Even if you reinstall every domain controller in the forest, you are simply reinstalling the hosts on which the AD DS database resides. Malicious modifications to Active Directory will replicate to freshly installed domain controllers as easily as they will replicate to domain controllers that have been running for years."

In other words, a Domain Admin account compromise is potentially tantamount to a system-wide compromise.

Responding to a Domain Admin Account Compromise

In light of the above, you'll hopefully see that the ONLY WAY to re-establish TRUST, which is PARAMOUNT to cyber security is to completely re-build the entire IT infrastructure, because that is the only way to ensure that any and every potential machine where the malicious Domain Admin could have potentially left a back door has been wiped clean.

Anything less than a complete re-build will not GUARANTEE the elimination of that risk.

As you can imagine completely re-building an entire IT infrastructure costs a proverbial BILLION DOLLARS. Meaning it is VERY expensive and virtually impossible to do so, even in medium organizations let alone large ones. Not to mention that most organizations will not be able to afford the downtime involved in rebuilding an entire IT infrastructure.

Bootstrapping Trust – A Billion Dollar Cyber Security Problem

Bootstrapping trust, both proverbially and realistically, is thus a billion dollar cyber security problem today. (Hypothetically speaking, just the cost of organization-wide downtime to rebuild the IT infrastructure of a large organization could be a $B.)

The scenario painted above applies to over 85% of all organizations worldwide today, including to almost a 100% of business and government organizations that are household names today. This is a very real global challenge today.

Is There a Million Dollar Fix to this Issue?

As I indicated, although a complete re-build is the only guaranteed way to bootstrap trust a 100%, realistically speaking, it is simply not possible/feasible (without it considerably impacting organization wide business operation).

The following snippet from the same Microsoft IT white paper corroborates this -

"A compromise to the degree described earlier is effectively irreparable, and the standard advice to “flatten and rebuild” every compromised system is simply not feasible or even possible if Active Directory has been compromised or destroyed. Even restoring to a known good state does not eliminate the flaws that allowed the environment to be compromised in the first place."

If the ONLY way to re-establish a 100% TRUST is to rebuild the entire IT infrastructure, which costs a proverbial BILLION dollars, and is not really feasible, is there a proverbial MILLION dollar (i.e cheaper) way to address this challenge?

Yes, and No.

The No part first. Technically, if you're looking to establish a 100% trust, that is the only way to go. I mean you can establish 99% trust for a proverbial MILLION dollars, but NOT 100%. But for many organizations, 99% may be sufficient, especially given where they're at today. (You'd be surprised if I told you just how many organizations have 100s of Domain Admin accounts holders that they don't even know of.)

The Yes part now. There's an old saying - "Prevention is better than cure". Every organization will always need a handful of Domain Admins, because every system needs an Administrator. But NO organization needs or should have more than a handful of Domain Admins, because as indicated above, with each additional Domain Admin you have, you increase the likelihood of the compromise of a very high value IT asset.

So, the Yes in essence relies on prevention, and involves the following -

1. Immediately, REDUCE the number of Domain Admin accounts to a bare minimum
2. Ensure that you can impose the HIGHEST levels of trust in the few Domain Admin accounts
3. Disable their use. Enable them on a need basis, and when used ensure that 2 PAIRS of eyes are involved
4. Establish policies that communicate in no uncertain terms, that should a willful or abetted misuse of administrative authority be found, there will undoubtedly be legal repercussions for the perpetrator
5. Proactively audit administrative access in Active Directory on a weekly/fortnightly basis
6. Implement 24-7 Active Directory Auditing to monitor the management and use of Domain Admin accounts 

(This assumes, of course, that one does not have already a compromised Domain Admin account, today.)

The Yes, is thus not strictly a Yes, but is an approach that can be used to substantially reduce risk realistically. Protecting 3 Domain Admin accounts is far easier (and has a higher likelihood of success) than protecting 30 or 300 Domain Admin accounts.

Why do Organizations have so many Domain Admin Accounts?

Like Microsoft, in our collective experience at Paramount Defenses, over the last half decade, we have had the opportunity to help 1000s of organizations worldwide, and we often come across organizations that have an alarming large number of Domain Admin accounts.

In my humble opinion, the root of this problem has to do with a lack of consistent diligence by IT groups in establishing and enforcing a stringent policy that ensures that access is ALWAYS provisioned based on the principle of least privilege, even when it may be inconvenient to do so.

Most organizations end up trading off comfort for security in this regard, by giving away Domain Admin access to so many individuals just because it is an easy way to not have to deal with the hardship of determining and provisioning least privileged access.

I will also add that many times, IT groups are under-staffed because they just don't have sufficient budget, so they often end up taking the convenient road. It is thus equally important for Executive Management to make this a priority, and adequately fund their IT groups to address this challenge.

Lastly, let me also state unequivocally there there is no shortcoming in Active Directory in regards to being able to precisely authorize/specify access. In fact, Active Directory offers arguably the world's most highly securable security model, wherein access can be very precisely specified based on the principle of least privilege.

Reducing the Number of Domain Admin Accounts

In regards to reducing the number of Domain Admins to facilitate access to resources stored on files servers, and/or to LOB applications etc, there is absolutely NO need to have Domain Admin access. A combination of least privileged local machine-specific access and least privileged network access to the appropriate resources should be sufficient.

As it pertains to reducing the number of Domain Admins to facilitate access to resources within the Active Directory, I'd recommend IT groups to seriously consider leveraging the Delegation of Administration capability to its fullest potential.

Properly implemented, Delegation of Administration, based on the principle of least privilege can be used to reliably delegate all administrative responsibilities (tasks) that do not require Domain Admin access, and virtually eliminate the need for requiring Domain Admin access for all but the most critical of all admin activities (e.g. DCPROMOing a new DC.)

In fact, by leveraging secure (verifiable) least-privilege, role-based delegation in Active Directory, most organizations should be able to reduce their number of Domain Admin accounts by at least 90%, thus substantially reducing risk.

A Word of Caution

Some organizations choose to deploy 3rd party solutions for identity and access management delegation. This approach is an alternative to directly delegating control in Active Directory, and while it may appear to be a secure/efficient alternate, it may actually potentially be laden with high security risks.

For instance, such a proxy solution, may have a requirement that it needs to be run on a Domain Controller, or that it itself needs complete unrestricted access to Active Directory to create and manage objects.

Before deploying ANY solution on a Domain Controller, or ANY Solution that requires UNRESTRICTED access to the Active Directory, organizations must (in their own best interest) ensure that any such solution is at least as TRUSTWORTHY as is the Active Directory itself, because otherwise, it could easily become their weakest link.

When evaluating the TRUSTWORTHINESS of any such solution, one should think about factors like -

1. Is the vendor offering this solution at least as trustworthy as Microsoft?
2. Is this solution developed by highly proficient developers?
3. Is it developed in a trustworthy country, or in some foreign country, where hackers or other malicious entities could easily (physically or via network security compromise) obtain access to its code-base?
 

Why is this important? It is important, because this solution will most likely either be running on a DC or require complete admin access to your Active Directory, so ensuring its utmost TRUSTWORTHINESS is paramount.

(I'm told that there is at least one 3rd party "Active Directory Delegation Solution" which is developed in / supported from Russia. In light of the Snowden affair, when it comes to cyber security, a Russian solution may or may not be a wise choice. In contrast, Active Directory's trustworthiness is unparalleled, which is why so many organizations worldwide choose to natively delegate administrative access in Active Directory.)

Time's Up

My 10 minute timer just rang, so I will have to end this here. I hope you now see why Bootstrapping Trust is a Billion Dollar Cyber Security Problem today, and why organizations MUST make it a high priority to reduce the number of Domain Admin accounts.  Using secure (verifiable) least-privilege, role-based delegation in Active Directory is one of the easiest ways in which organizations can reduce their number of Domain Admin accounts by at least 90%, thus substantially reducing risk.

Best wishes,

Sanjay

PS: 2016 Update: If you liked this post, perhaps you'll like this too - Defending Active Directory Against Cyberattacks

NSA Contractor Edward Snowden Leaked Secrets - A Classic Example of Cyber Security Risks Posed by Trusted Insiders

Folks,

Edward Snowden needs no introduction, and I'm not about to opine on his actions.  What I would like to share my 2 cents on is the nature of this "security incident", and what government and business organizations worldwide can learn from it.



A Trusted Insider

This incident was a classic case of "unauthorized information disclosure" by "a trusted insider" with unrestricted access.

In this case, the "insider" seemingly had virtually "unrestricted" access to information, and the nature of information he accessed and divulged was so highly "sensitive" that the impact of its disclosure was colossal enough to cause a national government and a clandestine agency, potentially substantial harm, and embarrassment.


Risks to Cyber Security from Trusted Insiders

Unlike a traditional cyber security incident, involving an attack from an outsider, such a security incident is much harder, but not impossible, to protect against, because it involves a "trusted insider."

The threat of a security compromise from an insider always exists. However, few organizations take it seriously, perhaps because they perceive the "likelihood" of it to be low, or because they "perceive" the damage to being usually manageable, in that your average insider does not have administrative access and thus the extent of confidential information to which they could obtain access is usually limited.

However, in situations, wherein a highly trusted IT/Systems Administrator is involved, the damage can be substantial, as was the case here, because such admins almost always have unrestricted access to virtually the entire IT infrastructure, and are trusted with the great responsibility of safeguarding the organization's information assets.

So, when a highly trusted administrator turns malicious, there is very little you can do to stop him/her from inflicting substantial damage to the organization. That is because he/she can access, tamper, divulge and destroy virtually any organizational information asset he/she likes at will.

For example, should an accountant at a defense company leak the earnings numbers before their scheduled disclosure time, the impact would be limited to legal fall outs, but should a systems administrator leak the entire set of confidential blue-prints of the next supersonic plane the company was working on, such a breach could effectively put the company out of business.

This is why it is of paramount importance to ensure that organizations minimize the number of highly trusted administrators to an ABSOLUTE bare minimum. The importance of this elemental cyber security measure cannot be over-stated.

A Trusted Administrator

I know a thing or two about this, because I authored Microsoft's 400-page official white paper on delegating administration in Active Directory deployments, which deals with this very subject i.e. how to minimize the number of highly privileged administrative personnel to a minimum by delegating administrative authority based on the principle of least privilege.

Just one more thing. The method/system that NSA (and 20K+ organizations worldwide) would most likely have to use to find out who has what administrative powers in their IT infrastructures is protected by a patent, that I happen to be assigned.

(But I digress.)


Managing Risk Posed by Trusted Insiders with Unrestricted Administrative Access

The risk posed by a privileged trusted insider can almost never be completely eliminated because you will always have at least ONE person who will need to have (/ be able to obtain) unrestricted administrative access across the organization's IT infrastructure.

 

However, in most cases, the "likelihood" of this risk being materialized can be substantially minimized by reducing the number of highly privileged administrators, and by ensuring (to the extent possible) that those who do possess such unrestricted access are highly trustworthy and understand the serious implications of the misuse of their unrestricted administrative power.

Practically speaking though, if I were to share with you just how dismal the state of excessive administrative access entitlements is in most business and government organizations worldwide, you might fall out of your chair!

For instance, you'd be surprised if I told you just how many companies out there have 100s of Domain Admin accounts. In fact, in one company we came across, over 700 individuals had the ability to reset the password of the CEO's account, and login as the CEO on-demand within seconds. The only thing more scary is that no one including the CEO or these 700 admins knew about this. (Interestingly, one of their employees used Gold Finger Mini to figure this out in 30 seconds.)

(Anyway, I digress again, so back to the point at hand...)


What Can Organizations Do To Minimize The Risk Posed by A Malicious Trusted Insider?

The #1 thing organizations can do to minimize this risk is to understand and acknowledge just how serious and damaging a single such security incident can be for the organization.  (ONE such incident is all it takes to inflict substantial damage.)

Executive Management

Specifically, what is needed is for executive management to require and demand the enactment of adequate security risk management measures aimed at reducing the number of insiders who have unrestricted access to the IT infrastructure i.e. Domain Admins, Enterprise Admins and the like, i.e. folks whose job titles read "Infrastructure Consultant" etc.

Without executive support, this problem can almost never be adequately addressed.

Executive support is necessary because without it, the organization's IT group may not be able to drive the changes necessary to accomplish the reduction in the number of administrative accounts.

The #2 thing that organizations can do once executive support is in place, is to assign a high-priority IT project aimed at identifying the list of all individuals who have unrestricted or widespread access across their IT infrastructure.

Administrative Access Audit

This list should then be vetted out to understand the business requirements that drive/necessitate the provisioning of such unrestricted access for the identified individuals.

The vetting process must involve an analysis of why each of the identified individuals currently possess and require unrestricted administrative/system-wide access, and for each case wherein such access is not actually required, actionable steps must be identified to reduce/revoke such unrestricted administrative access, such that individuals only possess the least amount of access they need to fulfill their responsibilities.

The #3 thing organizations can do, is enact the steps identified in #2 above to minimize unrestricted administrative access to a bare minimum, by leveraging delegation of administrative responsibilities based on the principle of least privilege.

In other words, administrative access should be locked down based on the principle of least privilege.


Maintaining Security Post Initial Risk Reduction

It is not sufficient to minimize the number of privileged account holders, and then forget about it, because, unchecked, business requirements will invariably cause this number to get out of control again.

Thus it is imperative that all subsequent access provisioning requests be fulfilled in adherence to the principle of least privilege. This takes effort and time, but it is the harder right.

Also, to maintain security, on an ongoing basis, organizations should also periodically audit administrative access to ensure that the number of folks with unlimited /unrestricted system-wide access (as well as delegated access) is in line with what is expected, approved and authorized (i.e. not in violation of established business policy.)

It is also important to institute additional protection and monitoring measures to protect all accounts that have all-powerful administrative / unrestricted / system-wide access. In addition, it is equally important to establish policies that clearly state the ramfications of abuse of administrative power, and to communicate them to all powerful administrators. This deterrence measure is necessary.

If organizations enact just these 3 simple measures listed above, they could substantially reduce their attack surface, and thus reduce the likelihood of a successful "security breach" by a trusted insider.

For instance, you could use these measures to reduce the number of individuals who have unlimited administrative access from say 400, down to 40. Now, 40 is still 36 too many, but it is 360 less than the existing and unacceptable level of 400. (The number 400 is arbitrary, albeit representative of many large organizations, and primarily used to make the point.)


Time's Up

Given additional time, I could elaborate further, and provide additional and detailed guidance, but for now my 10 minutes are almost up, so this will have to be it.

My apologies if my 2c above is not proof-read by an editorial staff. Given my role at Paramount Defenses, I only have a few minutes each month to spend on "blogging", so this will have to be it.

Best,
Sanjay.

PS: There's no dearth of commercially motivated advice out there that seems to suggest the deployment of certain access management solutions in such situations. I'll add just this much - no software solution "in and by itself" can reduce this risk as much as the single fundamental step of actually reducing the number of individuals who possess unrestricted privileges can, because you cannot protect a system from the administrator of the system, because the administrator is, by definition, a part of the system's TCB (Trusted Computing Base.)

PS2: Here's something to think about in light of Mr Snowden's actions - http://www.sanjaytandon.com/integrity.html

Does the Chinese Government Pose an Advanced Persistent Threat to the United States on the Cyber Security Front?

Folks,

Not a week seems to go by without there being a news headline about the cyber security threat posed to the United States by the Chinese Government.

Does the Chinese Government Pose an Advanced Persistent Threat to the United States on the Cyber Security Front?

The latest slew of headlines allege that the Chinese may have gained access to extensive design information on advanced American weapons. On Friday U.S, Defense Secretary Chuck Hagel said that cyber threats posed a "quiet, stealthy, insidious" danger to the United States and other nations, and called for "rules of the road" to guide behavior and avoid conflict on global computer networks. So, the (rhetorical) question is...


Do the Chinese Pose an Advanced Persistent Threat to the United States on the Cyber Security Front?

Well, let's look at the definition of an Advanced Persistent Threat, courtesy Wikipedia...

"Advanced persistent threat (APT) usually refers to a group, such as a foreign government, with both the capability and the intent to persistently and effectively target a specific entity. The term is commonly used to refer to cyber threats, in particular that of Internet-enabled espionage using a variety of intelligence gathering techniques to access sensitive information, but applies equally to other threats such as that of traditional espionage or attack."

Perhaps we should dissect the defintion ...

a group, such as a foreign government - The Chinese government, and more specifically the Communist Party and the People's Liberation Army (PLA) are a foreign government

with both capability and intent - According to Dr. Larry M Wortzel, a retired U.S. Army Colonel, the PLA has developed doctrine and exercised an integrated information warfare capability that can defend military and civilian computer networks while seizing control of an adversary’s information systems in a conflict.

to persistently and effectively target - According to Arthur Herman of the American Enterprise Institute, over the last 30 months, Chinese hackers have targeted Bloomberg News, Google, Hotmail, Yahoo, The New York Times and The Wall Street Journal — as well as the US Chamber of Commerce, then-Secretary of State Hillary Clinton and then-Chairman of the Joint Chiefs of Staff Mike Mullen.

a specific entity - Well, how about not just one but so many specific business and government organizations of the United States of America that have been targeted thus far.

Based on the above, it does seem to the logical mind that the Chinese Government may very well pose an Advanced Persistent Threat to the United States.



An Organized and Structured Cyber War/Espionage Effort?

According to Mark Stokes and his colleagues at the Project 2049 institute, the PLA General Staff Department (GSD), Third Department and Fourth Department are organized and structured to systematically penetrate communications and computer systems, extract information and exploit that information.

Unit 61398?

Their research indicates that cyber operations are a massive effort in China with the GSD Third Department being responsible for monitoring communications, communications security, computer network exploitation, and cyber security for the PLA, and the the GSD Fourth Department being responsible for electronic countermeasures, electronic support measures, gathering electronic intelligence, and probably cyber attack to penetrate information systems and assists in computer network exploitation. There apparently also are militia units that have cyber-related missions for the PLA, and the People’s Armed Police has its own technical reconnaissance unit.

 

According to Mike McConnell, former Director of National Intelligence, Michael Chertoff, former Secretary of Homeland Security; and William Lynn, former Deputy Secretary of Defense, China has a national policy of espionage in cyberspace and is "the world’s most active and persistent practitioner of cyber espionage today"

  

Chinese Attempts to Gather Know-How on Advanced Exploitation Techniques

If you scroll down the Wikipedia page on Advanced Persistent Threats to the APT life cycle section, you'll find the following excerpt: "In 2013, Mandiant presented results of their research on alleged Chinese attacks using APT methodology between 2004 and 2013 that followed similar lifecycle:

1. Initial compromise — performed by ...
2. Establish Foothold — plant ... 
3. Escalate Privileges — use exploits and password cracking to acquire administrator privileges over victim's computer and possibly expand it to Windows domain administrator accounts.
4. Internal Reconnaissance — collect ...
5. Move Laterally — expand ...
6. Complete Mission — exfiltrate stolen data from victim's network."

The 3rd step, Escalate Privileges is the defining step that gives a perpetrator administrative access in target IT infrastructures, by virtue of which substantial willful damage can be inflicted.

We happen to know a thing or two about it because we help organizations worldwide prevent the successful enactment of this step in their Active Directory infrastructures, which is where the prized "domain administrator" accounts reside.

We have seen the Chinese attempt to gather information on a specific, advanced exploitation technique / threat related to the escalation of privileges in Windows environments, "Active Directory Privilege Escalation".

We also believe that many business and government organizations may still be vulnerable to such attacks, and we have been privately and publicly helping organizations become aware of the importance of adequately protecting their foundational Active Directory infrastructures, so that any attempts to infiltrate their networks and subsequently escalate privilege to obtain unrestricted administrative access in their internal IT environments can be thwarted.


A Call to Establish Rules of the Road - Is the U.S. Government Scrambling?

The U.S. government would like to see Rules of the Road established for Cyber Security, and it would like the Chinese to adhere to these rules, apparently so as to prevent the continued barrage of cyber security attacks and breaches.

That's very gentlemanly, but with all due respect, that's like Iron Man requesting his adversaries to please not kick him on his knees while engaging in battle, since the armour around his knees is not strong enough yet.

One cannot rely on the presence of rules of the road for protection, especially with the Chinese. What is needed is for our organizations to realize just how serious the threat of cyber security is, and to take immediate steps to adequately bolster their defenses, so as to be resilient in the face of attacks.

I say so because the threat is not only from China. The threat is equally from any other foreign government or a non-national business entity that might have something to gain by compromising or breaching an organization's IT security defenses. Examples include organized mafia, ideological groups, groups engaged in corporate espionage, and even individuals.

By the same token, its not just U.S organizations that are at risk. Business and government organizations in our ally countries, such as the United Kingdom, Canada, Germany, France, Switzerland, the Middle East, India, Australia etc. are all equally at risk.

The challenge with cyber security is that, unlike physical security, which involves clearly definable and defensible borders, it is very difficult to draw boundaries online, and thus very difficult to protect organizations from attackers and attacks.

I do believe that most organizations do want to adequately bolster their defenses, but struggle to determine how to do so efficiently, measurably and provably. My humble suggestion to them would be to begin by establishing their top cyber security priorities, then performing prioritized risk assessments to assess risks and weaknesses, and subsequently determine and implement an adequate set of asset-specific risk mitigation measures aimed at providing comprehensive security at all times.

No organization can ever completely eliminate risk, but they can substantially minimize it.


Time's Up

I could share a lot more, but my 10 minute alarm just rang, so I'm afraid I'll have to end this here.

More next time. Stay tuned. Alright, back to work.

Best wishes,
Sanjay

New Coordinates - Cyber Security Blog

Folks,

On April 24 2013, this blog's url changed from www.identitysecurityandaccessblog.com/ to www.cyber-security-blog.com/

Now that might sound like the height of conceit, but there's a very good and selfless reason for that. Allow me to explain.

You see, ideally I would have been happy with something like, say www.justanotherblog.com/. However, when you know a thing or two about security, and you see the likes of Kim Cameron demonstrate the height of conceit by blogging on urls like www.identityblog.com/, you sometimes have to make a point to the Kim Camerons of the world, that there are others, who could shed light on things far more important, and that's what motivated the url www.identitysecurityandaccessblog.com/.



Active Directory Security - A Top Cyber Security Priority

 

As for the new coordinates, Cyber-Security-Blog.com, the reason was simple. There's just so much senseless noise being made by the media regarding cyber security that organizations worldwide are actually missing out on the need to protect the very foundation of their cyber security, their foundational Active Directory infrastructures. So, we decided to acquire that url so we could shed light on the most paramount aspect of cyber security - protecting the very foundation of cyber security itself.

Speaking of foundational security, in case you didn't know, the entire U.S Federal Government and all state governments, virtually all other national and state governments, Microsoft, CNN, Symantec, HP, Dell, etc. all operate on Active Directory.

Active Directory is the Foundation of Cyber Security

In fact, from Wall Street to Fortune 1000, virtually all business and government organizations worldwide operate on Active Directory. So I hope you'll see just how important it is to help them understand that their underbellies are rather soft.

Now, of course, reporters at the CNNs of the world aren't going to tell you that, because even though they too operate on Active Directory, I doubt their reporters have even heard of Active Directory. Or for that matter I wouldn't be surprised if 90% of the world's hackers know anything about it (which is a good thing for us good guys). Its the other 10% that we worry about.

So, you see, the reason is simple - we merely wish to help organizations worldwide understand the importance of protecting their very foundation of security, because even the tallest of skyscrapers are only as strong as its foundation.

Oh, just one more thing.

As for the date April 24, 2013, the reason we made the change that day is because on that day we made an announcement that has far-reaching implications for the cyber security space. On that day, we announced that we had been granted a very important cyber security patent by the United States Patent and Trademark Organizations (U.S PTO.)

You see, security (including cyber security) is fundamentally about access control (i.e. the prevention of unauthorized access to resources), and apart from controlling access, one of the most important aspects of access control is access assessment i.e. being able to assess what access someone effectively has in a system.

The Need to Know Who has Access To What is Paramount To Cyber Security

The patent we were awarded covers exactly that - a method and system for assessing the access that a user effectively has in a system. So you see, that patent has huge implications for the entire cyber security space, because it potentially applies to everything from trying to determine who has what effective access to a web server to who has what effective access to a file residing on a file server, and from determining who has what effective access to data residing in a database to determining who has what effective access to administer an IT infrastructure.

In other words, as you'll hopefully agree, we've hopefully earned the right to stake claim to www.cyber-security-blog.com/.

In weeks to come, you can expect some insightful perspectives on the subject.

Best wishes,
Sanjay

The Temperature Is Rising - Cyber Security Threats Abound

Folks,

If you've been following the Cyber Security space, then you know that cyber threats are increasingly becoming a serious threat to national and corporate security worldwide. Over the last few weeks, we've all seen a steady increase in cyber security attacks, and we've also seen governments move to make cyber security a national security priority, as it rightly should be.

Last week, U.S Representative Dutch Ruppersberger of Maryland, top Democrat on the House Permanent Select Committee on Intelligence, said on CNN’s State of the Union program - “We have attacks right now. Wall Street has been attacked. We have the capability of other countries, including Iran, for destructive attacks, to knock out our grid system, to attack some of our banks. We have got to stop this.”

A few months ago, I had alluded to the fact that the Perfect Storm may be brewing for organizations worldwide. I believe that a perfect cyber security storm is ahead of us, and it may be around the corner.

 

Based on what we're seeing, we believe that the temperature is rising, and that in months to come, the number and severity of cyber attacks on organizations is unfortunately only going to increase.

Based on what we're seeing, I also continue to believe that inspite of the rhetoric, most organizations worldwide, including numerous government organizations hardly have a clue as to some of the world's most serious cyber security risks today. (For now, the seem busy trying to figure out how to prevent themselves from kiddish DDOS attacks, which frankly, are merely an annoyance.)

There's no dearth of rhetoric when it comes to Cyber Security. There is only the dearth of the enactment of well-thought out, prioritized risk mitigation measures aimed at ensuring that organizations are adequately defendable from not just kiddish DDOS attacks to their front doors, but also adequately defendable from advanced cyber threats that could very well be launched from on the inside, once malicious perpetrators have found a way to deliver a well-crafted payload to the inside.

In essense, what is needed is that organizations understand just how paramount the importance of cyber security is, and that they swiftly enact measures aimed at ensuring that their digital assets are adequately and comprehensively protect from risks. A high-priority, well-funded, organization wide cyber security risk assessment and mitigation initiative

At Paramount Defenses, we're helping organizations obtain a deeper understanding of some of the most critical of such advanced threats that have the potential to cause swift, irreversible, wide-spread damage to the very foundation of their cyber security defenses.

We wish all organizations well, and we hope that understand the gravity of the situation, because the temperature is certainly rising, and the perfect storm may unfortunately be around the corner.

Best wishes,
Sanjay

Cyber Attacks a key threat to U.S. National Security, according to a Report. (Unimpressed. This is just Common Sense.)

According to the U.S. intelligence community's recent worldwide threat assessment, cyber attacks are a key threat to U.S. national security, as reported by CNN – http://www.cnn.com/2013/03/12/us/threat-assessment/index.html

I’m surprised that this is news or that it takes a threat assessment to deduce this – this is common sense!
 

 

Why you ask?

 

Well, its no surprise that the United States is one of the most technologically advanced countries in the world, and as a consequence, virtually all aspects of its economy and security are digitally powered i.e. underlying most of its business and government organizations are mission-critical IT infrastructures that play an elemental role in facilitating the digital operation and control of large parts of these organizations.

 

 
These mission-critical IT infrastructures play a paramount role in protecting the digital assets of these organizations, and given their digital nature, they do not enjoy the privilege of being protected by physical boundaries such as discrete and defendable geographical borders.

 

 

On the contrary, they are exposed to a vast and myriad attack-surface, as they can be attacked both from outside and from the inside, and since most of them are connected to the Internet, technically anyone from anywhere could potentially try to launch an attack against these IT infrastructures, and because the attack surface is so vast, the likelihood of an attack succeeding is rather high.

 

 

These cyber attacks can also vary in technical sophistication, and range from your vanilla kid-stuff throwing-stones-at-the-entrance DDOS attacks (which are so easy to carry out, and often glorified by an ignorant media) to advanced enterprise-targeted security privilege escalation attacks which require sophisticated technical expertise to carry-out and can result in a perpetrator gaining complete administrative control over an organization’s entire IT infrastructure.

The kiddish DDOS attacks so often publicized by the media aren’t even worthy of national news anymore, but unfortunately, the media doesn’t understand this stuff to well, so for them its news! What the media doesn’t understand well at all are advanced cyber threats which have the potential to take out entire organizations, (plausibly including many of these media organizations as well) within a day, by using the power of automation. Yes, these are very possible, but I don’t expect the media to shed light on these because they don’t have the faintest clue as to how such attacks might work, or just how much harm they can inflict.

That's the kind of stuff we worry about at Paramount Defenses; these advanced cyber security attack vectors, which often require deep technical expertise but can be automated by a single entity, such as a hostile foreign government, and one that can then be launched in a variety of ways to compromise an organization. What I’m referring to here is a Stuxnet like payload, crafted meticulously to take one or more organizations down. Such payloads, once written, can be disseminated and deployed in numerous ways, the simplest of them involving an organization’s own administrators downloading free IT tools/utilities.

Such advanced cyber security threats to organizations worldwide, not just in the U.S. are very real, and in our experience, we have found that most organizations are unprepared to secure and defend themselves from such attacks.

To make a long story short, this isn’t and shouldn’t be news to anyone, and shouldn’t require a formal threat assessment to realize – this is common sense, but I suppose, as they say, common sense isn’t that common.

That’s about all the time I have for blogging. Now if you’ll excuse me, I’ve got to get back to helping our customers secure and defend themselves from powerful, advanced cyber security threats, such as this.

Best wishes,
Sanjay

Just 10 Simple, Elemental Questions Impacting > A $ Trillion of Wealth

Folks,

This year, I'm going to ask just 10 simple, elemental questions related to Cyber Security in general and Active Directory Security in particular, that will go a long way in protecting over a $ trillion of wealth.

I'm going to ask these questions to the 1600+ members of our global community spanning 100+ countries worldwide.

A $ trillion may sound like a big number, but it isn't really that big, becaue big and small are all relative. If you take into account the fact that Active Directory Security impacts over 85% of organizations worlwide, a $ trillion's not too much. These questions impact the security of over 20,000 organizations worldwide from the United States Government to Goldman Sachs, and from Google to Cisco.

For those interested in being privy to these questions, you're welcome to join our global Active Directory Professionals Group.

Thanks,
Sanjay

Cyber-Security - Anonymous Cyberwar on Israel Seemed Simplistic and Israel's Claim of 44 Million Cyber-Attacks Seemed Overstated

Folks,

Cyber-security, cyber-war and cyber-attacks all seem to be making headlines these days, especially in light of the hacker collective Anonymous publicly declaring 'cyberwar' on Israel, and Israel claiming that it has been hit with 44 million cyber attacks in the last week..

It seems that Cyber-<anything-to-do-with-IT-security> is getting a lot of importance these days with the likes of Richard A Clarke writing books on Cyber-War, governments setting up special Cyber-Security commands to combat it, security vendors you've never heard of, jumping on the band-wagon, and of course the media making a huge deal out of it without, in my humble opinion, truly understanding the difference between a simple cyber-attack and a sophisticated enterprise-security attack.

While cyber-security is very important, and should be taken seriously, it is imperative to understand the vast difference between simplistic cyber-attacks and sophisticated enterprise-security attacks.

As former Microsoft Program Manager for Active Directory Security, I thought I'd take just a few minutes to share a few thoughts in this regard with you, because undue attention on simplistic cyber attacks may detract organizations from protecting themselves from sophisticated enterprise-security attacks that could be far more damaging than basic cyber attacks.

 

[ For those of you who may not know this, from the United States Government to the Fortune 1000, at the very foundation of security of over 85% of all organizations worldwide, lies Microsoft's Active Directory technology. ]



Anonymous Cyberwar on Israel Seemed Simplistic and Israel's Claim of 44 Million Cyber-Attacks Seemed Overstated

The short of it is that Anonymous's 'Cyberwar' on Israel seemed rather simplistic, and Israel's claims of 44 Million Cyber-Attacks seemed over-stated, and that most organizations worldwide are in fact inadequately prepared to face and combat real, sophisticated enterprise-security threats.

In order to substantiate the claim, I'd like to humbly point out the difference between simplistic Cyber-Attacks and sophisticated Enterprise-Security Attacks, because this difference is rather important to understand, to comprehend just how much damage a real enterprise-security attack could inflict.

 

(Simplistic) Cyber-Attacks vs. (Sophisticated) Enterprise-Security Attacks

You might ask - "Aren't enterprise-security attacks the same as cyber-attacks?" Aren't they the stuff we all hear about in the news almost on a weekly basis, when the media sheds light some organization being "hacked"? You might also say, "Isn’t this what Israel’s finance minister Yuval Steinitz was referring to" when he said that Israel has successfully deflected 44 million cyber-attacks on government websites.

The answer is NO. (At least not exactly.)

Although one could technically cover enterprise-security attacks under the umbrella of cyber attacks, there is a substantial difference between simple cyber-attacks and sophisticated enterprise-security attacks.

Much of the world populace hasn’t really heard about a sophisticated enterprise-security attack, or its impact, other than STUXNET I suppose, because a largely ignorant media has portrayed simplistic cyber-attacks as the main / predominant IT security threat. The reality however is that a targeted enterprise-security attack could inflict far more serious damage than a simple cyber-attack.

(Simple) Cyber Attacks

Cyber-attacks, generally, are attacks targeted at organizational websites accessible on the Internet and for the most part, try to exploit inherent design deficiencies in TCP/IP, the protocol upon which the Internet runs. 

 

For instance, the most common form of a cyber-attack involves sending a large number of requests to an organization’s website (SYN flood) resulting in a situation wherein the site’s legitimate users are then unable to access the website, because its resources are being consumed servicing incoming requests from computers being used to carry out the attack.

This is a very basic form of a DOS attack that could possibly even be launched by amateurs with just a little know-how, and often be enacted using automated programs, from virtually anywhere in the world. A variation of this attack involving the use of bots involves using a large number of hijacked computers from all around the world to attack the same website, and the attack then becomes a DDOS attack, the first D standing for Distributed. 

At worst, with such an attack you could bring down an organization’s website for a few minutes, but other than some downtime for a website, there’s not much real damage that they could cause. In all likelihood, this may very well have been what Israel's Finance Minister was referring to when he said that a single website was down for about 10 minutes, and then brought back up online.

Most such attacks are mere annoyances, and easy to carry out.

I suspect that the attacks alluded to by the Israeli Finance Minister are mostly of this kind and that 44 million is merely a count of the TCP SYN requests received by the Israeli government's web servers, I also suspect that these are the same kinds of attacks Anonymous is referring to in their claims to wage cyber-war against Israel.

While many organizations have Internet-facing websites, whether designed to share information, or enable electronic commerce, the actual corporate networks of most organizations are largely disconnected from their websites (, at least to some extent) or to be more specific, from the infrastructure that supports the Internet facing websites, which is usually placed in DMZs.

A majority of all "cyber-attacks" launched online are merely basic DOS/DDOS attacks trying to make websites unavailable. A small number of attacks involve successfully penetrating the infrastructure within the DMZ and could result in the compromise of any information stored in the databases in the DMZ, such as databases that facilitate the organization’s ecommerce offering, and result in the compromise of information such as credit-card numbers, and other such information stored in these databases. In comparison, relatively speaking, only a few attacks actually involve a successful penetration of the DMZ and a successful penetration of corporate networks via the DMZ.

In other cases, a cyber-attack might involve a malicious entity defacing a company’s website’s homepage and claiming that they “hacked”the organization, but in fact, all they did was go a little beyond a DOS attack in being able to gain modify access to the organizations’ external facing web-server. In addition to the embarrassment caused to the organization, I suppose the only other thing accomplished here is a temporary boost to the ego of whoever carried out the attack, and bragging rights for a few hours.

Then you've got the free email (e.g. Gmail, Yahoo, Hotmail etc.), Facebook, Twitter account hacking, but that's relatively easy and inconsequential that almost not even worth mentioning. Why? To begin with, if you're trusting anything in the hands of a free service offered to millions/billions, realistically, you'd have to be really naive' to expect that any of that information you upload to it, or communicate via it, would be completely secure at all times. (At any point, any one of thousands of IT personnel responsible for operating that service could possibly obtain access to your information, plus, a variety of ways designed to help you regain access to your account could be (mis-)used by any one of billions of people to compromise your account.) That's kid-stuff, so I'm not even going to touch upon it.

(Sophisticated) Enterprise-Security Attacks

Now, contrast such attacks to an attack specifically targeted to take out an organization’s IT infrastructure.

 

Such an attack would involve a digital payload designed by a specialist to compromise one or more critical IT components of an organization's IT infrastructure, such as its IT security infrastructure.

For example, imagine if a payload were written to take out the very foundational systems within an organization's IT infrastructure that provide the means to authenticate an organization’s users and/or that provide the means to authorize secure access to the entirety of the organization's IT assets.

 

The impact of the compromise of the very systems that provide authentication and authorization services to the entirety of an organization’s IT assets, is that it would instantly expose the entirety of the organization’s IT assets to the risk of compromise.

For instance, if a malicious entity were to build, deliver and have executed a payload to successfully take over an organization’s IT security infrastructure components (e.g. Kerberos KDCs, Active Directory etc.) virtually all of the organization's IT assets, such as its IP, R&D data, financials, customer information, strategic plans etc could all be instantly vulnerable to compromise.

Now, an IT security practioner might say that this is the reason we have layered security and that we deploy multiple layers of security above the platform. Well, the thing is that any layer of security that has a software component is running on the system too, and thus still relies on the system for its own trustworthiness.

For instance, anti-virus protection runs as a service on a computer. If you are an admin, you control the computer's system, and by virtue of that you can disable the anti-virus service on the system. By the same token, software running as system has complete control over the system, and thus on any applications/services running on that system. (Its called the Trusted Computing Base (TCB) of that system.)

So, if an attacker could successfully compromise the system itself, he/she would then in effect be the system and if you are the system, you, in all likelihood, can now circumvent virtually every other additional control deployed on top of the system to protect the organization’s IT assets.

An enterprise-security attack also often involves just one payload and a well-crafted payload only needs to be run once on a corporate computer, and there are numerous ways to get one payload to run once on any one computer within the organization.

This is why enterprise-security attacks also do not require that an organization's IT infrastructure necessarily be connected to the Internet, because payloads can be delivered in various forms, ranging from the use of social engineering to have an insider download and execute some code, to the use of legitimate fulfillment of IT needs, such as the delivery of a malicious payload disguised as an unsigned printer driver delivered as a software upgrade.

All in all, a targeted enterprise-security attack designed and carried out to take out critical components of an organization's IT infrastructure can have far greater impact, than any cyber-attack designed to temporarily bring down, deface or break-into and organization's customer-facing website.

Enterprise-security attacks are usually designed to target and take out critical components of the internal IT infrastructures of organizations, not the organization's pretty-looking external-facing websites places in DMZs.
  

It is such attacks that I am referring to as enterprise-security attacks.



Substantiating the Claim

In light of the above, I should perhaps substantiate my claim that Anonymous's 'Cyberwar' on Israel seemed simplistic, and Israel's claims of 44 Million cyber-attacks seemed over-stated.

If you read what the media has to report, it is virtually apparent that most of the cyber-attacks that were launched against Israel were mere DOS/DDOS attacks targeted at company websites.

As I indicated above, a majority of these attacks would have at most caused a denial-of-service (DOS) when legitimate users would try to browse the websites of the Israeli government organizations, and a minority may have been successful in getting modify access to the root web directory, thus defacing the website. In some cases, in order to bring the website backup online, the admins might have to reboot the systems and that could take a few minutes, so its quite possible that a few websites may have been down for a few minutes.

So, it doesn't seem like Anonymous was carrying out sophisticated attacks aimed at compromising the government's core IT infrastructures, which as I indicated earlier, may not even be directly connected to the Internet, or even so, they might be a few (router) hops out with intrusion-detection systems in place.

Anonymous certainly seems to have a lot of fervor but does not seem to have much in the way of the advanced technical sophistication required to enact a serious enterprise-security threat, at least just yet.

For instance, while they may be very good at good old fashioned network security attacks (i.e. exploiting inherent limitations of TCP/IP  carrying out DDOS attacks, engaging in password guessing/brute-forcing etc.), which are an archaic science today, they don't appear to be very good at systems security (attacking Kerberos, engaging in Active Directory Privilege Escalation etc.) yet. Based on what we've seen thus far as a part of their latest performace in waging 'Cyberwar' against Israel, their capabilities seemed rather simplistic.

As for suggesting that Israel's Claim of 44 Million Cyber-Attacks seemed over-stated / mis-represented, well, in light of the nature of attacks that are believed to have been carried out, it appears that the actual number of attack attempts may have been in the 1000s and that 44 million may be the number of TCP SYN packets that their entirety of their government's web servers may have received as a part of these attacks. Alternatively, 44 million may have been the number of computers used as bots to launch these attacks.

So, in all likelihood, its not that there may have been 44 million attacks, but that there may have been 44 million TCP SYN packets received during the course of these few days on their web servers, or that 44 million Internet-connected machines were used (largely remote-controlled) to launch these attacks.

Israel's finance minister said that they are "reaping the fruits on the investment in recent years in the development of computerized defense systems." I suppose they've invested heavily in trying to protect their systems from cyber-attacks aimed at their public websites and the protection of their DMZs.

However, I wonder if they're adequately protected when it comes to protecting critical components of their internal IT infrastructures (e.g. their Active Directory deployments) equally rigorously. Perhaps that's what the finance minister may have been alluding to when he added that "but we have a lot of work in store for us" in a written statement.

All said and done, while the emphasis ad importance given to Cyber-Security is good, it would also be helpful if folks actually understood the difference between simple Cyber-Security attacks and sophisticated Enterprise-Security attacks.

In fairness to them, I suppose they might claim that they include Enterprise-Security when talking about Cyber-Security, and if they do, then I must say, that in the interest of the public service, they need to communicate the vast difference between attacks to organization's websites and attacks to organizational IT infrastructures.


In Conclusion

Imagine a vast land with many fortresses.

Then imagine a little tent in front of each fortress designed to greet visitors to inform them about their fortress, provide helpful information, and possibly sell a few souvenirs.

Now imagine someone trying to shut down the tent, or change the poster that shows the fortress's name on top of the tent, or take the tent down. Doing either or all of the above would not materially impact the fortress a bit.

That is essentially your average simplistic cyber-security threat.

Then, fast forward to the use of advanced attack-vectors, and imagine James Bond skydiving into the fortress at night, then using electro-magentic radiation to disable all the metal locks on all the doors within the fortress and possibly to the fortress itself,  making room for an army to invade the fortress overnight.

That is essentially your average sophisticated enterprise-security threat.



So, you see, there is a vast difference between taking the tent-out and taking the fortress out.


Best wishes,
Sanjay

PS: I apologize if this wasn't written perfectly. I only had 15 minutes to put this together, given the sheer lack of time, given my responsibilities at Paramount Defenses. I trust that you'll get the drift.