,
4 tweets,
2 min read
Read on Twitter
[Thread]
Enterprise password vaults (CyberArk, SecretServer, etc) can be useful but when they store privileged AD credentials, the security of that system needs to be protected like a DC.
adsecurity.org/wp-content/upl…
Enterprise password vaults (CyberArk, SecretServer, etc) can be useful but when they store privileged AD credentials, the security of that system needs to be protected like a DC.
adsecurity.org/wp-content/upl…
When using the RDP (or RDP proxy), if the remote system the credential is used on is compromised, the credentials can be re-used (default). Changing the password mitigates reuse of the NTLM cred (pw hash), not existing Kerberos tickets (good for 10 hrs)
adsecurity.org/?p=2362
adsecurity.org/?p=2362
Limiting privileged account authentication to admin systems is critical, even with password vaults managing privileged credentials.
Even brief access to a privileged credential can result in full AD compromise.
adsecurity.org/?p=1929
Even brief access to a privileged credential can result in full AD compromise.
adsecurity.org/?p=1929
Important Steps:
1. Reduce accounts with AD admin rights
2. Restrict where privileged accounts use credentials
3. Limit systems & accounts with the ability to install/run code on admin systems, DCs, pw vaults, etc
4. Restrict network comms to admin systems incl. password vaults
1. Reduce accounts with AD admin rights
2. Restrict where privileged accounts use credentials
3. Limit systems & accounts with the ability to install/run code on admin systems, DCs, pw vaults, etc
4. Restrict network comms to admin systems incl. password vaults
