Thread by @Maliciouslink

I feel an active directory rant coming on. Prepare the mute or unfollow button.

<rant> We need to talk about AD. First, I want to say that I actually like AD. What I do not like is the half assed way that most organizations run their AD environment.

Just because we CAN implement it like it’s running on a home network, doesn’t make mean we should 1/

Designing and implementing a properly secured Windows environment is very difficult. When I point out to people that they need to very carefully structure permissions and tightly control admin rights, what admins can do, and where the can connect from 3/

In line with Microsoft’s guidance here: docs.microsoft.com/en-us/windows-…, it’s seen as overwhelmingly complex and of little value. 4/

See, I think most Corporatey IT people view the adversary as auditors, rather than the Dridex team, or one of the myriad other actors. When auditors are the adversary, AD makes immense sense - I can easily manage IDs, permissions, etc, lowering operational burden and 5/

Easily appeasing those auditors and their pesky checklists. Those other security issues that remain from not implementing the crazy, burdensome tiered permission model, SAWs, and the like? Well... 6/

Recent events also highlight to me that, like an overgrown forest full of dead trees, old growth AD forests probably need to be burned to the ground occasionally to weed out all those bad ideas, unused admin accounts, badly designed trust relationships, and on and on 7/

So here I am, asking you to PLEASE take AD and network design and operations seriously. It is complex. It will impinge on the power mad domain admins. But I know you won’t. It’s too big. Too complex. You have 500 other priorities. But at least do this: 8/

Sketch out what you would do differently and what you would keep. Spend some time to learn the right way to design the environment, and why. If you’re lucky, you just learned some stuff and had some daydreams about how to restructure stuff. 9/

But it’s also possible that you get hammered by one of the many threat actors. Since your company, like all others, care first and foremost about the security and privacy of your clients’ data, you hire Microsoft professional services to come in and help recover. 10/

They’ll rightly point out that you basically need to start over. New network, isolated from the old. Build new. Implement the tiered permission model, SAWs, and piss off those domain admins - who haven’t slept in weeks, so I guess they don’t really care right now. 11/

People often ask “why are so so bad at security?”

It’s not because we don’t know how. People at Microsoft probably spent person-years writing that stuff. It’s because we want to design the environment the way WE want. We want the good parts, but not the inconvenient parts 12/

I’m tired of seeing and reading about the same thing over and over and over. Stop the madness.
</rant>