Mitigating Risk in a Complex Hybrid Directory Environment

Mitigating Risk in a ComplexHybrid Directory Environment

Hosted by: Brad SamsPetri Presenter: Sean DeubyVeeam Presenter: Alvaro Vitta

What percentage of your organization has moved to Office 365?• 1-10%• 10%-30%• 30%-50%• 50%+• We’re not using Office 365 today

Sean Deuby• Identity technology analyst and expert• Microsoft MVP for Directory Services

since 2004• Consults and speaks on cloud identity

and identity as a service (IDaaS) • Identity architect at Edgile, Inc.• Frequent contributor to Petri IT

Knowledgebase

Alvaro Vitta• Principal Solutions Architect specializing

in security at Quest• Specializes in Microsoft cloud-based data

center technologies, including Azure AD, Office 365, Active Directory, Exchange, and EMS (Enterprise Mobility Suite)

• Works with large private and public organizations to help them solve business problems with software solutions across cloud, hybrid, and private data center environments

Confidential5

• Market trends• Infrastructure security challenges• The solution

AGENDA

Confidential6

MARKET TRENDS

Organizations have used AD to authenticate since 2001

2003

2013-TODAYOrganizations begin taking the cloud seriously

2007Collaboration heats up

2009Server 2008R2 -new forest level

2001AD replaces NT

2008Add new resource forest for security

2010Upgrades, M&As, BYOD, security risks

TODAYFuture-ready Windows Infrastructure

2004Email is now business critical

Presenter

Presentation Notes

The backbone of your IT Infrastructure is built on Active Directory on-premises. It’s been around for quite a while and it’s not going away anytime soon. Did you know that a secure Active Directory infrastructure MAY be the KEY to your success with Office 365?

Office 365 adoption is growing rapidly

• 22 million consumers (55% YOY growth from 12.4 M) and 70 million commercial customers who have active Office 365 subscriptions.

• In the commercial segment, Office 365 had a 57 percent month-over-month jump in the latest 2016 quarter.

• Year-over-year growth: about 1 million subscribers a month are adopting Office 365

Presenter

Presentation Notes

Microsoft says that Office 365 is it’s fastest growing commercial product ever. As you can see - - there are currently 70 Million commercial users and it’s growing at a rate of 1 MILLION subscribers a month.

Why do organizations move to the cloud?

• Reduce infrastructure, licensing, and maintenance costs, eliminating on-premises infrastructure and finding storage efficiencies

• Empower workforce to operate from anywhere from any device

• Increase scalability and business continuity

Presenter

Presentation Notes

Why are customers moving to the cloud at such a rapid rate? When implemented properly, the cloud computing economic model can drastically reduce the operations and maintenance cost of IT infrastructures

What about Azure Active Directory?

• Office 365 *requires* an Azure AD instance

• Azure AD provides the Directory Service for Office 365 applications

• Azure AD integrates with on-prem AD creating a HYBRID Directory environment

Azure Active Directory

Presenter

Presentation Notes

We all know that Active Directory is the source for authentication and authorization for on-premises infrastructures. What about Office 365? Well, and many companies don’t even know this - - Office 365 authentications thru Azure AD. To make sure we are all on the same page – Azure AD provides the Directory service for O365. Azure Active Directory (Azure AD) is Microsoft’s multi-tenant cloud based directory and identity management service

Hybrid Environment: Azure AD Connect Synchronization Workflow

Summary: How Hybrid Directory was ‘created’

90% of Companies use AD-On prem.

O365 Adoption Growing at 70% YoY.

AAD has over 10M tenants

75% of Orgs. > 500 users synch AD-On

prem. >> AADHybrid Directory

How important is protecting on-prem AD resources?

75% of enterprises with more than 500 employees sync their on-prem AD accounts to Azure AD/Office 365 (AD on premises is authoritative)

Presenter

Presentation Notes

SCRIPT: integrating on-prem with azure ad is not as easy as it looks…. On prem is powerful and schema where Azure AD is flat Azure is required for Office 365

If you’re leveraging Office 365, are you using Azure AD?

• Yes, managing Azure AD accounts• Yes, but only replicating to Azure AD from on-

prem• No, not using

Confidential15

HYBRID DIRECTORY SECURITY CHALLENGES

What is the surface attack area? AD On-Prem

Active AD licenses

500Million

Companies using AD to authenticate

90%

95 million of those accounts are under attack every single day (Microsoft)

Daily authentic-

ations

10 Billion

Accounts under attack

each day

95 Million

Presenter

Presentation Notes

SCRIPT: So, with all that is riding on AD, what is the potential for damage? (REVIEW SLIDE)

What is the surface attack area? Azure AD

Number of Azure AD accounts

700Million

Number of Azure AD tenants

10 Million

Daily logons

1.3Billion

MS Cloud daily

cyberattacks

10Million

Microsoft's user identity management systems, process over 13 billion logins

Over 10 million (per day) of these logins are cyber-attacks.

Business Challenges

• Data exfiltration• Insider threats• Compliance failures• Prolonged operational downtime • Revenue loss due to downtime,

loss of productivity, and potentially fines

• No permission baselining• No automatic remediation• Lack of detailed auditing• Labor-intense/error-prone• Lack of granular delegation• Disjointed administration• Manual DR Processes

Technical Challenges

Dangers and pitfalls if you don’t secure AD on-prem

Hybrid Directory Challenges faced by businesses

Presenter

Presentation Notes

Data exfiltration is the unauthorized copying, transfer or retrieval of data from a computer or server. Data exfiltration is a malicious activity performed through various different techniques, typically by cybercriminals over the Internet or other network.

Confidential19

WHAT’S THE SOLUTION?Securing the weakest link in your hybrid directory

Quest AD Security Lifecycle Methodology

Continually Assess

• Who has access to what sensitive data and how did they get that access?

• Who has elevated privileged permissions in AD, servers, and SQL DBs?

• What systems are vulnerable to security threats?

Presenter

Presentation Notes

Continuously Assess Understand who has access to what – permissions, privileged groups, sensitive business groups, GPOs and data. Conduct a thorough assessment and know your security configuration baseline to easily identify your surface attack area, vulnerabilities and risk profile. Provides clear visibility and reporting to stay in ‘the know’ of your directory, windows computers and file shares.

Detect and Alert

• How will I know if any suspicious privileged account activities have occurred?

• Have any changes occurred that could be significant of an insider threat?

• How will I know, quickly, if an intrusion has happened?

• Could we be under brute-force attack right now?

Presenter

Presentation Notes

Detect and Alert Know when suspicious/anomalous activities occur. Real-time monitoring will quickly detect and alert you to potential insider attacks. Proactive measures allow you to take immediate action and reduce the risk of exposure caused by insider attacks or data breaches. (InTrust, Change Auditor)

Remediate and Mitigate

• Is access control allowing those whitelisted in and blacklisted out?

• Do my users have the lowest level of user rights possible to do their jobs?

• Are my sensitive resources protected?

• How much time will it take me to manually remediate unauthorized changes?

Presenter

Presentation Notes

Remediate and Mitigate Remediate unauthorized actions immediately across AD and your Windows environment. Respond to alerts quickly to minimize damage from unsanctioned changes. Automate security policy enforcement across AD to reduce human errors and mitigate the risk of recurrence. Improve operational efficiency and give IT Staff more time to focus on innovation. (ARS, InTrust, Change Auditor, GPOAdmin)

Investigate and Recover

• How can I be sure that ‘it’ doesn’t happen again?

• How can I test my business continuity plan without going off line?

• How long will it take us to recover from an AD security incident, manually?

• What is my AD RTO after a disaster?

• Can I secure access to my DC before next time?

Presenter

Presentation Notes

Investigate and Recover Reduce incident response time investigations across your Windows environment. Correlate security baseline information with fine grained auditing. Get a cradle to grave 360-degree contextual view of how a security incident materialized and reveal the most likely path(s) that led to a security breach. Automate your Active Directory BCP (Business Continuity Process) to minimize your RTO (Recovery Time Objective) in the event of a security incident that causes partial or total damage across your Active Directory infrastructure.

Active Directory Security Suite components

IT Security Search & Recovery Manager FE

• Investigate AD security incidents

• Continuously test your AD business continuity plan

• Recover from a security incident

• Improve your RTO following a disaster

• Secure access to AD DC data

Enterprise Reporter

• Report on elevated permission in AD

• visibility of open shares across servers

• Understand which servers have vulnerable security settings

Active Roles & GPOAdmin

• Enforce permission blacklisting/whitelisting in AD

• Implement AD least-privilege access model

• Prevent unauthorized access to sensitive resources

• Auto-Remediate unauthorized activities

Change Auditor for AD

• Detect suspicious privileged AD activities

• Alert on potential AD insider threats

• Notify in real time of unauthorized intrusions against AD

• Detect and alert on brute-force attacks

Presenter

Presentation Notes

ALVARO . Who has access to what sensitive data in AD and how they got that access Who has elevated privileged permissions in AD, servers What systems are vulnerable to security threats Identify open shares The Active Directory Security Suite includes 6 modular and integrated components: Enterprise Reporter Change Auditor for AD2 ActiveRoles Server GpoAdmin Intrust Recovery Manager for AD Forest Edition The power of this solution is the way in which Dell Software’s products work together. If you buy a single product, you will not have the security power you need to protect your organization. Talk to your sales rep today about the power of this suite and special discounts.

https://software.dell.com/products/intrust/it-security-search.aspx

https://software.dell.com/products/recovery-manager-for-active-directory-forest-edition/

http://software.dell.com/products/enterprise-reporter/

http://software.dell.com/products/active-roles/

http://software.dell.com/products/gpoadmin/

http://software.dell.com/products/change-auditor-for-active-directory/

Hybrid directory solution protects all the way around

Presenter

Presentation Notes

Organizations moving to Office 365 have real and significant security challenges around Active Directory.

Secure your Active Directory to mitigate risk in Office 365

• Organizations moving to Office 365 have real and significant security challenges around Active Directory.

• On-premises AD remains the core of security even in a cloud/hybrid environment.

• Quest offers the only end-to-end AD Security solution in the market

• Don’t let your on-premises AD be your Hybrid Achilles Heel!

Presenter

Presentation Notes

Work this into the summary slide [‎6/‎8/‎2016 12:56 PM] Alvaro Vitta: –On-Premises AD remains the core of security –Even in a cloud/hybrid environment –Everything – in the cloud, in the data center, on the device – depends on the security AD on-premises –Secure on premises apps like SQL Server and SAP and use the most secure cloud there is –But you still inherit all the risks in –On-premises AD –Domain controllers

What is the biggest technology problem facing your organization today?

• Pressure on our IT budget• Security threats• IT skill gap• Legacy applications management• Cloud migration difficulty• Other

We get IT

Work Smarter

Petri.com | The IT Knowledgebase

Thank you for joining. Our broadcast, presentation, and a Tech Brief Summary will be provided.