Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
Controlling Privileged Access To Prevent Rogue Users In Active Directory
Knowing which of your employees have which privileges is the first step to staying safe.
2 Min Read
Privileged access security control process. (Source: the author.)
More on Security
Live at Interop ITX
Often, a rogue user is an internal employee who has been granted privileges that he or she shouldn't have. Controlling privileges for your Windows servers, domain controllers, and Active Directory environment is key to limiting what your users can do. The problem is knowing who has privileges and how to restrict those privileges.
But there is a solution! First, you need to report on each area that grants privileged access to ensure the privileges are correct. If they are not correct, simply set the privileges to the appropriate level.
The following is a list of security controls that grant privileges within your Microsoft environment:
Group membership (domain admins, enterprise admins, Exchange admins, etc.)
User rights (backup files and folders, change system time, system shutdown, etc.)
File and folder permissions (access control lists for databases, IP files, etc.)
Delegation (Active Directory, Group Policy, etc.)
Service access control lists (stop, start, manage)
To successfully secure your privileged access, have a process and stick to it. Following the steps illustrated in Figure 1 will allow you to get control of privileged access.
1. Report on what security settings are in place. This allows you to make corrections where needed.
2. Analyze the information in the reports that you obtain. Ideally, you should evaluate every area of privileged access to ensure that only the correct users have this level of access to your Windows Servers, domain controllers, and Active Directory.
3. Once you have decided on which security settings to implement, configure them. Usually, Group Policy will be the method to deploy your security controls, but you might also use other Active Directory tools such as Active Directory Users and Computers.
If you stop at just securing your environment, you will never know if anything changes. So, to ensure that a privileged access doesn't change without your knowledge, you need to monitor and alert on changes that occur.
4. Monitor and track all changes that occur to privileged access within your Microsoft environment. This will give you reporting and alerting capabilities.
5. For all of the security settings that can allow vulnerabilities, attacks, and malicious actors to enter your environment, have systems in place to alert you via email when changes to privileges occur.
Once you get control of privileged access for your Windows infrastructure, you will have reduced your attack surface and dramatically increased security for your organization.
Related Content:
About the Author
You May Also Like
More Insights
