Scribd Logo
Upload

Welcome to Scribd!

  • 3 views

    Castle

    Uploaded by

    NavneetGupta
    The document summarizes the results of a PingCastle security assessment of an organization's Active Directory system between 2020 and 2021. It finds major improvements in anomalies, privileged accounts, trusts, and stale objects. Specific remediation efforts are described that strengthened controls over golden tickets, privileged access, trust relationships, and inactive user and computer accounts. While some work remains, such as enabling SID filtering, the assessment shows the organization significantly enhanced the security of its Active Directory environment over the past year.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Flag for inappropriate content

    You might also like

    Castle

    Uploaded by

    NavneetGupta
    3 views9 pages
    The document summarizes the results of a PingCastle security assessment of an organization's Active Directory system between 2020 and 2021. It finds major improvements in anomalies, privileged accounts, trusts, and stale objects. Specific remediation efforts are described that strengthened controls over golden tickets, privileged access, trust relationships, and inactive user and computer accounts. While some work remains, such as enabling SID filtering, the assessment shows the organization significantly enhanced the security of its Active Directory environment over the past year.

    Original Description:

    Copyright

    © © All Rights Reserved

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    The document summarizes the results of a PingCastle security assessment of an organization's Active Directory system between 2020 and 2021. It finds major improvements in anomalies, privileged accounts, trusts, and stale objects. Specific remediation efforts are described that strengthened controls over golden tickets, privileged access, trust relationships, and inactive user and computer accounts. While some work remains, such as enabling SID filtering, the assessment shows the organization significantly enhanced the security of its Active Directory environment over the past year.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pptx, pdf, or txt
    3 views9 pages

    Castle

    Uploaded by

    NavneetGupta
    The document summarizes the results of a PingCastle security assessment of an organization's Active Directory system between 2020 and 2021. It finds major improvements in anomalies, privileged accounts, trusts, and stale objects. Specific remediation efforts are described that strengthened controls over golden tickets, privileged access, trust relationships, and inactive user and computer accounts. While some work remains, such as enabling SID filtering, the assessment shows the organization significantly enhanced the security of its Active Directory environment over the past year.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pptx, pdf, or txt
    of 9

    Ping Castle Security

    Assessment for
    Active Directory
    2
    Ping Castle Security Assessment for Active Directory

    Introduction: Ping Castle for Active Directory

    • We use the PingCastle Basic Edition (Health Check Report)


    • Get an overview of the technical situation and provide guidance and advices to fix the issues
    • PingCastle is a tool which helps us to detect critical Active Directory security issues
    • Based on a model and rules, it evaluates the score of the sub-processes (Scores) of the Active Directory

    The use of “PingCastle Basic Edition” (free version) will allow us to audit our systems but without getting any support
    including bug fixing activities. All remediation activities / Bug fixing are conducted internally.
    3
    Ping Castle Security Assessment for Active Directory

    PingCastle Risk level analysis for Active Directory


    Scores: The Score is computed by the maximum of the 4 sub-processes:

     Anomalies: It is about specific security control points (GoldenTicket, Weak PW)


     Privileged Accounts: It is about privileged accounts like administrators
     Trusts: It is about operations related to user or computer objects (Trust relationship)
     Stale objects: It is about operations related to user or computer objects and their life cycle
    for computer, user objects and delegation
    4
    Ping Castle Security Assessment for Active Directory

    Overview of Indicators and Risk level analysis for Active Directory


    5
    Ping Castle Security Assessment for Active Directory

    SubScore: “Anomalies  Major Improvement in Anomalies


    Status as per report of 06.08.2021 Summary
    Status as per report of 04.06.2020

     Mitigated Golden
    Ticket attack
     Implemented the
    EU
    LAPS tool
     Cleared the Admin
    Count attribute
     Disabled the spooler
    service

    LA
    6
    Ping Castle Security Assessment for Active Directory

    SubScore: “Privileged Accounts  Major Improvement


    Status as per report of 04.06.2020 Status as per report of 06.08.2021 Summary
     Removed unconstrained
    delegation from entire forest

     Added privileged account in


    "Protected User" group in Entire
    Forest

     Built-in built-in Administrator


    EU
    password changed (was older
    than 3 years)

     Removed Presence of delegation


    to "Authenticated Users" from OU

     Changed the DC ownership to


    Domain Admin from individual user

     Deleted the Disabled Admin


    NA accounts from AD

     Removed the unknown accounts


    from OU delegation

     Marked the Admin accounts to


    "This account is sensitive and
    cannot be delegated"
    7
    Ping Castle Security Assessment for Active Directory

    SubScore: “Trusts  Major Improvement in Trusts


    Status as per report of 04.06.2020 Status as per report of 06.08.2021 Summary

     Trust (without SID


    filtering) 100 points
    (use case accepted)
    EU  Cleared the SID history
    attributes from AD
    accounts
     Export, review and
    clearing the SID history
    is now scheduled as a
    monthly activity
     As per our environment
    SID Filtering cannot be
    enabled due to user
    LA Migration activities in
    other Domain
    8
    Ping Castle Security Assessment for Active Directory

    SubScore: “Stale Object  Major Improvement in Stale Object


    Status as per report of 04.06.2020 Status as per report of 06.08.2021 Summary

     Removed flag
    "PASSWD_NOTREQD"
    from "useraccountcontrol"
    EU
    attribute for AD Accounts.
     Corrected the primary
    group for the users
    Why it is increased
    • In the latest report OS win7
    and 2008 has been added
    • Due to Covid the computer
    cleanup has been stopped
    LA
    9
    Ping Castle Security Assessment for Active Directory

    Next Steps
    What are the next steps to ensure security is maintained in the AD Domain?
     Designing a tiering model to protect Domain Services (AD DS)
    (Proactive Operations Program: Privileged Access Workstations)
     Azure Active Directory: Recovery Execution Service
     Implementation of OnDemand Assessment for Active Directory Security is currently ongoing
     Stale Object Clean-up activities initiated for Server and Clients (Windows 7 / Windows 2003/2008)

    Team will incorporate in their operational activities the PingCastle Health check analysis, ODA AD and ODA
    AD Security which will be executed every 6 months

    You might also like