Скачать или смотреть Breaking Down Barriers: Analyzing Active Directory Security Across Industries

Gary Sun (CyCraft Technology, TW), Vivian Teng (CyCraft Technology, TW)

Gary Sun is a cyber security software engineer of the Engineering and Development Team at CyCraft Technology. Currently, he focuses on research on active directory security and cloud security. He graduated from National Yang Ming Chiao Tung University with master degree in Network Engineering. He has publish papers in CISC 2021 && 2022. Also, he is a speaker of Sans Blue Team Summit, AVTokyo, HITCON Enterprise and CyberSec.

Vivian Teng is a detection and response analyst on customer success team at CyCraft Technology. She is responsible for the Active Directory analysis and provide Best Practice to solidfy the security for customers. She has publish research in ACM Advances in Social Network Analsisys and Mining, as well as NTCIR16 (NII Testbeds and Community for Information Access Research).
--
Active Directory (AD) is a critical role of identity and access management for organizations, serving as the backbone for authenticating users and managing access to resources. Thus, AD is a popular target for attackers. According to DEVCORE, a professional red team company, 72% of AD environments are successfully compromised during red team assessments. It shows that it is easy for attackers to compromise AD. We investigate real world cases, finding that misconfigurations, such as excessive permissions and weak segmentations, are common root causes behind these vulnerabilities.In this talk, we explore real-world cases to reveal how industry-specific needs shape AD configurations across three sectors -- Finance, Government, and Technology. We conclude six common permission settings observed in corporate environments. We would discuss real world cases and statistical insights into these configurations. These insights emphasize the critical need for permission management, segmentation, and access control to mitigate risks and secure AD environments effectively.Lastly, we would provide actionable recommendations to address these misconfigurations and protect organizations from potential breaches. Attendees will gain knowledge about industry-specific AD configuration challenges, common risky permissions, case studies on misconfigurations, and actionable strategies to strengthen AD security.