Tactic 4: Defend Your Domain Controllers

1. Tactic 4: Defend Your Domain Controllers Zaid Arafeh Microsoft Services Cybersecurity

2. Recap • Tactic #3: Defend your Directory

3. AD Control Categories Credentials Domain Controller Host Active Directory Data Security Dependencies C:\> Active Directory Service

4. Part I – Harden HOST Based PRIVILEGES

5. Control on the Host 1 2 Microsoft Windows C:\> WHO CAN EXECUTE COMMANDS ON A DC? WHAT PRIVILEGES CAN THEY EXECUTE WITH? • Back up files and directories • Create a token object • Debug programs • Load and unload device drivers • Restore files and directories • Modify an object label • Take ownership of files or other objects • Logon rights • PowerShell Remoting • Remote access tools • $IPC share • WMI • Network Applications

6. Assign User Logon rights & privileges in accordance with Microsoft Baselines

7. User Rights Assignment

8. Establish Baselines • Use Microsoft policy baselines • Microsoft Security Compliance Manager • Specify allowed applications • Keep these to the bare minimum! • Baseline the OS image • Microsoft Deployment Toolkit (MDT)

9. Part II – Protecting the security Boundary

10. Think of domain controllers as appliance machines

11. Verizon Data Breach Investigation Report 2015

12. Host Patching • Install security updates a.s.a.p. • Install all other updates within 90 days • Keep Antimalware up to date • Patch third party software • After you remove ALL unnecessary software • Test updates in a lab • Develop mitigation plans for updates that can’t be installed • Automate • Windows Software Update Services (WSUS) • System Center Configuration Manager (SCCM)

13. Restrict Applications • AppLocker • Note: Limitations • Implement AppLocker whitelisting • Thorough testing in Audit Mode is necessary • Review NSA guidance on AppLocker • Code Integrity (Server 2016 Feature) • Help protect against • Code injection and malware • Administrators unintentionally running non-permitted code • Powerful whitelisting technique for Kernel and User mode • Can use hardware-level security to protect • Test thoroughly and start with unsigned policies

14. Network Access • Enable host-based firewall • Disable Internet Access • Remove unnecessary services (ex: IIS) • Restrict RDP access • Restrict to the Administrators group using User Rights Assignment • Defense in depth

15. Protect Startup Components • Universal Extensible Firmware Interface (UEFI) Secure Boot • Only trusted pre-boot components are allowed • Early Load Antimalware (ELAM) • Choose an ELAM compatible AV • Measured Boot • Allows for measuring startup component integrity

16. Physical Security • Physical Domain Controllers • BitLocker (TPM Protection) • Physical access control • Virtual Domain Controllers • Hyper-V fabric using Windows Server 2016 • Supports existing 2012 VMs • Backups • Backups are a security dependency of AD • Backups must be protected to the same extent as Domain Controllers • Encrypt backups and control their storage and transportation Mitigates a number of Security Dependencies

17. Coming up next • Tactic 5: Beware of Security Dependencies

18. Resources • Shielded VMs Session Sweet • Device Guard • Security Baselines for Win8.1/Server 2012 R2 by Aaron Margosis • Microsoft Security Compliance Manager • Microsoft Guidance on running AppLocker Use on DCs • NSA Guidance on AppLocker For other machines • User Rights Assignments documentation • Need help from Microsoft Services Cybersecurity? CyberRFI@microsoft.com