如何保护 Active Directory 抵御勒索软件攻击
勒索软件对各种类型企业的攻击无所不用其极，而 Active Directory 仍是最常见的攻击目标。通过修复这些关键的 AD 和群组策略错误配置可以阻止特权提升。
勒索软件现已成为全球各类企业的一个头疼问题。勒索软件现在多种多样。攻击者几乎会穷尽各种手段进入企业，将窃取的数据张贴在互联网上，迫使受害者支付赎金。在大多数情况下（请参见 SolarWinds 和 XingLocker），Active Directory (AD) 就是他们的攻击目标之一，因为攻击者可以在得到域特权账号后会扩散勒索范围。当然，企业也可以采用一些方法帮助保障 Active Directory 的安全，防止勒索软件得手。
Active Directory 的各个部分可以得到安全保护，这会增加企业的整体安全性，同时降低了风险。具体而言，下列有关 AD 的配置需要被修复：
- 需要修复用户属性的错误配置
- 需要修复群组的错误配置
- 需要清除特权群组
- 需要有正确的 AD 流程配置（例如 SDProp）
- 需要保障服务主体名称 (SPN) 的安全（如图1 所示）
- 信任关系正确且得到安全保护
- 需要清理用户的 SidHistory 属性
图 1. 具有服务主体名称 (SPN) 的用户帐户
此外，保护 AD 本身和群组策略可确保攻击者无法利用错误配置和特权提升可以达到的部分。下面说明如何做：
- 需要验证和保护 AD 信任安全（如图 2 所示）
- 需要清除 AD 代理
- 需要清除群组策略代理
- 需要保护群组策略结构组件的安全
- 需要启用群组策略对象部署的安全设置
图 2. 合并与并购案可能会让信任关系变得无人管理；此外，必需信任关系也必须受到保护。
最后，攻击者希望获取特权。在获得特权后，他们想建立攻击路径。因此，能够检测这些类型的 AD 攻击就变得很重要。下面是 AD 管理员和安全专业人员要阻断攻击路径时能够采取的操作：
- 确保特权群组成员受到监控
- 检测 DCShadow 和 DCSync 攻击
- 黄金票据攻击（如图 3 所示）
- 检测横向移动攻击
- 检测危险的 SIDHistory 和 PrimaryGroupID 设置
图 3. Tenable.ad 可以实时检测针对 Active Directory 的先进攻击，而无需 Agent 或特权。
我们提供了可持续、自动分析和检测 AD 安全和攻击路径的技术。要了解更多有关 Tenable.ad 如何提供帮助的信息，欢迎观看此网络研讨会：全新推出 Tenable.ad — 保障 Active Directory 的安全并阻断攻击路径
了解详情
相关文章
Cybersecurity Snapshot: CISA Shines Light on Cloud Security and on Hybrid IAM Systems’ Integration
March 15, 2024Check out CISA’s latest best practices for protecting cloud environments, and for securely integrating on-prem and cloud IAM systems. Plus, catch up on the ongoing Midnight Blizzard attack against Microsoft. And don’t miss the latest CIS Benchmarks. And much more!
Poor Identity Hygiene at Root of Nation-State Attack Against Microsoft
February 1, 2024The latest breach suffered by Microsoft shows once again that detection and response are not enough. Because the source of an attack almost always boils down to a single overlooked user and permission, it’s critical for organizations to have strong preventive security.
Cybersecurity Snapshot: What’s in Store for 2024 in Cyberland? Check Out Tenable Experts’ Predictions for OT Security, AI, Cloud Security, IAM and more
December 29, 2023The new year is upon us, and so we ponder the question: What cybersecurity trends will shape 2024? To find out, we asked Tenable experts to read the tea leaves. Their 2024 forecasts include: A bigger security role for cloud architects; a focus by ransomware gangs on OT systems in critical industries; an intensification of IAM attacks; and much more!
How Risk-based Vulnerability Management Boosts Your Modern IT Environment's Security Posture
July 11, 2024Vulnerability assessments and vulnerability management sound similar – but they’re not. As a new Enterprise Strategy Group white paper explains, it’s key to understand their differences and to shift from ad-hoc vulnerability assessments to continuous, risk-based vulnerability management (RBVM). Read on to check out highlights from this Tenable-commissioned study and learn how RBVM helps organizations attain a solid security and risk posture in hybrid, complex and multi-cloud environments.
Microsoft’s July 2024 Patch Tuesday Addresses 138 CVEs (CVE-2024-38080, CVE-2024-38112)
July 9, 2024Microsoft addresses 138 CVEs in its July 2024 Patch Tuesday release, with five critical vulnerabilities and three zero-day vulnerabilities, two of which were exploited in the wild.
How the regreSSHion Vulnerability Could Impact Your Cloud Environment
July 5, 2024With growing concern over the recently disclosed regreSSHion vulnerability, we’re explaining here what it is, why it’s so significant, what it could mean for your cloud environment and how Tenable Cloud Security can help.
- Active Directory
- Government
- Threat Management