Sponsored Microsoft released Active Directory (AD) in a time when it owned most of the business desktop and a large chunk of the server computing world. Two decades later, Microsofts directory and authentication system has become a single point for managing resources and identities in many a business computing setting.
That has also marked out AD for attention by hackers, meaning AD can become your Achilles heel. Attackers rattle the doors on 95 million AD accounts every day, according to enterprise software specialist Quest Software. This isn't the only directory service from Redmond under threat, though: according to Microsoft, 0.5 per cent of Azure Active Directory accounts are being compromised each month.
That might seem small but its a terrifying number because AAD is intrinsically linked to Office 365, and customers are adopting Microsofts cloud-based collaboration suite at a brisk clip. According to the 2019 cloud adoption report from Bitglass, Office 365 is the leader in cloud productivity by furlongs with a 79 per cent adoption rate compared to 33 per cent for Googles G Suite.
How do hackers try to break into Microsoft's directories? A lot depends on whether they're hitting AD or AAD. Microsoft says 40 per cent of compromised AAD accounts fall victim to password spraying, where hackers try to brute force access with obvious credentials.
Other common attacks include the exploitation of legacy protocols, some of which you can disable easily with group policies and some of which are more difficult to block. Attackers can also use tools like Mimikatz to sniff some credentials in memory, giving them account access. Kerberoasting attacks rely on poorly configured service accounts. Kerberos uses a service account's NTLM hash to sign access tickets. Those can be taken offline and cracked, giving attackers administrative access to the service account's service.
There are also some accounts that will have elevated privileges, for printer operators and backup and that will have the ability to log into Domain Controllers (DCs) by default. These are ripe for attack. What about AD? DDoS attacks will be used to distract admins while hackers go after specific data or individual accounts. Those mounting the attack don't always understand AD and, as long as they get the data or cause the disruption, they don't care if they break the system. Unfortunately for you, a broken SYSVOL or corrupted database can level an entire AD forest.
One of the directorys greatest strengths could also become its greatest problem for you. AD's replication lets you automatically copy critical data between locations. This means data in AD is always up to date, whatever the location. When the system is used properly this is a great back up measure and ensures streamlined operations, but if an attacker strikes this feature can turn against you. Any corruption the attacker introduces can propagate," Quest principal strategist Colin Truran tells us: "You might not spot that for a while until you reach the point where you cannot recover from it."
At that point, it's game over you'll need to restore everything.
Recovery will rely on full server backups, which might not always be possible. If, for example, your backup server has also been infected and locked down by ransomware, then you're really in trouble. When NotPetya hit logistics giant Maersk and wiped out its AD system, it was only saved by one of the companys offices in Ghana running AD. Thanks to poor local bandwidth, that office's domain controller hadn't replicated the corruption. The company shipped that machine for use in a painstaking rebuild.
The rising tide of these attacks and their consequences means that its crucial for organisations using AD and AAD to have a recovery plan in palace.
Recovery is a complex affair that involves dozens of steps for each domain, many of which must be carried out in a given order. At a high level, initial recovery means restoring the first writable controller for each domain, reconstructing AD services, cleaning up the metadata, re-establishing trust relationships, resetting accounts and restarting replication.
This is a complex enough process but other factors such as the standard practice of using a forest can make recovery even more difficult. In AD, a forest is a collection A collection of one or more domains. The first of which is the root that represents a security rather than the administrative boundary between domains.
In a single domain AD implementation you can restore just one of the DCs but in a multi-domain implementation there are forest-level roles that control things Like forest level identity and replication. Further, the domains underneath may have their own child domains arranged in a nested hierarchy. The order of restoration is therefore important, because those domains must authenticate with each other and set up trust relationships.
The other challenge comes when you try to restore AAD when its part of a hybrid arrangement. Many people tend to think AAD in the cloud in the cloud is simply a replica of their AD but that's a big mistake, warns Truran. "They really do not realize that there are so many elements in Azure that simply do not exist in Active Directory," he says. These elements include everything from user attributes such as application associations, multi-factor authentication data, and conditional access policies.
"If you restore an on-premise Active Directory object like a user and replicate that up [to the cloud], the user won't be able to access anything, because they will have no association with their mailbox, they'll have no access to applications. They won't even have a license."
It's vital, then, that any recovery plan is comprehensive and should you be running a hybrid cloud environment that it encompasses the restoration of both AD and AAD. Importantly, your plan should automate as many of the steps towards recovery as possible in this fiendishly complex process.
Unfortunately, many of those using AD and ADD don't have sufficient recovery plans in place. Also, they rely on manual administrative interfaces supported by rudimentary policies. This can make recovery succumb to mistakes that mean having to restart the whole recovery process.
Add to this the problem that recovery plans must be updated whenever anything changes in your AD or AAD such as changes to group-policy objects. These kinds of changes arise when organisations go through structural events like a merger or an acquisition. How many admin departments document those changes fully? Without a clear, complete and accurate picture of an AD or AAD implementation, recovery becomes a lot more difficult.
Automated backup and recovery tools can help overcome many of these challenges. Quest's Active Directory Recovery products automate and normalise the backup and recovery process, filling the gaps of native tools. Quest tools help protect your AD and AAD environments and restore them in an orderly and sequenced way. They also provide choices and the flexibility you need to select the parts of your directory hierarchy that you wish to recover rather than forcing you to restore it all useful for spot-fixing corrupt elements, Truran says. The Quest recovery system virtualises an AD configuration, too, so organisations can reorganize and make changes to AD safely by working on a representation of the system before going live.
For on-premises AD, Quest Recovery Manager ships with a version for object-level recovery that lets you recover from relatively straight-forward problems, a Forest Edition that provides full-forest recovery, and a full Disaster Recovery edition that offers automated restoration with the ability to also specify virtual environments so you can quickly and easily build a virtual lab from your live environment. That will also automatically document your recovery process for you, too.
Theres Quest On Demand Recovery, too. This is useful no matter whether you run just cloud objects with Azure or Office 365 or a hybrid of both cloud and on-prem systems. On Demand Recovery lets you set up backup and recovery for AAD and Office 365; you can run reports that compare your back ups with live AAD to discover users and assets and identify specific changes and deletions for automated recovery when needed. And, with On Demand Recovery you can search and recover individuals and group users in bulk, without needing to resort to manual, scripting-based procedures.
On Demand Recovery works with Quests on-premises Recovery Manager to give you a unified view of AD and AAD, too. And, finally, On Demand Recovery lets you restore on-premises AD to a virtual server in Azure so you can keep operating even if you have to rebuild your on-premises hardware following a cyberattack or data center disaster.
AD and AAD have become thoroughly entwined in the fabric of business computing so much so that losing them will cripple your business. A backup and recovery plan that is automated should be just as important to your operations as the directories themselves. Run AD and ADD without a plan to fallback on, and when disaster does strike youll find your list of problems just like your recovery time will get a lot longer.
Sponsored by Quest Software
Sponsored: Webcast: Build the next generation of your business in the public cloud
See the original post:
Rapid and risk-free Active Directory backup and recovery with Quest Software - The Register