Single Sign-On and the Dangers of Active Directory

Image

Active Directory is a staple of enterprise IT and it nominally ensures secure, authenticated access to a company's core business applications. Like other pivotal parts of the Microsoft Windows ecosystem, though, it can become problematic if it isn't properly monitored and supported by up-to-date security software, modern hardware, and access controls.

Accordingly, system administrators face many potential risks when working with Active Directory, with some of the most notable being:

• Privilege escalation
• Pass-the-hash attacks
• Renamed or modified domains and directories
• Insider threats to accounts
• Managed server/client failure

These issues run the gamut from malicious attacks to accidental oversights, with plenty of possible technical failures in between. A common thread running through these Active Directory worst-case scenarios is credential theft and misuse, which enables unauthorized access to domain admin or enterprise admin capabilities.

This authentication headache has been compounded by the rise of software-as-a-service solutions. These apps have to be integrated into Active Directory, saddling everyone with more username/password combos to remember.

In this context, single sign-on is a good way to simplify Active Directory management and mitigate risk. We'll review a few of the main Active Directory dangers and how single sign-on can address them.

Privilege Escalation

Escalation refers to the accumulation of additional privileges by a non-admin account. This risk is considerable since it has such a low bar to entry and a huge attack surface.

Anyone with read access to Active Directory content, a tool (there are many) for scanning Access Control Lists and the ability to create administrative tasks could find a path to escalation. Multi-factor authentication can only go so far in mitigating this risk due to how easy it can be to reset account passwords.

Renaming the Domain

Changing the domain's name is a big undertaking with far-reaching consequences. Some versions of Microsoft Exchange are incompatible with renamed domains. There's also the issue of locking out any users who aren't guided through the transition and instructed to unjoin the old domain and reboot their workstations.

Since an unneeded renaming could be pulled off by unauthorized users, it's important to streamline and harden access controls through single sign-on.

Administrative account/workstation takeover

High-level Active Directory accounts have extensive privileges, making them natural targets of hackers and insiders. Escalation may be used to reset admin passwords, or attackers may resort to classic brute-force attacks. Workstations may also be targeted by physical access or host compromising.

To drive down risk, administrators may avoid logging onto machines other than their own. Single sign-on, multi-factor authentication and strong passwords can all make it easier to ensure that a user is who she says she is. For workstations, a mix of physical and network security is vital to blocking unauthorized logins.

Single sign-on goes a long way toward eliminating the above risks as well as many others. Active Directory users may be matched against third-party databases to verify identity. Passwords can also be kept in sync to better monitor any changes, intended or otherwise.