{"id":1840,"date":"2018-05-02T08:16:11","date_gmt":"2018-05-02T08:16:11","guid":{"rendered":"https:\/\/www.teal-consulting.de\/2018\/05\/02\/esae-serie-teil-1-einleitung\/"},"modified":"2021-04-29T13:06:38","modified_gmt":"2021-04-29T11:06:38","slug":"esae-series-part-1-introduction","status":"publish","type":"post","link":"https:\/\/www.teal-consulting.de\/en\/2018\/05\/02\/esae-series-part-1-introduction\/","title":{"rendered":"ESAE series part 1- Introduction"},"content":{"rendered":"
[vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”50″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text]\n
\n
\n

In the blog category “Secure Administration Environment” we want to share our experiences from customer projects around Microsoft’s Enhanced Security Administration Environment (ESAE), so that others can learn from our experiences and not stumble across the same problems as we did.<\/p>\n

We will start with a series on a very exciting topic that we have been able to work on for a globally active insurer in recent months: The complete implementation of an environment inspired by ESAE.<\/p>\n

In this first article of the series, we want to explain what it deals with, why it is necessary and what components the environment is made up of. In further articles, we will examine individual components in more detail and finally to summarize our practical experiences and our handling of the stumbling blocks in the last article.<\/p>\n

ESAE is a design approach by Microsoft (ESAE documentation by Microsoft<\/b><\/a>) to make credential theft and pass the hash\/pass the ticket attacks more difficult or to at least to reduce their impact. There are entire blog series and white papers (http:\/\/adsecurity.org\/<\/b><\/a>\u00a0and\u00a0Microsoft white paper<\/b>) on credential theft, pass the hash\/pass the ticket, so we’ll only cover a short summary and provide links to more in-depth topics.<\/p>\n<\/div>\n

\n

The problem:<\/b><\/p>\n

Because of the way Windows and Active Directory work, there are a number of ways for attackers to read and use passwords or their hashes. All that’s needed are admin rights on a workstation and freely accessible tools like Mimikatz (Github<\/strong><\/a><\/b>\u00a0and\u00a0BlueHat talk<\/strong><\/a><\/b>).<\/p>\n

Admin rights can be acquired through a phishing attack or a social engineering attack, for example. According to the study ‘Wombat Security State of the Phish 2017’, 76% of all organisations were the victims of phishing attacks in 2016 alone. Particularly with larger organisations, chances are that sooner or later, an attacker will succeed.<\/p>\n

In the next step, the attacker will try to spread themselves in the network. In the past, attackers had to spend a lot on moving around the network via trial and error methods in order to eventually acquire privileged accounts. Today, there are tools like Bloodhound (Github<\/strong><\/a><\/b>\u00a0and \u2013\u00a0DEF CON 24 talk<\/b><\/a>) which display the path from the captured computer to the domain admin account (or any other) within a few minutes.<\/p>\n

I advise everyone to look at the linked talks. It’ll open your eyes!<\/p>\n<\/div>\n

\n

The (ESAE) solution:<\/b><\/p>\n

As already stated above, ESAE is not a single technique, no tool or service that solves all these problems, but a set of techniques, tools, and work methods that make it difficult for an attacker to acquire highly privileged accounts and cause damage with them.<\/p>\n

The core of the solution is to subdivide the IT services and systems into different tiers on the basis of the protection needs and to outsource the admin accounts for the tiers with high protection needs to a separate administration forest.<\/p>\n<\/div>\n<\/div>\n[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_empty_space height=”20″][vc_single_image image=”1221″ img_size=”full” alignment=”center” qode_css_animation=””][vc_empty_space height=”20″][vc_column_text]If you check out the Microsoft documentation, the systems are devided into the tiers as follows:<\/p>\n

Tier 0: Entreprise identity systems such as Active Directory, PAM systems, ADFS.<\/p>\n

Tier 1: Entreprise applications such as email, collaboration and other line of business applications.<\/p>\n

Tier 2: Workstations.<\/p>\n

This classification has to be enjoyed with a pinch of salt, of course. Every company has one or another highly protective system which doesn’t fall into the above definition for tier 0. These systems can and should be protected as well just the same, of course.<\/p>\n

The admin accounts don’t have constant standing administration rights per se, though. These need to be requested via a just-in-time Privilege Access Management (PAM) solution for a defined period of time. Furthermore, the environment can only be administered with hardened Privilege Access Workstations (PAWs).<\/p>\n

Since the introduction has become a little bit longer than expected, we’ll do a cut here and present the specific customer scenario and the selected architecture in the next blog article.[\/vc_column_text][vc_empty_space height=”40″][vc_column_text]Source: freepik.com<\/a>[\/vc_column_text][vc_empty_space height=”50″][vc_raw_html]JTNDYSUyMGhyZWYlM0QlMjJqYXZhc2NyaXB0JTNBaGlzdG9yeS5iYWNrJTI4JTI5JTIyJTNFJTNDc3BhbiUyMHN0eWxlJTNEJTIyY29sb3IlM0ElMjAlMjNmZjIwNzAlM0IlMjIlM0UlM0MlM0MlMjBCYWNrJTNDJTJGc3BhbiUzRSUzQyUyRmElM0U=[\/vc_raw_html][vc_empty_space height=”50″][vc_separator type=”small” position=”center” color=”#eeeeee” thickness=”2″ width=”1100″][vc_empty_space height=”100″][\/vc_column][\/vc_row][vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_column_text]\n

LATEST POSTS<\/h2>\n[\/vc_column_text][vc_empty_space height=”30″]\n
\n