{"id":6247,"date":"2022-06-20T10:46:36","date_gmt":"2022-06-20T08:46:36","guid":{"rendered":"https:\/\/www.teal-consulting.de\/?p=6247"},"modified":"2022-08-02T13:18:26","modified_gmt":"2022-08-02T11:18:26","slug":"establish-security-boundaries-in-your-on-prem-ad-and-azure-environment","status":"publish","type":"post","link":"https:\/\/www.teal-consulting.de\/en\/2022\/06\/20\/establish-security-boundaries-in-your-on-prem-ad-and-azure-environment\/","title":{"rendered":"Establish security boundaries in your on-prem AD and Azure environment"},"content":{"rendered":"
[vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”30″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=”” padding_top=”20″ padding_bottom=”20″][vc_column_inner][vc_column_text][\/vc_column_text][vc_empty_space height=”20″][vc_column_text]\n

Preventing escalation from initial access in your Active Directory (AD) environment to Domain Admins can feel impossible, especially after years of successful red team engagements finding new attack paths each time. While securing your critical assets is challenging, it is not impossible with the right approach.\u00a0<\/span><\/p>\n

This blog post provides a high-level explanation of how to implement security boundaries in an on-prem AD and Azure environment to protect your critical assets based on the principle of tiered administration, including how BloodHound Enterprise can help you in the process. Finally, we will cover how to organize your AD objects and Azure resources in a structure that reflects your security boundaries.\u00a0<\/span><\/p>\n

The blog post was produced as a collaboration between Teal<\/a> and SpecterOps<\/a>.<\/p>\n

We recommend that you have a basic understanding of attack paths before reading this blog post, which you can gain from the first section of wald0<\/a>\u2019s deep dive into the subject: The Attack Path Management Manifesto<\/a>.[\/vc_column_text][vc_empty_space height=”20″][vc_video link=”https:\/\/youtu.be\/PRl5RIjb0bU” el_width=”70″ align=”center”][vc_empty_space height=”30″][vc_column_text]\n

Old and new Microsoft recommendations<\/span><\/h2>\n

Historically, Microsoft recommended using the Enhanced Security Admin Environment (ESAE) architecture to provide a secure environment for AD administrators to prevent full compromise of a production forest in case of compromise of non-admin users. The AD tier model was part of ESAE. Because Microsoft created ESAE before they made Azure, ESAE was explicitly designed for on-prem AD. Thanks to the Internet Archive, you can still read Microsoft\u2019s old version of Securing Privileged Access<\/em> with EASE, the tier model, etc., here<\/a>.<\/p>\n

On December 15, 2020, Microsoft published their new revised version of Securing Privileged Access<\/a> on Microsoft docs, including the Enterprise Access Model, which encompasses both on-prem, Operational Technology (OT), Azure, and other cloud providers. Microsoft retied ESAE and took down their old recommendations.<\/p>\n

The principles for Microsoft\u2019s old and new recommendations are effectively the same. They recommend tiered administration with dedicated admin accounts. Admins should use a hardened Privileged Access Workstation (PAW) when performing administrative tasks, and the admin session must require Multi-Factor Authentication (MFA) and Just-In-Time (JIT) restrictions. Deployment of PAWs and other critical assets must comply with the clean source principle<\/a>.<\/p>\n

The main difference between the two sets of recommendations is the focus on Azure. The previous recommendations had a strong focus on preventing cached credentials, an extensive security challenge in on-prem environments. Microsoft\u2019s latest recommendations include Azure technologies like Conditional Access, which is highly relevant for Azure as the control panels are Internet exposed.<\/p>\n

As the core fundamentals of each are the same (limiting access to privilege, we recommend using elements from ESAE as the underlying basis for creating security boundaries in on-prem AD and use Microsoft\u2019s latest recommendations for Azure.<\/p>\n

In the following sub-sections, we will dive into the tier model from ESAE and the equivalent Enterprise Access Model from the latest Securing Privileged Access.[\/vc_column_text][vc_empty_space height=”30″][vc_column_text]\n

Active Directory administrative tier model<\/span><\/h2>\n

The purpose of the tier model is to implement security boundaries that will protect critical assets from high-risk devices like regular workstations adversaries frequently compromise.<\/p>\n

\"\"<\/p>\n