Active Directory Security Best Practices

Active Directory Security should be a top priority of any organization. Read on to learn why AD is so important and how to protect yourself from cyber attacks.
Michael Buckbee
4 min read
Last updated February 25, 2022

Active Directory security is important because Active Directory(AD) represents the keys to the kingdom. Imagine that box where your store all of the physical keys to every door in the office building. AD is just like that box, but for every computer, software application, and service you run on your entire network. You keep that physical box of keys protected and secured – or you should – and you need more security to protect AD from cyber attacks.

Verizon’s security team researched over 53,000 cyber attacks for their 2018 Verizon Data Breach Investigation Report. During that research, Verizon confirmed 2,616 data breaches. For comparison, in 2017, the FBI tracked 19,502 burglaries of offices in the United States. It stands to reason that your digital presence is a much bigger target than your physical office space, so let’s dig into AD security and establish best practices to prevent data breaches with a well defended Active Directory.

Get the Free Pentesting Active
Directory Environments E-Book

Why is Active Directory Security Critical?

Why is Active Directory security so important? Because Active Directory is central to all of the steps of the cyber kill chain. To perpetuate an attack, attackers need to steal credentials or compromise an account with malware, then escalate privileges so they have access to all of the resources they need. If you don’t have proper security and audit controls for AD in place attackers could hide and steal any data they wanted, and you might never know.

cyber kill chain phases

Common Active Directory Security Risks

Active Directory has been around since Windows 2000, and that is quite enough time for attackers to figure out many different ways to exploit vulnerabilities in and around the system, including the humans who use the system.

Common Active Directory Security Vulnerabilities

  • Active Directory currently uses Kerberos authentication, which itself has several vulnerabilities
  • AD used to use and still supports NTLM encryption, which is very weak in today’s standards
  • Attackers can use a brute force approach to break into Active Directory
  • Phishing and malware are very common methods of stealing user credentials

User-Related Active Directory Security Threats

  • Phishing also falls under this category, because phishing doesn’t always attack AD directly, but it takes advantage of the human’s desire to click a link
  • Social engineering is phishing but more in person, like someone calling you and saying they are from the IT department and you need to log in with your user and password, but they aren’t from IT, and they just stole your credentials
  • One element of social engineering is spear phishing – impersonating a high ranking officer of a company to deceive others to steal money or data

active directory security risks

Active Directory Security Best Practices

To counter the many vulnerabilities and attacks used to break into AD, security experts have developed a set of best practices for securing active directory.

Document Your Active Directory

To keep a clean and secure AD, you must know everything about that AD – and I do mean everything. Document naming conventions and key security policies in addition to every user, service account, computer, and access group.

Here’s a good first checklist:

  • Identify all of your computers, users, domain, and OU naming conventions.
  • Describe your OU hierarchy, DNS configuration, network numbering conventions, and DHCP configuration.
  • List the main functions of your GPOs and the process of organization.
  • Take note of the locations of AD’s Flexible Single Master Operation Roles (FSMO) roles.
  • Identify the organization’s policy when adding new user accounts or when revoking user accounts.
  • Describe the organizations’ policy for user restrictions.

Enforce Safe Practices Among Users

Once you have the rest of your security stack tightened up, the weak link in your data security will be the humans themselves. Research shows that humans will click a phishing link or get fooled by a whale phishing or social engineering scam – it’s going to happen. It is vital that you prepare and train your users to recognize these threats and have the ability to notify the Incident Response team if they suspect an attacker compromised their account.

Here are some other basics to enforce with your users:

  • Enforce a good password policy. What is a good password policy? That is still up for debate. NIST recently updated their policy, and other security experts recommend an encrypted password manager to keep randomized long passwords safe. In any case, the longer the password with more character options the better.
  • Train users to recognize phishing attacks.
  • Prevent users from making administrative changes on their laptop that could compromise their security.
  • Give System Administrators two accounts: one for normal usage and an Administrator account to perform changes.
  • Limit administrative accounts to the assigned systems, with redundancies in place of course. You don’t want a single Admin account that can open all the “doors.”

Secure Domain Controller

Make it close to impossible to reach your Domain Controllers. You can configure your network to allow access to DCs only from a hardened and secured computer without access to the internet. Adding this layer of security will keep your DC safer from outside intrusion and lateral movement or privilege escalation attacks from inside your network.

Employ the Least Privilege Model

The least privilege model is one of the best investments you can make to keep your networks secure from cyberattacks. Least privilege says that each user only has access to the resources they need to do their job, including admins and service accounts. If any account gets compromised, using the least privilege model will minimize your overall risk of exposure to data theft.

Monitor Active Directory for Compromise

Lastly and most importantly, monitor Active Directory. You should know every change, every login request, and every GPO change that happens on your DCs. That’s a huge amount of data and will require automation to analyze. Varonis monitors Active Directory and correlates perimeter telemetry, file activity, and user behavior to detect unusual activity or abnormal behaviors. You can uncover critical misconfigurations, monitor & alert on changes to security groups, GPOs, OUs, and other AD objects. Varonis then leverages advanced data security threat models to determine if there are current behaviors or events that indicate a possible cyberattack.

For example, a user logging in after-hours isn’t necessarily all that interesting, but a user logging in after-hours from a different country and then accessing sensitive credit card data is! Varonis makes sense of the chaos in your data so you can protect AD and prevent data breaches.

Monitoring Active Directory is so important, in fact, that we’ve created a dashboard just for that. You can track disabled accounts, accounts without passwords or non-expiring passwords, and even any accounts with weak encryption settings. These metrics represent areas of risk in AD, and provide a way for you to prioritize resolving those issues.

active directory security best practices

Want to learn more about Active Directory cyberattacks – and how to stop them? Check out our on-demand webinar 25 Key Risk Indicators to Help Secure Active Directory – and see our dashboards in action.

Tracking this data daily will show you if someone creates a new account incorrectly, if an attacker has changed the encryption type, or any number of other indicators of a cyberattack.

What should I do now?

Below are three ways you can continue your journey to reduce data risk at your company:

1

Schedule a demo with us to see Varonis in action. We'll personalize the session to your org's data security needs and answer any questions.

2

See a sample of our Data Risk Assessment and learn the risks that could be lingering in your environment. Varonis' DRA is completely free and offers a clear path to automated remediation.

3

Follow us on LinkedIn, YouTube, and X (Twitter) for bite-sized insights on all things data security, including DSPM, threat detection, AI security, and more.

Try Varonis free.

Get a detailed data risk report based on your company’s data.
Deploys in minutes.

Keep reading

Varonis tackles hundreds of use cases, making it the ultimate platform to stop data breaches and ensure compliance.

the-difference-between-ssl-and-tls
The Difference Between SSL and TLS
SSL and TLS are used interchangably in conversations as they are incredibly closely related. Knowing the subtle difference is key. 
someone-deleted-my-file.-how-can-i-find-out-who?
Someone Deleted My File. How Can I Find Out Who?
If you’ve ever been tasked with recovering a lost file or folder and had to explain exactly what happened (Who moved or deleted it? When did it happen? Why?), you...
kerberos-attack:-silver-ticket-edition
Kerberos Attack: Silver Ticket Edition
With a name like Silver Ticket, you might think it’s not as scary as its cousin the Golden Ticket – you’d be horribly mistaken. A Silver Ticket is just as nasty...
in-search-of-kerberos’s-golden-ticket
In Search of Kerberos’s Golden Ticket
In a Kerberos environment, all users get tickets, or more specifically TGTs (Ticketing Granting Tickets). It’s the starting point for gaining access to services—network files, email, apps, etc.  In Windows,...