如何保護 Active Directory 對抗勒索軟體攻擊
勒索軟體會從各種角度攻擊各種類型的企業，而 Active Directory 仍然是最常見的目標。透過修復這些關鍵的 AD 與群組政策錯誤設定來遏止權限提升。
勒索軟體打擊了全球各地各種類型的企業。但它也有很大幅的改變。它會從幾乎各種角度進入企業，包括攻擊者會利用竊取而來的資料張貼在網際網路上，迫使受害者付出贖金。在大多數的案例中 (參見 SolarWinds 和 XingLocker)，Active Directory (AD) 都被當成目標，讓攻擊者在取得網域特殊權限後，得以輕易地散播勒索軟體。不過，也有一些方法能協助保護 Active Directory 避免勒索軟體成功得手。
我們可保護 Active Directory 當中的不同部份，如此可提高企業的整體安全性，並同時降低安全風險。尤其是能夠保障以下有關 AD 物件的設定。以下說明它的運作方式：
- 必須修正使用者屬性的錯誤設定
- 必須修正群組的錯誤設定
- 必須清理特殊權限群組
- 必須要有正確的 AD 流程設定 (例如：SDProp)
- 服務主體名稱 (SPN) 必須要受到保護 (如圖 1 所示)
- 信任關係必須正確且受到保護
- 必須清理使用者的 SidHistory 屬性
圖 1.具有 Service Principal Name (SPN) 的使用者帳戶
此外，保護 AD 本身和群組政策可確保攻擊者無法利用錯誤設定和提升權限可以達到的地方。以下說明它的運作方式：
- AD 信任關係必須經過驗證且受到保護 (如圖 2 所示)
- 必須清理 AD 的委派
- 必須清理群組政策的委派
- 群組政策結構元件必須受到保護
- 必須啟用由群組政策物件部署的安全設定
圖 2.合併與併購案可能會讓信任關係變得無人管理；此外，要求的信任關係也必須受到保障。
最後，攻擊者會想要獲得特殊權限。 一旦取得特殊權限，他們就會建立後門。因此，能夠偵測這些類型的 AD 攻擊就變得十分重要。以下是 AD 管理員和資安專業人員要中斷攻擊路徑時能夠採取的行動：
- 確保特殊權限群組成員資格受到監控
- 偵測 DCShadow 和 DCSync 攻attacks
- Golden Ticket 攻擊 (如圖 3 所示)
- 偵測橫向移動攻擊
- 偵測危險的 SIDHistory 和 PrimaryGroupID 設定
圖 3.Tenable.ad 能夠即時偵測 Active Directory 上的進階攻擊，且無需代理程式或特殊權限。
我們提供了可持續且自動分析與偵測 AD 安全與攻擊路徑的技術。想深入瞭解 Tenable.ad 如何提供協助，歡迎觀看此網路研討會：全新推出的 Tenable.ad：保障 Active Directory 的安全並中斷攻擊路徑
深入瞭解
相關文章
Cybersecurity Snapshot: CISA Shines Light on Cloud Security and on Hybrid IAM Systems’ Integration
March 15, 2024Check out CISA’s latest best practices for protecting cloud environments, and for securely integrating on-prem and cloud IAM systems. Plus, catch up on the ongoing Midnight Blizzard attack against Microsoft. And don’t miss the latest CIS Benchmarks. And much more!
Poor Identity Hygiene at Root of Nation-State Attack Against Microsoft
February 1, 2024The latest breach suffered by Microsoft shows once again that detection and response are not enough. Because the source of an attack almost always boils down to a single overlooked user and permission, it’s critical for organizations to have strong preventive security.
Cybersecurity Snapshot: What’s in Store for 2024 in Cyberland? Check Out Tenable Experts’ Predictions for OT Security, AI, Cloud Security, IAM and more
December 29, 2023The new year is upon us, and so we ponder the question: What cybersecurity trends will shape 2024? To find out, we asked Tenable experts to read the tea leaves. Their 2024 forecasts include: A bigger security role for cloud architects; a focus by ransomware gangs on OT systems in critical industries; an intensification of IAM attacks; and much more!
Cybersecurity Snapshot: U.S. Gov’t Unpacks AI Threat to Banks, as NCSC Urges OT Teams to Protect Cloud SCADA Systems
March 29, 2024Check out new guidance for banks on combating AI-boosted fraud. Plus, how to cut cyber risk when migrating SCADA systems to the cloud. Meanwhile, why CISA is fed up with SQLi flaws. And best practices to prevent and respond to DDoS attacks. And much more!
Enhancing Transportation Cybersecurity and Fleet Management for the DoD
March 25, 2024Few things can halt operations across the Department of Defense like a critical failure of logistics and transportation. From automated asset inventory to malicious-activity detections through baselining, learn how Tenable OT Security can protect these critical functions within the DoD and work towards the federal government’s zero trust mandate in OT environments.
Cybersecurity Snapshot: NSA Picks Top Cloud Security Practices, while CNCF Looks at How Cloud Native Can Facilitate AI Adoption
March 22, 2024Check out the NSA’s 10 key best practices for securing cloud environments. Plus, learn how cloud native computing could help streamline your AI deployments. Meanwhile, don’t miss the latest about cyberthreats against water treatment plants and critical infrastructure in general. And much more!
- Active Directory
- Government
- Threat Management