Treat the Problems, Not the Symptoms
summary
Shows how a failed remediation after a pen test leads to real breach — Singapore healthcare exposes 1.5M records — and demonstrates concrete AD attacks: credential theft with mimikatz, unconstrained delegation abused via Print Spooler/Exchange RPC to capture DC TGTs and perform DCSync, and LSA/Credential Guard limits and bypasses via token impersonation. Proposes a practical mitigation model (configuration-complexity tiers), specific fixes like deny Network Logon for local admins, mark sensitive accounts to disable delegation, enforce SMB signing, remove excess built-in privileged groups, and use tiered privileged workstations and noninteractive admin logons.
AI-written summary · about
chapters (11)
- 0:00Introduction to talk
- 1:02Fundamental Active Directory issues
- 2:50Attacker mindset in AD security
- 5:58Credential theft attacks in AD
- 8:24Unconstrained delegation exploit
- 10:51Limitations of security controls
- 13:19LSA protection and credential guard
- 15:49Baby steps to secure domain
- 19:43Administrative tier model
- 21:30Logon types and credential exposure
- 22:15Q&A
related talks
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
50mBeyond the Mcse: Active Directory for the Security Professional
20mStop Doing Stupid $%^--How Not to Secure Your Environment
40mTop Active Directory Attacks: Understand, then Prevent and Detect
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
29mGet the Freaking Basics Right!
52mStart covering your bases & Stop chasing APT headlines
42mStart Covering Your Bases And Stop Chasing APT Headlines