The Importance of Identity-Centric Security in 2024
summary
Demo shows an attacker using vssadmin create shadow to copy NTDS.DIT + SYSTEM from a live DC, then feeding extracted hashes into crackstation.net to recover about 10–15 real passwords, proving on‑prem AD is the weakest link that spreads to Azure and SaaS. Actionable fixes are listed: automated AD risk assessments every 180 days, scheduled access certification campaigns, HR/ITSM → IAM integration, non‑intrusive RBAC delegation, and a single adaptive MFA plus password blacklist policy tied into self‑service password workflows.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 3:10Digital identities in infrastructure
- 8:09Hacking Active Directory demo
- 21:40New network perimeter
- 27:53Identity security tips
- 39:18Active Directory risk assessment
- 44:19Access certification campaigns
- 46:48Authentication with MFA
- 52:34Summary
related talks
55mOffensive Azure Security
50mHybrid Active Directory Attacks: Anatomy and Defenses
50mBeyond the Mcse: Active Directory for the Security Professional
40mWhat’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech
40mTop Active Directory Attacks: Understand, then Prevent and Detect
50mAttacking and Defending the Microsoft Cloud (Office 365 & Azure AD)
23mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
42mWriting Your Own Ticket to the Cloud Like APT: A Dive to AD FS Attacks, Detections, and Mitigations