Want to Disrupt Attacks? Protect Your Active Directory Domains!

Active Directory domains are living, ever-evolving assets that organizations need to secure now. Adversary success rates depend on mis- or loosely configured domains to harvest credentials, move laterally, and achieve their objectives. Luckily for defenders, the best Active Directory defense is a proactive defense: one that provides immediate and vital insight organizations can use to protect their domains. In this review, SANS instructor and security expert Matt Bromiley explores Tenable.ad as a tool for identifying and addressing Active Directory security. Key takeaways from our Tenable.ad review include:

• Critical Active Directory insights such as key account metrics and security compliance scores
• Real-time indicators of exposure (IoE) and indicators of attack (IoA)
• Using Tenable.ad's Trail Flow to provide granular history of Active Directory changes
• Building and applying dynamic YARA rules and mapping activity to the MITRE ATT&CK framework