Active Directory forest and domain configuration. This includes evaluating the current Domain and Forest functional levels and identification of security enhancements in the current and higher levels.
Network Security Testing assesses the efficacy of security controls that protect your digital assets. Offensive Shield tailors network security testing to each client's defensive posture and security program maturity.
OSS performs an Active Directory Security Audit remotely in order to assess known security configuration issues. The ADSA involves running scripts and tools, and manual review of the Active Directory configuration and settings.
The assessment process has three primary phases:
01
02
03
OSS approaches this process as a partner and is fully committed to provide Active Directory security guidance that makes it more difficult for an attacker to gain access to the “crown jewels” on the network. Furthermore, OSS will model typical attacker methods and how they apply to the network, identifying the areas of concern and how best to mitigate them.
Active Directory forest and domain configuration. This includes evaluating the current Domain and Forest functional levels and identification of security enhancements in the current and higher levels.
Active Directory trust configuration and security.
Active Directory security misconfigurations are highlighted and recommended remediation/mitigation is provided.
Active Directory administration groups. This includes Enterprise Admins, Administrators, Domain Admins, custom delegation groups, and others as identified. Groups with logon rights to Domain Controllers are scrutinized and membership is expanded to gain a complete picture of the Active Directory administrators.
Custom security groups with privileged access to Active Directory are discovered and their access rights identified.
Group Policy security configuration for the domain and Domain Controllers.
Permissions for all Group Policy Objects (GPOs) are reviewed and issues with the delegation of GPOs are noted along with recommended remediation.
Service Accounts with elevated permissions. Identification of Kerberos enabled services and their associated service accounts. Special focus on service accounts with domain-level admin rights.
Domain Controller management review including Operating System versions, patching, backup.
Active Directory organizational unit (OU) permissions with a focus on top-level domain OUs.
Additional Active Directory object permissions are reviewed to identify potential “backdoor” access which is not obvious based on group membership.
Analyze domain password policies, to see if they enable users to create secure passwords. Generate reports to identify accounts with password vulnerabilities, including expired passwords, identical passwords, blank passwords, and more