Securing Hybrid Identity

Identity is the new security perimeter. Any breach in this perimeter can enable malicious users to gain access to your apps, your data, and your business operations. For organisations that rely on Azure Active Directory  or a hybrid environment of Azure AD and on-premises Active Directory to provide identity services, securing hybrid identity can be a complex and time-consuming task. Yet it’s one that’s absolutely vital. 

Hybrid environments, especially, are prone to errors and misconfigurations that leave the door wide open to cyber attacks. And by compromising your on-prem Active Directory, attackers can extend their dirty work into Azure AD or vice versa. The SolarWinds attack is a prime example of this type of strategy. 

The challenges of securing hybrid identities are quite different from those found in purely on-premises environments. If your infrastructure includes Azure AD - and if your organisation uses Microsoft Office 365, it does - here are the top issues to guard against. 

Lateral Attacks From Within On-Premises AD 

Cyber criminals often use phishing and social engineering attacks to target vulnerable users and trick them into disclosing sensitive information, including identity credentials. The SolarWinds and Colonial Pipeline attacks illustrate the risk. The threat actors in these cyberattacks gained dominance over on-premises AD, compromised the ADFS federation to forge SAML tokens, and gained access to Azure AD. 

What You Can Do To Thwart Attackers When Securing Hybrid Identity 

First and most obvious, enforce MFA. Stolen identity credentials are one of cyber attackers’ most dangerous tools, and the use of those credentials can go undetected for long periods. Not all monitoring systems flag unusual account activity, so this additional layer of protection is important. 

Second, understand that modern hybrid identity management calls for additional security controls beyond those available in a traditional ADFS deployment. Maintaining the necessary infrastructure to host ADFS carries its own risks, including missed patches, outdated hardware, and so on. 

Instead, consider AD Pass-through Authentication, which enables use of the same password to log in to both on-premises and cloud applications. This approach uses an outbound-only connection model and certificate-based authentication to delegate the authentication process to the on-premises Active Directory, providing a more secure alternative to ADFS. You can also integrate AD Pass-through Authentication with other Azure AD security measures to guard against infiltrations and credential thefts. And you can synchronize AD password hashes to Azure AD. 

You might also consider Azure AD Application Proxy, which uses Azure AD credentials to configure secure remote access to applications hosted on-premises and provides the same user experience as any Azure AD-integrated application. 

Configuration Creep & Complexity 

Hybrid identity protection complicates your job—whether you’re an AD admin, an identity pro, or a security expert. Threats are continually evolving and locking down access to your Tier 0 assets—including AD and Azure AD—is a time-consuming chore. But neglect it, and you can easily find yourself spending that time scrambling to recover AD from a cyberattack. 

Using Azure AD for third-party application authentication adds complexity to the security model. In some cases, these apps can read and store data from Azure AD, extending your risk perimeter and leaving data security dependent on the third-party application with which Azure AD integrates. 

Another possible weak spot is the level of permissions given to applications in Azure AD. If you don’t carefully review permission settings before granting access, these apps might end up with more permissions in Azure AD than they require. This potential oversight adds to the risk of applications making changes in the AD tenant. And security measures like MFA might not work for some apps, making them dependent on whatever security controls the app can provide. 

What You Can Do To Tighten Access 

These potential security gap calls for strict governance and periodic audits of app permissions to understand where to implement additional restrictions. Tie up any loose ends and ensure that you have the right set of roles enabled in Azure AD, audit app permission settings and tighten app security configurations, and add guardrails such as MFA. 

Also, evaluate the way you manage RBAC. The assignment of roles in Azure AD differs from traditional AD access management, so carefully consider how roles are defined and permissions granted. 

Following the principle of least privilege is important when securing hybrid identity. Don’t add accounts that you synchronised from on-prem AD to Azure AD into a privileged RBAC role such as Global Administrators. Reserve those highly privileged roles for native Azure AD accounts. You can also create Administrative Units in your Azure AD tenant. This capability enables you to restrict the objects that IT team members can manage via a specific RBAC role, further supporting least privilege. 

Misconfigurations & Other Security Vulnerabilities 

Misconfigurations and security vulnerabilities associated with your identity management solution provide access points for cyber attackers. Azure AD consists of managed services; Microsoft manages the security of its underlying infrastructure in the cloud. But the security of your data and Azure AD configuration is your responsibility. 

During a cyberattack, attackers can alter or wipe out users, groups, roles, conditional access policies, and so on. Unless you have a proper recovery plan, you could be looking at a devastating and long-lasting impact. There are few native controls to protect data or configurations in Azure AD from being overwritten during an attack. 
What you can do to make securing hybrid identity less complicated 

The Azure AD recycle bin provides a soft delete feature that can help you restore deleted users. However, this feature has minimal capabilities to restore anything beyond a 30-day window. 

Other forms of compromise can be difficult to detect and mitigate, especially if attackers move laterally from on-prem AD to the cloud. In addition to native security measures, IT leaders should explore tools with advanced capabilities to help you track attacks that could extend laterally across hybrid environments. change-tracking and auto-remediation features can protect against stolen credentials and malicious insiders. Always have a proactive, tested recovery plan for Active Directory and Azure AD. 

Guido Grillenmeier is Chief Technologist at Semperis  

You Might Also Read: 

Detecting & Mitigating Cyber Attacks:

 

« India's Health Systems Are A Top Target
NATO Secrets Found For Sale On The Dark Web »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Sangfor Technologies

Sangfor Technologies

Sangfor is a global leader of IT infrastructure, security solutions, and cloud computing.

Syhunt Security

Syhunt Security

Syhunt is a leading player in the web application security field, delivering its assessment tools to a range of organizations across the globe.

Rewertz

Rewertz

Rewterz is a cyber security company based out of Dubai, serving customers in UAE, Oman, Qatar, Bahrain, Saudi Arabia, and Pakistan.

DynaRisk

DynaRisk

DynaRisk helps companies protect their staff, clients and supply chain from cyber threats by enabling people to take action for themselves.

CyberStream

CyberStream

CyberStream, a division of the TechStream Group, is an information & cybersecurity talent acquisition solution provider.

NinjaJobs

NinjaJobs

NinjaJobs is a community-run job platform developed by information security professionals. We focusing strictly on cybersecurity positions.

MagicCube

MagicCube

MagicCube is a device independent IoT security platform that protects against on-device, cloud, and network attacks.

EVOLEO Technologies

EVOLEO Technologies

EVOLEO provides engineering services covering a wide range of needs in the electronics design, embedded and systems engineering.

Newtec Services

Newtec Services

IT should be responsive, adaptive, and smart. Now more than ever, you need a business that runs efficiently and can adapt to today's challenges. We can help with custom IT solutions.

INVISUS

INVISUS

INVISUS protects businesses against the latest cyber risks – including business and employee identity theft, data breaches, and cybersecurity compliance.

Veratad Technologies

Veratad Technologies

Veratad Technologies, LLC is a world class provider of online/real-time Identity Verification, Age Verification, Fraud Prevention and Compliance Solutions.

Have I Been Pwned (HIBP)

Have I Been Pwned (HIBP)

Have I Been Pwned is a free resource for anyone to quickly assess if they may have been put at risk due to an online account of theirs having been compromised or "pwned" in a data breach.

BlueHalo

BlueHalo

BlueHalo is purpose-built to provide industry capabilities in the domains of Space Superiority and Directed Energy, Missile Defense and C4ISR, and Cyber and Intelligence.

Axiata Digital Labs

Axiata Digital Labs

Axiata Digital Labs is the technology hub of Axiata Group Berhad Malaysia which is one of the leading groups in telecommunication in Asia.

LockMagic

LockMagic

Lockmagic is an information asset management solution to protect, track, audit and control accesses to sensitive information inside and outside your organization.

Redapt

Redapt

Redapt is an end-to-end technology solutions provider that brings clarity to a dynamic technical environment.