+APP.2.2 Active Directory
---+APP.2.2.G1. Inadequate Planning of Security Boundaries
---+APP.2.2.G2. Excessive or Negligent Trust Relationships
---+APP.2.2.G3. Lack of Security Features due to Older Operating Systems and Domain Functional Level
---+APP.2.2.G4. Operation of Additional Roles and Services on Domain Controllers
---+APP.2.2.G5. Insufficient Monitoring and Documentation of Delegated Rights
---+APP.2.2.G6. Insecure Authentication
---+APP.2.2.G7. Overly Powerful or Insufficiently Secure Service Accounts
---+APP.2.2.G8. Use of the Same Local Administrator Password on Multiple IT Systems
---+APP.2.2.A1 Planning Active Directory [Process Owner] (B)
---+APP.2.2.A2 Planning of Active Directory Administration [Process Owner] (B)
---+APP.2.2.A3 Planning of Group Policy in Windows (B)
---+APP.2.2.A5 Hardening Active Directory (B)
---+APP.2.2.A6 Maintaining the Operational Continuity of Active Directory (B)
---+APP.2.2.A7 Implementation of Secure Administration Methods for Active Directory [Process Owner] (B)
---+APP.2.2.A8 Configuration of Secure Channel in Windows (S)
---+APP.2.2.A9 Authentication Protection When Using Active Directory (S)
---+APP.2.2.A10 Secure Use of DNS for Active Directory (S)
---+APP.2.2.A11 Monitoring Active Directory Infrastructure (S)
---+APP.2.2.A12 Backups for Domain Controllers (S)
---+APP.2.2.A14 Use of Dedicated Privileged Administration Systems (H)
---+APP.2.2.A15 Separation of Administration and Production Environments (H)

APP.2.2 Active Directory

Introduction

Active Directory (AD) is a directory service developed by Microsoft that was introduced for the first time with the Windows 2000 Server operating system. Based on the Active Directory functions available in Microsoft Windows 2000 Server, additional key functions have been added to the service in every release of the Windows Server family of operating systems.

Active Directory is mainly used in networks with Microsoft components. An AD stores information about objects within a network, such as users or IT systems. It makes it easier for users and administrators to provide, organise, use, and monitor this information. Since Active Directory is an object-based directory service, it facilitates the administration of objects and their mutual relationships, which is what constitutes an actual network environment. Active Directory thus provides central control and monitoring capabilities for a given network.

Objective

This module is designed to help secure Active Directory in normal operations in organisations that use it to administer their infrastructure of Windows systems (client and server).

Scoping and Modelling

Module APP.2.2 Active Directory must be applied to all directory services that are based on Microsoft Active Directory.

This module examines the threats and requirements that apply specifically to Active Directory. General security recommendations for directory services can be found in module APP.2.1 General Directory Service. The general requirements described therein are explained in detail and complemented by this module. This module does not repeat the requirements for securing the operating systems of servers and clients used to operate and administrate AD; these are covered, for example, in SYS.1.2.2 Windows Server 2012 and SYS.2.2.3 Windows 10 Clients. This module does not revisit the requirements of the underlying network infrastructure either.

Active Directory should always be included when considering the modules ORP.4 Identity and Access Management, OPS.1.1.3 Patch and Change Management, CON.3 Backup Concept, OPS.1.1.2 Archiving, OPS.1.1.5 Logging and OPS.1.1.2 Proper IT Administration.

Useful Resources

The website “Active Directory Security” (https://adsecurity.org) contains a great deal of further information about AD security.

Microsoft itself provides additional information about Active Directory and its security aspects:

  • Enhanced Security Administrative Environment: https://docs.microsoft.com/de-de/windows-server/identity/securing-privileged-access/securing-privileged-access
  • Privileged Access Workstations: http://download.microsoft.com/download/9/3/9/9392A4D2-D530-4344-8447-4A7CF1C01AEE/Privileged%20Access%20Workstation_Datasheet.pdf
  • Einstiegspunkt Active Directory für Windows Server 2012 (R2): https://technet.microsoft.com/en-us/library/dn283324.aspx
  • Introduction to Active Directory for Windows Server 2008 R2: https://technet.microsoft.com/en-us/library/dd378801.aspx

1. Ħarsa ġenerali

APP.2.2.A1 Planning Active Directory [Process Owner] (B)

The domain functional level selected MUST be appropriate and as high as possible. The justification for this choice SHOULD be documented appropriately. An access control policy for Active Directory MUST be developed in accordance with the requirements at hand. Administrative delegations MUST be assigned restrictive authorisations that meet the requirements at hand. The planned Active Directory structure, including possible scheme changes, SHOULD be documented in a comprehensible manner.
APP.2.2.A2 Planning of Active Directory Administration [Process Owner] (B)

In large domains, the administrative users MUST be divided in terms of the service and data administration pertaining to Active Directory. Here, the administrative tasks MUST also be distributed in Active Directory according to a delegation model so that there is no overlap.
APP.2.2.A3 Planning of Group Policy in Windows (B)

There MUST be a concept for configuring group policies. Multiple overlaps MUST be avoided whenever possible in the group policy concept. It MUST be possible to recognise exceptions to the group policy concept in the documentation. All group policy objects MUST be protected by restrictive access rights. Secure specifications MUST be defined for the parameters in all group policy objects.
APP.2.2.A5 Hardening Active Directory (B)

Built-in accounts MUST be configured with complex passwords. They MUST ONLY be used as emergency accounts. Privileged accounts MUST be members of the “protected users” group. Managed service accounts (for groups) MUST be used for service accounts.

All domain controllers MUST be assigned restrictive access rights at the operating system level. The Active Directory restore mode MUST be protected by an appropriate password. Work in this mode SHOULD only be performed in compliance with the two-person principle.

A map of the domain controller SHOULD be created on a regular basis. The authorisations for the “Everyone” group MUST be restricted. The domain controller MUST be protected against unauthorised restarts.

The policies for domains and domain controllers MUST include secure settings for passwords, account lockout, Kerberos authentication, user rights, and monitoring. A sufficient size MUST be set for the security log of the domain controller. If external trust relationships exist with other domains, user authorisation data MUST be filtered and anonymised.
APP.2.2.A6 Maintaining the Operational Continuity of Active Directory (B)

All trust relationships in AD MUST be evaluated at regular intervals.

The domain administrators group MUST be empty or as small as possible. Accounts that are no longer used MUST be disabled in AD. They SHOULD be deleted after a reasonable retention period has expired.

All the necessary parameters of Active Directory SHOULD be kept up to date and documented comprehensibly.
APP.2.2.A7 Implementation of Secure Administration Methods for Active Directory [Process Owner] (B)

It MUST be possible to clearly trace every account to an employee.

The number of service administrators and data administrators for Active Directory MUST be limited to the required minimum of trustworthy persons.

The default “Administrator”" account SHOULD be renamed. An “Administrator” account without privileges SHOULD be created.

It MUST be ensured that the administration of service administrator accounts is only performed by members of the Service Administrator group. The “Account Operators” group SHOULD be empty.

Administrators SHOULD only be assigned to the “Scheme Administrators” group temporarily for the time required to change the scheme. For the groups “Organisational Administrators” and “Domain Administrators”, the dual-control principle SHOULD be established for administration of the root domain.

It MUST be ensured that the “Administrators” and “Domain Administrators” groups are also owners of the domain root object of the domain in question.

The use of domain-local groups for controlling the read privileges of object attributes SHOULD be avoided.

The recycle bin of AD SHOULD be enabled.

In large organisations, an enterprise identity management solution SHOULD be used in order to ensure that the rights of all users comply with the defined specifications.
APP.2.2.A8 Configuration of Secure Channel in Windows (S)

Secure Channel SHOULD be configured in Windows according to the security requirements and the local conditions at hand. All the relevant group policy parameters SHOULD be taken into account in the process.
APP.2.2.A9 Authentication Protection When Using Active Directory (S)

The Kerberos authentication protocol SHOULD be used consistently in the Active Directory environment. If NTLMv2 is used temporarily for compatibility reasons, the migration to Kerberos SHOULD be planned and scheduled. LM authentication SHOULD be disabled. SMB data traffic SHOULD be signed. Anonymous access to domain controllers SHOULD be prevented.
APP.2.2.A10 Secure Use of DNS for Active Directory (S)

Integrated DNS zones or the secure dynamic updating of DNS data SHOULD be used. Access to the configuration data of the DNS server SHOULD only be permitted from administrative accounts. The DNS cache on DNS servers SHOULD be protected against unauthorised changes. Access to the DNS service of the domain controllers SHOULD be restricted to the necessary minimum. Network activities related to DNS requests SHOULD be monitored. Access to the DNS data in Active Directory SHOULD be restricted to administrators using ACLs.

Secondary DNS zones SHOULD be avoided. At minimum, the zone file SHOULD be protected against unauthorised access.

If IPsec is being used to protect DNS communications, sufficient data throughput SHOULD be ensured within the network.
APP.2.2.A11 Monitoring Active Directory Infrastructure (S)

Changes at the domain level and in the overall structure of Active Directory SHOULD be monitored, logged, and evaluated.
APP.2.2.A12 Backups for Domain Controllers (S)

There SHOULD be a backup and recovery policy for domain controllers. The backup software used SHOULD be explicitly approved by the provider for use in backing up the data of domain controllers. A separate backup account with service administrator rights SHOULD be set up for the domain controllers. The number of members of the “Backup Operators” group SHOULD be restricted to the required minimum. Access to the AdminSDHolder object SHOULD be placed under special protection in order to protect the authorisations.

The data of the domain controllers SHOULD be backed up at regular intervals. Here, a method that avoids legacy objects whenever possible SHOULD be used.
APP.2.2.A14 Use of Dedicated Privileged Administration Systems (H)

The administration of Active Directory SHOULD be limited to dedicated administration systems. These SHOULD be subject to particularly strong hardening based on their limited tasks.
APP.2.2.A15 Separation of Administration and Production Environments (H)

Particularly critical systems such as domain controllers and domain administration systems SHOULD be placed in a separate forest with a unilateral trust relationship towards the production forest.

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti

Kwistjonijiet marbuta

Links
includes APP.2.2.G1. Inadequate Planning of Security Boundaries
includes APP.2.2.G2. Excessive or Negligent Trust Relationships
includes APP.2.2.G3. Lack of Security Features due to Older Operating Systems and Domain Functional Level
includes APP.2.2.G4. Operation of Additional Roles and Services on Domain Controllers
includes APP.2.2.G5. Insufficient Monitoring and Documentation of Delegated Rights
includes APP.2.2.G6. Insecure Authentication
includes APP.2.2.G7. Overly Powerful or Insufficiently Secure Service Accounts
includes APP.2.2.G8. Use of the Same Local Administrator Password on Multiple IT Systems