35 ways to harden your Active Directory environment 1. MFA everywhere, without exceptions 2. Create a patch cadence you can stick with, and stick to it 3. You don’t need more domain admins, limit it like anyone who has it is cursed 4. You can’t protect what you don’t know exists, inventory is essential 5. Segment your network like your career depends on it 6. If it absolutely doesn’t need to be on the internet, it shouldn’t be 7. EDR alone will not save you, diversify your threat detection strategy 8. Application control can be one of the hardest controls to defeat, use it 9. Deception technology is essential for today’s modern threats, learn it and use it well 10. Email security tools are great, but don’t forget out of band processes are key especially for money transfers 11. Teach users the basics of social engineering red flags, don’t phish them yourself 12. If you don’t test your backups, you don’t have backups 13. If you don’t test your DR plan you don’t have a plan 14. If you don’t follow the 3-2-1 rule for backups you don’t have backups 15. Backups in Steve’s basement don’t count 16. Rotating passwords regularly for no good reason is counter productive and then less secure option 17. 99% of vulnerabilities don’t matter, spend your time identifying the ones that could hurt you and address those first 18. Vulnerability scanning doesn’t show the whole picture, pentesting is a must 19. Hunting for misconfigurations yourself is a necessary part of good systems engineering 20. The cloud is not more or less secure than on-prem, it’s your strategy that matters most 21. Service accounts should be treated like radioactive material, tightly scoped and constantly monitored 22. Under no circumstances should the built in admin account be a service account 23. Domain admins should not be service accounts either 24. Active Directory permissions drift over time, assume yours already has 25. If you can’t explain why something needs admin rights, it shouldn’t 26. If you can’t explain why someone needs admin rights, they shouldn’t 27. Separate admin work from daily work, identity debt is real 28. Don’t reuse local admin passwords, LAPS is easy, use it 29. Security tools don’t replace good engineering, they amplify it 30. If fixing it later is the plan, it’s not a plan 31. Boring but consistent security beats clever hacks every time 32. If you don’t know if you have misconfigured ADCS, you probably do 33. After every change in ADCS, run invoke-locksmith 34. After every delegation change in AD run Invoke-ADeleginator 35. Use AppLocker Inspector to audit your applocker policies. 🏷️Bookmark this so you can come back to it later.

I think it’s important, now more than ever, to consider self hosting absolutely everything if you have the skill for it. It’s only going to get worse.

1) I didn't know .RDP config files could be signed 2) RDP RemoteApps are crazy 3) I always appreciate a Fuzzy Snuggly Duck cloud.google.com/blog/topics…