Safeguarding The Security Posture Of Your AD, Pre-Attack And Post-Attack

on YouTube ↗47m

" summary

Claims that every org needs a tested AD DR plan and that recovery is feasible if backups are usable and security gaps are fixed; demonstrates use of Purple Knight, BloodHound and Forest Druid plus certifi and AD recovery tooling to find IoE/IoC, detect DC Shadow and compromised certificate templates; reports a real incident with multiple attackers and corrupt databases on every DC and describes restoring into an isolated network, hardening, and returning production successfully.

AI-written summary · about

" chapters (33)

1. 0:00Securing Active Directory
2. 1:11Ransomware impact on DCs
3. 2:16Pre-attack AD assessment
4. 4:25Detecting AD attack paths
5. 5:51AD indicators of compromise
6. 7:16Tiering model for privileged access
7. 8:42Account security strategies
8. 10:08Securing certificate authorities
9. 11:12Eliminating legacy protocols
10. 11:57Managing AD complexity
11. 12:19Trust boundaries in AD
12. 13:23Patch management in AD
13. 14:06Testing AD backups
14. 15:29Monitoring AD changes
15. 16:13Hybrid identity risks
16. 18:20AD historical limitations
17. 19:03AD disaster recovery rules
18. 20:50AD downtime risks
19. 21:53AD failure scenarios
20. 23:37Ransomware recovery options
21. 26:48Automating AD recovery
22. 28:12Manual vs automated recovery
23. 30:19Backup orchestration challenges
24. 31:21Isolating recovery environments
25. 32:26Post-recovery AD assessment
26. 33:07Hybrid identity recovery
27. 34:13Three AD compromise scenarios
28. 37:22Choosing AD backup
29. 38:48Azure AD sync gaps
30. 40:11Case study: AD attack response
31. 43:18Key takeaways for AD security
32. 44:22Mitigating AD attacks
33. 45:36Q&A

" related talks

• 32mRansomware, Risk, & Recovery: Protecting and Creating Resilience for Hybrid Active DirectoryCalum Field · 34th Annual FIRST Conference 2022
• 53mThe Importance of Identity-Centric Security in 2024Vivin Sathyan · RSA Conference 2024
• 50mBeyond the Mcse: Active Directory for the Security ProfessionalSean Metcalf · Black Hat USA 2016
• 40mTop Active Directory Attacks: Understand, then Prevent and DetectJeff McJunkin · RSAC 2021
• 39mBattle-Tested Incident Recovery: Lessons from the Front LinesJack Hughes · FIRST Conference 2026 (FIRSTCON26)
• 36mBeing A Better Defender By Channeling Your Worst Adversary:John Stoner · 34th Annual FIRST Conference 2022
• 50mHybrid Active Directory Attacks: Anatomy and DefensesDerek Melber · RSA Conference 2023
• 45mFinding Our Path: How We're Trying to Improve Active Directory SecurityAndy Robbins, Rohan Vazarkar, Will Schroeder · Black Hat USA 2019