Posts

How Kerberos works

 Kerberos in Windows -An Overview Introduction  Kerberos is used since a long time as an authentication protocol in the UNIX world.It entered the Windows family with Windows 2000 and is used with all the OS releases till date. Windows Active Directory uses Kerberos as a default authentication protocol.Its major advantage over other authentication schemes is its interoperability with Unix systems.When coupled with a strong password, Kerberos is considered to be the toughest to break through.Kerberos V5 is the current version used in the Windows Family. Architecture Kerberos Architecture typically works on the concept of mutual authentication. Unlike other authentication techniques kerberos authentication verifies the identity of the client as well as the server. NTLM misses this techinique of validation as it has no provision of validating the server. Architectural Dependencies Operating System – Windows brought kerberos in its family since Windows 2000 so operating systems pri...
Post a Comment
Read more

AD trust register

An AD trust register should be a controlled inventory of every trust relationship in your environment, with enough detail to answer **what exists, why it exists, who owns it, and when it was last validated**. At minimum, it should capture the trust’s type, direction, transitivity, source and target domains/forests, and security settings such as selective authentication or SID filtering where applicable [1][2]. ## Recommended columns A practical trust register usually includes these fields: | Field | Purpose | |---|---| | Trust ID | Unique identifier for tracking and audit references. | | Trust name / target | The other domain or forest in the trust. | | Source domain / forest | Your side of the relationship. | | Trust type | Domain, forest, external, realm, etc. [3][1] | | Direction | One-way incoming, one-way outgoing, or two-way [3][2] | | Transitivity | Transitive or non-transitive [3][1] | | Authentication model | Selective authentication or forest-wide authentication [1] | | SID f...
Post a Comment
Read more

Ad control catalog

  # Active Directory Security Framework Detailed Control Catalog ## Purpose This document is an expanded draft of the Active Directory security framework with individual controls listed under each control domain so the framework can be used as the basis for an auditable control register, control testing workbook, or management review package.[1][2][3] The control statements are designed to be tailored to the organization’s actual implementation status and evidence sources while retaining mapping to recognized standards and vendor guidance.[1][2][4] ## How to use this catalog Each control should be assigned a unique internal control ID, owner, implementation status, review frequency, and evidence source during the next draft iteration.[3][2] The standards mapping shown here is intended as a practical starting point rather than a legal or certification opinion, and it should be validated against the organization’s chosen compliance framework.[3][5] ## Standards basis This draft uses ...
Post a Comment
Read more

Risk categorization on ad trust

 what would be defined as high risk in terms of trust A trust should be treated as **high risk** when it meaningfully increases the chance of lateral movement, privilege escalation, or cross-boundary compromise, especially if it extends access between forests or to sensitive production environments.[1][2] In practical audit terms, high risk usually means the trust weakens the security boundary, is difficult to monitor tightly, or depends on legacy settings and exceptions that expand exposure.[3][4] ## High-risk indicators A trust is typically high risk if any of the following apply:[1][5][6] - It is a **forest trust** or crosses a strong security boundary, because that expands the reachable attack surface.[1][2] - It allows broad authentication rather than **selective authentication**, meaning users from the trusted side can authenticate to many systems by default.[5][6] - **SID filtering** is disabled, weakened, or temporarily turned off for migration purposes.[4][7] - The trusted...
Post a Comment
Read more