For the security of both identities and systems, we use both the “defense” approach and the “attack” approach. From a defense perspective, both identities and systems must be secured as best as possible. With this a healthy balance between “security” and “user experience” is achieved. We do not want (too) strict security that results in a bad user experience. Bad user experience in turn will result in poor security due to incorrect behavior. To prevent that additional guidance or tooling is needed. Nevertheless, sometimes you really need to bite the bullet if you are behind on (new) security standards. Subsequently, both identities and systems must be approached from an attack perspective. The main reason for this is to learn which weaknesses still exist in order to (be able to) take measures. Those measures further mitigate risks and where possible even eliminate them completely.
Ask yourself the following question: “why not use the knowledge of possible weaknesses yourself to make improvements, instead of having a malicious person use it against you?“
Ultimately, it’s all about ensuring:
- identities have correct and most recent security settings;
- identities have unique and strong passwords instead of shared and weak/compromised passwords;
- identities receive additional authentication verification through some form of MFA where and when applicable;
- where possible identities no longer use (additional) passwords (at all), but instead use other stronger authentication mechanisms (passwordless), or at least less passwords;
- malicious people are blocked and employees can continue to do their work with minimal or no impact;
authentication systems are as secure as possible and use the most recent settings and protocols;
- abnormal events are detected in time with, if necessary, follow-up risk mitigation measures.
Remember, Active Directory at this point in time for many organizations is still the foundation in a hybrid identity scenario, but also a primary attack vector. Make sure to be and stay in control, discover and fix weaknesses before attackers use them against your organization.
Do you know what the security posture is of your core identity systems? Would you like to know?
Be secure, stay secure, but also ahead!
CoC (NL): 22.214.171.124 || VAT ID: NL002970959B74
Unless otherwise stated and/or agreed, the NLdigital Terms and Conditions 2020 (English version) (Dutch version) apply to all our offers and agreements, deposited at the District Court Midden-Nederland, location Utrecht. In the event of disputes concerning interpretation of the English version of the NLdigital Terms, the Dutch version takes precedence.