Cyber Defense eMagazine January Edition for 2022

Beyond closing AD security gaps, public infrastructure organizations can implement solutions that
continually monitor the environment for malicious changes. The ability to detect attackers moving laterally
through the network can substantially limit the damage done. Attack paths can be closed before the
malicious actors are able to deploy malware, for example. And setting up automated remediation can
help defuse an attack when every minute counts. Cyberattacks can infect globally connected systems in
minutes, so the ability to automatically reverse malicious changes helps contain the fallout.
In the event of a cyberattack, one of the key factors in resuming delivery of public services is being able
to quickly recover Active Directory to a known-secure state. As any IT administrator can attest, rebuilding
an AD forest is a laborious, time-consuming process that is prone to errors. Rebuilding an AD forest while
under the stress of an in-progress attack is the stuff of nightmares. Every organization needs to have a
fully tested, documented plan for recovering AD—the system that authenticates and grants access to all
other systems—in the event of a cyberattack.
Ensuring public services are safe from cyberattacks
Although public infrastructure organizations are in the crosshairs of attackers, they can improve their
defenses against even the most sophisticated attacks. By evaluating the security posture of their Active
Directory environment, setting up monitoring to detect malicious changes, and implementing a fully tested
AD recovery plan, these organizations will be better positioned to combat attacks and continue to deliver
vital public services.
About the Author
Sean Deuby | Director of Services, Semperis
Sean Deuby brings 30 years’ experience in Enterprise
IT and Hybrid Identity to his role as Director of
Services at Semperis. An original architect and
technical leader of Intel's Active Directory, Texas
Instrument’s Windows NT network, and 15-time MVP
alumnus, Sean has been involved with Microsoft identity technology since its inception. His experience
as an identity strategy consultant for many Fortune 500 companies gives him a broad perspective on the
challenges of today's identity-centered security. Sean is also an industry journalism veteran; as former
technical director for Windows IT Pro, he has over 400 published articles on Active Directory, Azure
Active Directory and related security, and Windows Server. He has presented sessions at multiple CIS /
Identiverse conferences.
For more information, visit http://www.semperis.com
Cyber Defense eMagazine – January 2022 Edition 90
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.