Latest / Identity at the Center / #301 - IDAC Sponsor Spotlight - Semperis

Transcript

#301 - IDAC Sponsor Spotlight - Semperis · Identity at the Center

0:00
But where you, you could like have a lower privilege user that
0:02
maybe has group policy rights on a domain controller or an OU
0:09
that holds domain controllers, I should say.
0:11
And effectively you're a domain admin, right 'cause you could go
0:14
put, you know, wagon scripts and other things or startup scripts
0:19
in that, that GPO. And that's right thing and get
0:22
complex because right like we're all, we're focused on identity,
0:25
but there's also attacks on like the other components of Active
0:30
Directory that can lead to identity compromise, even though
0:33
right like group policy isn't like a component of identity and
0:38
access management aside from like being stuck into Active
0:42
Directory. So.
0:49
This is identity at the center. If it has anything to do with
0:54
IAM, this is the go to podcast now your hosts Jim McDonald and
1:02
Jeff Stedman. Welcome to the Identity at the
1:10
Center podcast. This is Jim McDonald.
1:12
I'm here without Jeff today, but I'm here with a special guest,
1:15
Eric Woodruff, who we've had on the podcast in the past.
1:19
It's time for another Sponsor Spotlight episode now.
1:22
Eric was on with us as a credentialed expert in the field
1:27
in the past on episode 191. Glad to have him back This time
1:31
of a Sponsor Spotlight episode and the sponsor spot related
1:34
episodes are special episodes that are created in
1:38
collaboration with our sponsor, in this case, a company called
1:41
Semperis to delve more deeply into their viewpoints on
1:47
specific security solutions in the IM market.
1:50
Now to make this crystal clear, the fully sponsored episode,
1:54
this allows us to what I like to say is take the handcuffs off in
1:58
terms of go, you know, understanding these deep
2:01
insights with the expert, but also understanding how their
2:04
solution solves specific problems in the industry.
2:08
So with all that being said, let's get going and uncover the
2:11
latest ideas and innovations with our digital in within the
2:15
digital identity industry and our sponsor, Semperos.
2:19
So welcome to the show, Eric Woodruff, senior security
2:23
researcher with Semperos. Hey, Eric.
2:26
Hey, Jim, No thanks. Thanks for having me on here.
2:30
Yeah. Glad to have you today.
2:32
So we spoke with you way back on Episode 191.
2:37
That was in December of 2022. And I'm wondering, what have you
2:41
been up to since we recorded that episode?
2:44
I'd, I'd say a lot. I mean, honestly, that was the,
2:47
the first podcast I was ever on and, and why I was nervous.
2:51
So I, I hope I come across less anxious these days, but yeah, I,
2:58
you know, just chugging away still at Sempress working in our
3:02
security research team these days, focusing on, you know,
3:06
Active Directory and enter ID sort of security so.
3:12
But. Out speaking about which I
3:14
enjoy. Pretty heavy title that you got
3:17
a senior security researcher at St.
3:20
Paris. So tell us a little bit about
3:22
what you do in your day-to-day and then for people who maybe
3:27
aren't as familiar with St. Paris, what the company does.
3:31
Yeah, No, I, I mean, so for myself I'd say, but there's
3:35
always kind of new emerging threats around Active Directory
3:40
entry ID. I mean, I in particular am more
3:42
focused on ENTRA because that's kind of my area of expertise.
3:48
But we've got a team of, you know, handful of us where you
3:54
were just sort of, you know, tracking the trends in, in
3:57
security around identity, new threats, doing our own research
4:02
on on potential vulnerabilities, things like that.
4:06
Yeah, that's, that's what I'm up to and, and do.
4:08
And eventually the things, the stuff that we work on is
4:12
released in both Purple Knight, which is one of our, our free
4:15
products for assessing Active Directory and Entra security and
4:19
also used within our commercial product DSP, which is Directory
4:25
Services protector. And I mean, as far as Sempress,
4:29
you know, we're probably most known for Active Directory
4:32
Forest Recovery or ADFR, which is our sort of like Dr. product
4:36
for Active Directory. But I, I think these days, you
4:39
know, we'd be sort of in the category of IDDR companies again
4:44
focused primarily on Active Directory and Entra right now.
4:47
We got a little Okta mixed in there, but.
4:51
Yeah, I mean, like pretty much most organizations are running
4:56
AD and then try D at some level. He was like, and usually it's
5:02
it's about, you know, as important of a platform as there
5:07
is in most enterprises. And you know, I think that ADFR
5:11
tools probably saved a lot of people's bacon in terms of being
5:15
able to recover a forest that has been corrupted intentionally
5:20
or unintentionally. Either one can happen, but I
5:25
wanted to ask you so I kind of said my piece in terms of why I
5:29
think AD is so important in terms of being a focal point for
5:35
your identity security. What are your thoughts?
5:40
Yeah. I mean, I think it's hard to
5:42
find a enterprise out there that that doesn't have Active
5:46
Directory, right? Sort of like putting your
5:48
opinion about Active Directory and Microsoft aside, like, but
5:52
everyone's kind of got it. You know, there's, there's other
5:56
components in Active Directory like group policy, right?
5:59
Like it's not just identity, which also makes it more complex
6:04
because but if you have a huge Windows Server farm or you're
6:08
not in the cloud yet and you're managing client devices, right?
6:11
Like, yeah, it just has its fingers and sort of so many
6:15
things that if Active Directory is is gone, you know,
6:22
intentionally, unintentionally, even for a brief period of time,
6:25
right? I mean, a lot of organizations,
6:27
I mean business just grinds to a complete halt, so.
6:32
Yeah, I mean that's your, your e-mail system, your login system
6:35
for your desktop networking capabilities is a lot of your
6:40
applications wind up being integrated with it as well for
6:44
authentication, sometimes authorization.
6:47
So I mean, I want to talk about some of the specific threats you
6:52
as a senior security researcher know about, but I also want to
6:56
just generally make the comment that it seems like a ransomware
7:01
on Active Directory could have devastating effects for an
7:06
enterprise. Yeah, no, absolutely.
7:09
And I'm, I'm not good at retaining like specific cases or
7:14
statistics in my head. But I mean, organizations,
7:18
right, will lose millions of dollars a day.
7:21
We have folks that work in incident response, right?
7:24
So if, if companies are having like an Active Directory
7:27
ransomware incident, we have our breach preparedness and response
7:31
team that you can call and, you know, we'll kind of come in and,
7:35
and help try to kick the threat actor out.
7:37
But you know, in, in talking to them and sort of hearing like
7:40
their their war stories and what they've seen.
7:44
Yeah, I mean, it can be very devastating.
7:46
I mean, there there's cases of companies just like going out of
7:49
business from, you know, Active Directory becoming ransomware.
7:54
So it goes back to the case and available.
7:57
Yeah, nothing. Nothing works.
7:59
We saw some cases, I mean in the last couple years where ransoms
8:02
got paid in the 10s of millions of dollars.
8:06
I guess the alternative is like if you're, if you're Active
8:09
Directory is completely owned and you can't get e-mail, you
8:14
can't communicate with the outside world, access any of
8:17
your files or your applications, you're pretty much at the mercy
8:22
of those ransomware actors, right?
8:25
Yeah, I mean, you're at their mercy, but also they're not
8:28
always right. The most trustworthy folks,
8:33
'cause there's there's times where organizations will get
8:36
ransomed and they'll pay the ransom and they'll be like
8:39
double extorted. They'll also be a target, right?
8:43
So you may be fixed one, you know, you, you plugged up one
8:48
hole in the dam. But if there's other things open
8:50
also, like other ransomware groups may start to come after
8:53
you knowing that you'll, you'll pay right.
8:57
So there's, there's a lot of scenarios where it can get dicey
9:02
whether whether you pay the ransom or not 'cause you're,
9:07
you're probably going to become a higher target for, for these
9:13
folks out there the the threat actors.
9:15
Absolutely. I mean, once you kind of show
9:17
that you'll pay the ransom, then it's kind of like damned if you
9:19
do, damned if you don't, I guess.
9:23
But I think the, you know, at least from what I've seen, the
9:26
ransomware actors, typically they rely on just getting in the
9:31
front door and then running some exploits that are kind of like
9:37
known within Active Directory. And you know, I can, you know,
9:41
the pasta #1 is one that people talk about all the time and the
9:45
me me cats, which I think is just basically the tool that's
9:49
used for that. But I used to be an Active
9:51
Directory administrator, believe it or not, way back in NT4 in
9:55
the early days of Active Directory after Windows 2000.
9:59
And I just think of all the times I logged into and devices,
10:05
laptops and workstations with my administrator account and left
10:10
that hash sitting there on the on the hard drive.
10:15
How relevant is pass the hash and what are some of the other
10:19
exploits that are popular these days?
10:22
Yeah, I mean, I'd say pass the hash is still relevant, right?
10:25
It's, it's really as much of A, you know, a, a technique, right,
10:32
where you're, you're harvesting the, the hash for, you know,
10:38
user credentials on a Windows device usually.
10:40
And right, depending on what privileges that user has, you
10:44
may then try to use it to, to sort of move into other systems.
10:49
I mean, there's a lot of attacks out there.
10:51
Probably the more sort of talked about ones are things like a
10:55
golden ticket attack, you know, DC shadow, DC sync attacks.
11:01
But I think the thing that's sort of interesting is most of
11:06
these attacks are sort of like late stage post compromise, like
11:11
a domain admin's already been owned.
11:13
Like Golden Ticket in particular is effectively that the the
11:17
KRBTGT password has been compromised and that's sort of
11:21
used for everything else in Active Directory.
11:27
So like when can you explain that for SO?
11:30
There's so there's, there's the Kerberos ticket granting ticket.
11:33
So basically there's an account in Active Directory that is used
11:36
for granting tickets for everything else in Active
11:40
Directory. And, and this, this account is
11:42
like a special account in AD. That's the KRBTGT, right?
11:47
Again, if if say I, I own a domain admin or I work my way up
11:51
on to like ADC and I can get the, the password essentially
11:56
for that account. I mean, at that point I kind of,
11:59
I, I am like Active Directory. I can do sort of whatever I want
12:06
and it becomes really difficult to really trust right Active
12:11
Directory. Like even if you were to detect
12:13
a golden ticket attack happening, you really should
12:17
also be like concerned about the overall the the bigger state of
12:23
AD cause, right? Say that attack it was
12:27
legitimate. And maybe say you have an EDR
12:31
that sort of like tried to isolate the end point that it
12:33
was detected on, you probably still have bigger problems
12:37
because you don't necessarily know what else the threat actor
12:40
has done at that point. So.
12:42
Right, right. That's what you you had
12:45
mentioned to me in the past about not being in a position
12:49
where you don't trust your Active Directory.
12:51
That's a scary thought. What does that stem from?
12:56
Well, I mean, so ultimately, like the, the, the problem I'd
12:59
say is that there's certain types of with attacks on Active
13:04
Directory that right, they require high privilege, but they
13:09
allow the attacker to basically do things like where they, they
13:15
can issue tickets for basically any, any service or any server,
13:20
right. When the, the ticket is
13:20
effectively like you can, you can be anyone do anything with
13:25
like a, a golden ticket type attack.
13:28
You know, there are things like DC shadow where you are
13:31
effectively sort of participating in Active
13:34
Directory replication and that can become tricky because a lot
13:40
of your event lodge and things that like a SIM or C may use
13:44
can't pick up on that stuff because it's actually in like
13:47
the replication stream. But where this all kind of goes
13:50
from a trust perspective, right? Is like, right, like you don't
13:56
necessarily know what other mechanisms of persistence that
13:59
have been installed. And I guess kind of bringing
14:01
this back to some of the ransomware type things is one of
14:04
the other issues that like IR teams will have is they'll,
14:07
they'll be brought in in a decently compromised Active
14:13
Directory. They'll they'll try to kick the
14:15
threat actor out, but then they've installed like five
14:18
other back doors at that point, right?
14:20
And so now they're, they're coming back in a different way.
14:24
And, and sometimes this comes down to where, where you have
14:29
this back and forth because Active Directory is really
14:33
critical for, you know, authentication.
14:36
And in both 80 and these days also, you know, out into like
14:39
entry ID, you know, Azure AD, your, your best bet really is to
14:45
try to go back to like a known good state with Active Directory
14:49
using something like ADFR where right you, you can go back to
14:53
before the incident happened and basically bring Active Directory
14:57
back up to a point in time where it's a known good state.
15:01
And there there's some, there's some like work kind of involved,
15:04
right? Because usually it's like
15:05
staging it isolated where you verify that it's like clean and
15:09
good. And then you sort of open the
15:12
doors to let other infrastructure kind of talk back
15:15
to it, so. It's a scary thought, right?
15:18
I mean, you know, this EDFR to me has always been like the Holy
15:23
Grail. But you also hear about threat
15:25
actors who, you know, they get in and then they sit silently
15:30
for long periods of time. And how would you know if
15:36
basically they compromise the a legitimate user's credentials
15:42
six months ago, right? Yeah, I mean, I think that gets
15:46
into definitely also other aspects of more like proactive,
15:53
you know, monitoring and and I guess I would learn more into
15:56
like DSP and and some of it would be in in Purple Knight,
15:59
which is our, our free, you know, AD and enter ID security
16:04
assessment tool. But there, there's other things,
16:08
right, where it's more like proactively monitoring,
16:12
especially your, your privileged accounts.
16:14
And, and that kind of dovetails though into, right, that some of
16:17
these identity attacks are complex or they're chained or
16:21
there's things that, right, you may not think of.
16:25
And I, I think a great example cause 'cause honestly, like you,
16:27
I, I managed Active Directory back in the day and sort of like
16:32
my eyes became open even more when I joined Sempress.
16:38
But where you, you could like have a lower privileged user
16:40
that maybe has group policy rights on a domain controller or
16:47
an OU that holds domain controllers, I should say.
16:49
And effectively you're a domain admin, right?
16:52
'cause you could go put, you know, wagon scripts and other
16:55
things or start up scripts in that, that GPO.
16:59
And that's right thing and get complex because right like we're
17:02
all we're focused on identity, but there's also attacks on like
17:07
the other components of Active Directory that can lead to
17:10
identity compromise, even though right like Drew policy isn't
17:14
like a component of identity and access management aside from
17:18
like being stuck into Active Directory.
17:21
So so. Eric, you said one word that
17:25
really triggered my ears to go up and that's Word free.
17:29
You mentioned a tool and it's kind of like, because where I
17:34
wanted to go is was what are some of the tools that can save
17:38
your bacon in a scenario or hopefully prior to this all
17:44
taking place? You mentioned the restore tool.
17:49
You also had mentioned a few other tools.
17:51
So why don't you kind of go over what those tools are?
17:54
We've got you guys are setting up a link.
17:56
It's in paris.com/idac, all the caps.
18:02
If you go to that URL, you should be able to find
18:04
everything that Eric's talking about.
18:06
We'll put that link in the show notes as well.
18:09
But Eric, could you kind of go over those tools again?
18:13
Yeah, so the the soup of things, I guess I'll, I'll start off
18:16
with a couple free tools that we have.
18:19
So there, there's Purple Knight and this has and I, I should
18:24
know this number 'cause it's the group I work in, but it's
18:26
continually growing between ENTRA and Active Directory.
18:31
I think we're up to around 100 and 7000 and 80 security
18:37
indicators, right? And so these are individual
18:39
things that are, are measuring the security configuration or
18:46
sort of lack thereof around Active Directory.
18:49
Enter ID. The other tool is, is Forest
18:52
Druid that's free, which is a attack path analysis, attack
18:56
path mapping tool, right? So that that will also help,
18:59
right, you sort of visualize and, and, and see like how
19:03
chained attacks could happen where, right, like I am in our
19:08
help desk and I have the ability to reset the password on someone
19:13
who is in our knock and that person in the knock.
19:15
That's like a sort of higher tier has the ability to maybe
19:18
manage through policies on your ADFS servers, right?
19:23
And that's as I'm speaking this, right, It's kind of a path, but
19:26
like something like forest Druid will help you visualize that
19:29
stuff. You know, that's in the realm of
19:32
other tools. Like probably the most, I guess,
19:34
say, well known would be the things like Bloodhound or
19:36
whatnot. We we have a bit of a different
19:38
take where we try to focus on the last sort of stage in the in
19:44
the path, right? That if you you cut off the last
19:47
line before getting like domain admin, I mean, you still may
19:50
have other clean up, but right, wanting to focus on, well, how
19:55
do we protect like that tier zero that the keys to the
19:58
Kingdom. But these are tools that can
20:02
take you above and beyond what Bloodhound could do, right?
20:06
Yeah. I mean, so like I would say
20:09
Forest Druid and Bloodhound, they're they're very related.
20:11
We kind of a different take on how we go about analysis 'cause
20:15
sometimes, right, you could look in Bloodhound and I mean, I
20:18
think it's a great tool, but generally it's more red team
20:21
sort of oriented where you really need to know a lot of the
20:24
underpinnings. Forest Druid is designed to be
20:27
more like for an IT pro, a defender and I, an identity
20:31
person who maybe isn't super familiar with like all the
20:35
nuances of attack path management, right?
20:37
They just want to see like, what are the things they need to get
20:39
rid of to like protect my domain admins.
20:42
So, OK, that's really. Cool.
20:45
Yeah, Well, good. So there's a length that people
20:49
can go out to, they'll be able to navigate their way to either
20:53
free tools as well as, you know, I I'm assuming that per the
20:57
business model of building free tools is that people see all
21:00
these problems on there, willing to go and spend a little money
21:03
to prevent being attacked. Yep.
21:08
Yep. So and, and that's absolutely
21:10
like again for the, for the paid products that we have Active
21:14
Directory Forest recovery, which is ADFR is that I, I think maybe
21:20
mentioned earlier, it's, it's what we're probably most well
21:22
known for and that's bringing Active Directory back from, you
21:27
know, being burned to the ground.
21:30
There's a lot of organizations that will also, so I think a
21:33
point you made earlier can have catastrophic sort of oopsies
21:38
where there's an operational sort of benefit to ADFR to, to
21:44
bring AD back. Some organizations use it for,
21:48
you know, Dr. testing and like going through those, those Dr.
21:51
drills where it's like, right, what's it actually take to bring
21:55
Active Directory back? And, and I'll actually say as
21:57
someone who again used to manage AD, not until I worked here did
22:04
I realize how complex it is to manually try to bring Active
22:08
Directory back from like a system state restore.
22:12
And unless you want to enjoy doing nothing for like the next
22:18
couple weeks it it can. It can be a nightmare probably
22:24
when you say that. When you say enjoy doing
22:26
nothing, you're talking about you're going to be working 80
22:29
hours a week for the next few weeks and getting yelled at
22:32
probably, Yeah. I, I don't mind the people who
22:36
are stuck in that. Now.
22:38
We've been talking about AD as in classic AD primarily.
22:42
You guys are really focused on the future as well, this hybrid
22:46
identity world. In fact, you've got a conference
22:50
coming up called the Hybrid Identity Protection AKA HIP, the
22:57
HIP conference. We have a, a discount code for
23:03
the HIP conf. It's HIP conf.com discount code
23:07
is IDAC POD. That'll get you 20% off.
23:12
But Eric, could you tell people what they can kind of expect out
23:15
of that conference? Yeah.
23:17
Absolutely. So the, I mean the conference is
23:20
actually rooted in Gil Kirkpatrick who you folks
23:24
actually had on quit a long time ago who had started the
23:29
Directory Experts conference. And it's an evolution of that
23:32
where it's a lot of the bigger names and Active Directory
23:39
identity security that are going to be there, as well as interest
23:44
security. I can't remember the roster, but
23:47
like Sean Metcalf over at Trimark is like a a pretty well
23:51
known person. I think we're we're well, I'll
23:57
start to ramble on the Microsoft.
23:58
MVPS and stuff like that, right? Yep.
24:01
Yeah, Thomas Noenheim, who's actually a very well known MVP
24:07
in the interest space is, is going to be talking about I
24:11
think enterprise applications and service principles and and
24:14
all that sort of stuff. So you know, and this is where I
24:18
guess to the hybrid piece, right, we're really trying to
24:20
cover both Active Directory and the Entra ID side of the house
24:26
sort of everything under the Microsoft ecosystem.
24:29
So yeah, I mean it's. So big right now.
24:32
So you know, hybrid identity is I think it's the new thing or
24:39
the next thing, but it's also the current thing.
24:42
I mean, if people haven't moved to Entra ID already for a lot of
24:46
the Active Directory services, they're moving to it.
24:50
I don't see an end of life or Active Directory on Prem anytime
24:54
soon, but I see a lot of folks, a lot of organizations moving
25:00
toward kind of this hybrid scenario where they have both,
25:04
they're staying In Sync. I'm kind of wondering though,
25:07
what kind of new threats does that create as well as what kind
25:11
of opportunities it creates? Yeah.
25:15
I mean from a threat perspective, it can get
25:18
interesting in again organizations sort of
25:22
unknowingly will perhaps have a user that's not privileged in
25:28
Active Directory, but privileged in ENTRA, right.
25:32
And so from an Active Directory sort of protection perspective,
25:37
the user sort of falls out of that, that privileged scope.
25:40
And, and sort of the Long story short is scenarios of a user
25:44
being compromised like in Active Directory and then the, you
25:49
know, whoever has compromised them being able to do stuff in,
25:52
in Entra. There's also some interesting
25:55
scenarios where you can almost have this like almost like loop
26:01
back where you could compromise someone that has some privileges
26:06
in entry, usually around something like Azure.
26:08
Like you have an Azure subscription and maybe you're
26:10
running domain controllers that are virtualized out in Azure.
26:14
You compromise someone that has some amount of rights over a
26:19
domain controller from like a management plane perspective.
26:22
And you can then go run commands sort of against the domain
26:26
controller because right, they're virtualized, there's an
26:28
agent on them as there isn't pretty much any sort of
26:31
virtualization scenario that the agent has system level access.
26:36
And next thing you know, you've given yourself like, you know,
26:39
domain admin through some, some cloud route.
26:43
So yeah, there there's a lot of like these weird complex paths
26:47
that just it's like spaghetti almost with the, the number of
26:53
potential ways that you can compromise in these these hybrid
26:57
scenarios. So.
27:00
Yeah. If you don't really know what
27:01
you're doing or even if you do, that's the problem, right?
27:05
It's like even if you do know what you're doing, you can still
27:09
wind up creating one of these scenarios.
27:11
And I think that's a big part of like the tooling that you guys
27:15
at Sempers, what you provide to people is the ability to kind of
27:21
identify those scenarios where you create an opening.
27:28
Yeah, absolutely. I mean, I think that, but you
27:31
you definitely encounter people at times who will, you know,
27:36
sort of say they can just roll their own or their their
27:38
Sentinel or their Splunk or their Q radar is kind of good
27:41
enough. But right.
27:44
It's, it's I'd say not just a Semper's argument that any, any
27:47
company working in in the ITDR space, right?
27:50
Like most of us, as different companies have a group of
27:54
identity security nerds sitting there all day trying to work on
27:58
this stuff full time and just seeing the things out there that
28:03
actually happened, right? Because we, we have feedback
28:06
from our IR team, right? Who they're like, you know, here
28:10
are things we've seen, right? So we're not just like sitting
28:13
there making stuff up as sort of like theoretical attack pass.
28:18
Yeah, it can, it can be quite, quite scary.
28:20
And, and I'll just say to your point, like, yeah, even if you
28:24
know what you're doing, everything just moves so quick
28:28
these days that I think it's really hard for organizations to
28:32
keep on top of things, right. And, and again, that's where
28:35
like for, for, you know, our other product DSP, that's more
28:40
like looking at the proactive security of Active Directory and
28:45
Intra as well as some, some indicators of compromise or
28:49
attacks in flight. We're, we're working on this
28:53
thing every month, we have a monthly release of, of new
28:56
indicators or updates for indicators all based on, right,
29:00
the data we're seeing, the research that we're, we're
29:03
doing. And, and so I'd, I'd sort of
29:07
politely argue to the role of your own people, right?
29:09
Like how can you sort of keep up like this, right?
29:14
I mean, you're if you are, you have to be investing a ton of
29:17
time and money and resources into doing it.
29:21
It's rare. When I first started in this
29:24
identity industry, it's much more common that organizations
29:28
will start off with the build versus buy analysis.
29:34
It's very rare these days. Once in a blue moon, somebody
29:37
will want to look at it. Usually it's having to do with
29:41
customer identity, but the assumption is we're not in the
29:46
business of secure of security, information security.
29:50
We're the byproducts and run them.
29:52
And then there is a major trust level in the partners that
29:57
organizations choose. I think what I what I really
30:01
like about what you guys are doing is it seems like you've
30:05
got to focus while the products have to evolve.
30:09
It's been centered on this AD and Tri D platform and you're
30:15
continuing to grow into that. Now, one of the other areas that
30:19
I know you guys have been growing into, and to me it seems
30:22
like it's the right direction, is ITDR.
30:27
Millet asks you first, like how do you define ITDR and then ask
30:32
you who needs it? Yeah, I mean.
30:36
I, I would say, I'll answer the second question 1st and saying I
30:40
think everyone needs it, but across, I mean, right, that's
30:44
kind of an answer that's that I used to console.
30:47
It's like, and it depends within as to what that, that spectrum
30:51
of needs it is. But to the, the first thing, I
30:53
actually like Gartner's ITTR sort of model that they have,
30:57
right? And it's identity threat
30:58
detection and response. I think in the industry, though,
31:05
it's a bit all over the place as to how people actually interpret
31:09
it. And, and I actually think that
31:11
probably two of the most important pieces, the the
31:15
prevention, which isn't in the name, but it isn't the, the
31:18
Gartner model and the, the response piece are the ones that
31:22
kind of kind of get left out. And everyone just like focused
31:27
on right, like the, the detection or if it's prevention,
31:33
it's more like, how can we, how can we obfuscate something?
31:37
How can we like throw the threat actor off instead of, I don't
31:40
know, to me, to me, prevention's like how can we go in as, as the
31:45
IT pros or the people managing identity and right turn the
31:49
knobs and dials to just make Active Directory more secure?
31:52
Or instead of trying to throw a bunch of like fancy sounding
31:57
things at it to sort of not actually harden Active
32:02
Directory, but just try to interfere with an attack.
32:06
So so I had some maybe I got I think.
32:09
That no, no, no, I think that was a good, good start to the
32:13
conversation. And I think the, you know, ITDR
32:20
could be like many other tools in identity where they focus on
32:26
the, the enterprise and all the different systems that could be
32:32
compromised. But I find so many organizations
32:36
are so heavily Microsoft centric that they're using AD or entry
32:41
ID including MFA system all through Microsoft.
32:46
So that's the best where most of your eggs are, you know, having
32:51
a tool that's hyper focused on that seems like it could make
32:55
sense. Yeah.
32:57
That kind of. Well what is where is going with
33:00
that was you know that seems like I may be answering this
33:04
next question which is why does it matter what vendor I choose
33:10
for my STDR solution? Yeah, I mean, obviously I think
33:16
right, I'm, I'm here here being sponsored right bias towards
33:21
Sempress, but I also think that that that being hyper focused
33:26
piece is where we excel. And right like I'm, I'm all
33:32
about having layers of security. So it's certainly nothing
33:37
against like XDR platforms. I think what I tend to find and
33:43
previously I I was on our product team and I was involved
33:47
in a lot of our competitive analysis.
33:49
So I've also like looked at all the other competitors like XDRS
33:53
tend to be really focused on like again, like a tax in flight
33:59
and there isn't really a component in them like, well,
34:02
what if something gets through right?
34:04
It kind of feels like you're betting a lot of money on like
34:07
that. They will absolutely 100% stop
34:11
anything and everything. Like no questions they asked.
34:17
You know, I, I think with Sempers in particular, like
34:21
looking at how we interpret response is really like that
34:27
trying to get Active Directory or intro back to a place that,
34:30
that you trust, right? Like where you can feel
34:33
confident that the directory service that you're looking at
34:38
isn't, isn't something that's been tampered with.
34:40
And that's where there's fewer companies out there kind of
34:46
working in that space to providing like forest recovery
34:49
or or now we also have tooling that we're working on for, you
34:55
know, bring in like Entra sort of back and objects back into
34:58
Entra. So that I feel like it's a big
35:02
question. So I could just probably keep on
35:05
on going. No, no for.
35:06
Sure. I mean, you know, a lot of
35:08
organizations have made a big investment in their SIM solution
35:12
over the years and a lot of times folks just ask the
35:16
question, what can ITDR do that my SIM solution can't do?
35:22
And, you know, they kind of see the SIM solution as identifying
35:28
events that have taken place. My answer has always been it's
35:32
the R Well, it's the detection should detect more things,
35:37
right? So it's kind of like you think
35:39
of like the Iron Dome analogy, right?
35:42
Shooting missiles out of the out of the sky or whatever.
35:46
It's identifying more missiles. And then the response is that it
35:50
can take them out. Just an analogy I made-up, but
35:57
how do you respond when people kind of come to you is can they
36:01
just get by the Splunk? Yeah, I'd say it's, it's back to
36:07
I, I think there's, there's three components is one.
36:11
I, I think like I, I was saying earlier that you'll probably
36:13
have a hard time sort of going one for one against a company
36:18
that focuses in the space and having all the detections.
36:23
I think the response piece is also the huge one because again,
36:26
like it's one of those things where it's tough because you
36:30
don't know until it happens to you what it can look like, but
36:39
whether it's like object level recovery, right?
36:41
And there's scenarios where the Active Directory recycling bin
36:44
like is not necessarily good enough.
36:48
So there's, there's some again, but we're mostly focused on
36:51
security operational benefits to the response portion.
36:57
But again, like I, I would just argue to any company who's sort
37:00
of like we've got the response covered would ask them to
37:03
actually go try to bring Active Directory back from, from the
37:07
grave, right? And I'm not talking about
37:10
pretending to bring one domain controller back, like bring
37:13
Active Directory back, bring it up so that your enterprise could
37:17
actually use it for whatever it is that you do and measure how
37:22
long that takes, how many resources it takes, right?
37:25
Like, you know, sort of what the, the cost is there, because
37:28
a lot of organizations don't go through a real sort of almost
37:34
like tabletop of that or, or actually go through the process,
37:37
right? They just look at their Dr. plan
37:40
and they're like, well, we've got, you know, a genetic, a
37:44
general backup solution or we've got system state restore and
37:48
check and like, right, we're on to the next thing.
37:50
And then when something actually happens, yeah, to my point
37:56
earlier about you sort of hate and life as the person who has
37:59
to bring things back. Yeah, we think.
38:03
Guests on come on and talk about getting cyber insurance and the
38:07
keys to getting cyber insurance. There were three things from an
38:11
infosec perspective or I should say from an IT perspective.
38:15
So it was ZDR, it was MFA and backups.
38:22
And so to me the question around backups is not just do you have
38:27
backups, but could you restore in a given scenario.
38:33
So I mean in my earlier days in IT, whenever I was responsible
38:39
for disaster recovery, the idea was some 9/11 type event or some
38:45
natural disaster takes off data center.
38:49
To me, that's not the most likely scenario.
38:53
To me, the most likely scenario is some threat actor who gets a
38:58
credential and then tries to take down your key
39:01
infrastructure. And if Active Directory is part
39:05
of your key infrastructure and they get a hold of it, you know,
39:09
just restoring from tape, it's, it's not like that, right?
39:12
And so that's where what you're saying comes into play.
39:16
I think EDR kind of feels a lot like well, I mean EDR is EDR,
39:21
but from an identity perspective it feels a lot like ITDR, you
39:26
know, and I think MFA is, is expected best part of this
39:31
hybrid identity protection because I was going to talk a
39:33
little bit earlier about opportunities with the hybrid
39:36
cloud. Well, it seems to me if you are
39:39
in a situation where you're going to continue to have an on
39:41
Prem AD, which I think a lot of organizations are in that booth,
39:45
they just don't see. They don't.
39:47
See a time until they close all of their offices.
39:51
They don't. See a time where an on Prem AD
39:53
is not going to be part of the picture.
39:57
Then having the MFA come from ENTRA is going to be a big key.
40:03
So I mean this this ability to recover from an intentional
40:08
disaster a lot different than the hurricane or something like
40:12
that happening anyway. Yeah.
40:16
So I think to your point, like if you use a cyber insurance
40:21
model, this is in the top three. Any any closing thoughts just to
40:29
kind of summarize everything we talked about.
40:32
Yeah, I have a couple. I guess I was just going to say
40:34
too, I, I think one point in with with the backup piece you
40:40
encounter a lot of enterprises where their their enterprise
40:44
backup software relies on Active Directory, right.
40:47
And nobody really notices or thinks that until, right, they
40:53
can't get into backup platform because active directory's down.
40:56
They've built that dependency and and now you're in the right,
41:00
the chicken and egg sort of scenario, except in a bad way
41:03
because you could, you don't have one to bootstrap the other.
41:08
No, I mean, I think as far as like, I mean, the, the points I,
41:12
I personally have like to drive with customers is, you know, on,
41:20
on the prevention piece of things.
41:23
So earlier this year there was like, you know, Windows Server
41:26
2025 coming out and, and you know, that actually kind of goes
41:30
to your point of Active Directory not really going
41:34
anywhere anytime soon. But Microsoft had this virtual
41:37
conference and I, I did a session that I called, you know,
41:41
an ounce of prevention is worth a pound of detection.
41:43
And the whole point I was trying to make in it was like, wait, a
41:49
lot of security people are so hyper focused on the detection
41:54
of attacks, which I, I won't argue that it's not important,
41:58
but there's so many ways we could just like prevent a golden
42:01
ticket from from happening, right?
42:03
And that's the part where I wish, like, I wish security
42:08
infrastructure, you know, whoever owns identity, that
42:11
there was more of an investment in the proactive security piece
42:16
of things, right? Because honestly, then I'm not
42:19
saying you don't need cyber insurance, but if you harden the
42:23
exterior, if you make it more difficult for a threat actor to
42:27
really, you know, pass the hash or perform a golden ticket
42:30
attack, like they're, they're also opportunistic, right?
42:33
So there are there are also scenarios where it might just be
42:38
right, a threat actor is going after five different people
42:40
like, well, the two that they can get domain admin in are the
42:44
ones that they're going to focus on and the others where maybe
42:46
it's unfruitful, right? They're just kind of move on.
42:51
And yeah, I probably already, I guess I'd say hit on it
42:56
somewhat. But I think the other part is
42:57
that that response, right? Because a lot of times again,
43:01
like I'd say kind of in the security industry, the feeling
43:05
is like response is like we've detected an attack and we're
43:09
going to like isolate the node, right?
43:11
Like again, I, I think from a layered approach, this is all
43:15
good. We've detected golden ticket and
43:17
we're going to use EDR to like isolate where we saw it coming
43:21
from, but written in those scenarios where it might be
43:25
actually too late based on the type of attack that you've
43:29
detected. But I think response really is
43:34
getting into that almost like Dr. piece of things like
43:39
response needing to be how do we get Active Directory back to a
43:43
place or a state where we can trust everything in it?
43:48
Because if you, if you can't honestly trust the state of
43:51
Active Directory, then you, you honestly can't like absolutely
43:54
say, how do we know that there isn't something from a threat
44:00
actor still lingering in here, right?
44:06
And as again, we we see in reality out there that these
44:10
scenarios happen where they'll they'll get you and then they'll
44:13
get you again after, after you've paid up or not paid up.
44:18
So. You, you made a great point
44:21
earlier where you're talking about layers of security.
44:25
It sounds to me like somebody says the prevention.
44:29
So in other words, examining your Active Directory and
44:34
providing a map, and this is the Druid tool I think you talked
44:38
about providing a map of here's where your vulnerabilities are.
44:44
And I love that point about an ounce of prevention worth a
44:49
pound of detection because if you can cut off, here's the way
44:55
I see it, most organizations are not going to be the target of a
45:02
day zero vulnerability, right? So that it's the attackers tried
45:07
to get in the door and then run scripts and they run scripts and
45:12
they run scripts. Well, those scripts essentially
45:15
are vulnerabilities that have been found and tools and scripts
45:20
have been created to leverage those vulnerabilities, right?
45:23
So if you have proper tooling in place, you cut off those
45:30
vulnerabilities, the scripts will work in your environment.
45:34
And so I think that's great. Now detection potentially would
45:38
detect something that is new that is novel, right?
45:43
And that, you know, there isn't really a pattern for.
45:46
And I think if you are the FBI or some organization where it's
45:52
like, you know, that's a really high value target and we're
45:55
going to use day zero attacks if we can get our hands on them,
46:00
nation state actors and things like that, that's a different
46:03
ball game. And I still think you have to be
46:05
in the prevention side. You have to prevent what you can
46:07
prevent, but you also have to be able to to detect more.
46:12
I think that you're making the case that for most
46:14
organizations, prevention is going to be the key.
46:17
So it's, you know, scanning your environment, setting up the
46:22
prevention. It's also, it's also the
46:27
detections. You have an ITDR system that is
46:30
detecting, it's giving you another layer of defense.
46:33
And then finally, if you are compromised, if all else fails
46:39
and you get, you get owned, you still have the the ability to
46:47
restore your Active Directory. What I like?
46:51
Is that you guys are so focused on the AD area, It's not a small
46:55
area by any means, but. It's a.
46:57
Focal point and for a lot of organizations, that's where the,
47:01
that's where they're, you know, their crown jewels lie and their
47:07
ability to control their environment lies within that
47:11
realm. Absolutely.
47:13
Absolutely, yeah. And I, I think in general, at
47:18
least it's Sempress like that's where, you know, we, we would
47:21
generally say that we're, we're complimentary to like XDR
47:24
platforms, right? Like 'cause, 'cause I think in,
47:28
in that layered approach, right? We all kind of bring our, our,
47:33
you know, benefits to protecting identity.
47:36
I mean, in the bigger picture, right?
47:38
I think especially from the layered piece of things, because
47:42
we just continue to see right sort of any identity attack.
47:46
It is so crucial, right? I mean, I, I, I have other talks
47:52
that I've done about right identity being the new security
47:56
perimeter. And we've been saying this since
47:58
2012 is as far back as I could find articles.
48:02
But to me it's like sort of like when are we going to drop the
48:04
new part of identity is the new security perimeter.
48:07
And just like say right it, it is the security perimeter these
48:11
days and actually treat identity security as like the sort of
48:19
first class sort of customer it should, it should be in the
48:23
enterprise. So, but I mean, I could again, I
48:27
could go on tangents about you all for years.
48:30
About that, right, but it's a great point.
48:32
We've been calling it the new perimeter for so long like why
48:35
don't we just call it the perimeter?
48:37
And it's because the layered security approach, there still
48:40
are firewalls. Oh, yeah.
48:42
They don't catch everything, but they block a lot, yeah.
48:47
Yeah, block a lot they are, but well, I would just say, I would
48:50
just say that's where it gets sticky with, right, the cloud,
48:54
because a lot of the more traditional defenses that we
48:58
have, we can't easily apply to like, you know, SAS applications
49:03
and and all that sort of stuff. Because, right, the interface
49:06
that all of our end users log into or authenticate through,
49:10
right, is the same one that, you know, threat actors can go hit.
49:14
And I, I won't ramble about it too much, but just I think to
49:19
the point you made earlier about, you know, sort of time,
49:23
money, resources and and how it's tough on people who even
49:26
know what they're doing It it it kind of goes back to that
49:28
there's just everything's so fast these days that you can be
49:34
the best of the best and still have trouble sort of keeping up
49:37
with it all. So yeah.
49:40
Absolutely. So Eric, any other closing
49:44
thoughts? No, I think good because I I've.
49:48
Been wanting to ask you, I know, I know you're really into hiking
49:53
and you had mentioned to me that you blew out your ACL was in
49:59
April. We're sitting here in in August
50:02
at this point recording this episode.
50:04
And I wanted to hear more about that.
50:07
Like what was the recovery like? Oh, it was.
50:10
It was, it was not fun. So, so actually my my son is
50:15
huge in the skiing and I never skied even though I've grown up
50:18
in the Northeast in my life. And this winter in January, I
50:22
was taking skiing lessons. My instructor had me going on a
50:27
slope that was a little too adventurous.
50:30
I got my skis caught up, heard a pop in my knee.
50:35
And then going to the orthopedic doctor, it was kind of a bit of
50:38
time. I had some fracture in my leg
50:41
that they had to let heal. So yeah, end of April, I had
50:43
surgery. Man, that was that.
50:47
That was rough. And I actually had a, a podcast
50:50
recording like my surgery was like on a Thursday.
50:55
And I think it was that next Monday I had some sort of
50:58
podcast recording set. And I, I didn't realize how
51:03
intense even the first week of healing would be because man, I,
51:08
I saw myself on that recording and I, I, I feel like I looked
51:11
and sounded like a hot mess from still being on meds and a lot.
51:16
Of opioids and stuff like that, Yeah, and.
51:19
I couldn't. My leg was completely like, I
51:21
had it propped up like under the desk it was.
51:24
But the, the recovery's been, it has been tough, man.
51:26
Like I, I'm still not allowed to run or jump.
51:30
And I, I can't believe just how the how little bit of surgery it
51:35
is in a way on your leg, how much it, it sets you back 'cause
51:41
it is, it is a tough thing to recover from so.
51:45
Yeah. Did you wind up gaining any
51:47
weight while you've been off your feet?
51:49
Oh yeah. Yeah, absolutely.
51:50
I mean, I'm, I'm up and walking around and, and if you saw me
51:54
walking down the street, you'd probably think nothing is sort
51:58
of wrong with my leg at this point.
51:59
But no, because also when I'm, when I'm feeling down, I love
52:02
binge eating. So it's, it's just been
52:04
cyclical. I can't go out and hike.
52:06
Join the club Join the. Club.
52:12
Well, yeah, I never actually had any kind of surgery on my knees
52:18
or anything, but I did have a a hernia a couple years ago now.
52:23
And like people said, oh, you have to sell your feet for a few
52:27
days. I didn't realize like this first
52:29
48 hours or so. How?
52:33
Because it was outpatient surgery.
52:35
So you go in and get the surgery, they knock you out, you
52:38
wake up five minutes later and the surgery's all in the past.
52:42
But then the recovery winds up taking a couple of months, and
52:46
it's the first couple of days they're the worst.
52:49
Oh yeah. Yeah, it is, it is brutal,
52:52
right. And I'm, I'm not a spring
52:56
chicken anymore or whatnot. So but yeah, it's, it's made for
53:02
a less than ideal summer in some ways.
53:05
But we're, we're going on vacation actually tomorrow with
53:08
the family for about a week to the Netherlands and, you know,
53:13
looking forward to still doing summary things and, you know,
53:18
enjoying life away from Netherlands is.
53:22
One of my favorite countries, you know, what I would recommend
53:26
if you can, is get outside of Amsterdam a little bit.
53:29
Amsterdam is like super cool, but it's also like touristy and
53:34
it's a big city. And if you get out into the, you
53:38
know, going from city to the city or maybe get into some of
53:41
the smaller towns, you're really going to enjoy it.
53:44
I mean, it's a beautiful country.
53:46
And, you know, I think all most people know they have a dike
53:49
system that pumps water out. Otherwise it would be most of
53:53
the country would be below water.
53:55
And so. It creates like there's all
53:58
these, I guess they're dikes that, that, you know, channel
54:02
the water out and the, the windmill.
54:04
The purpose was to operate the pumps to pump the water out.
54:09
Pretty ingenious and, yeah, just a beautiful country, a lot of
54:13
farmland. Yeah.
54:17
So try to get out there and explore.
54:18
I was. I spent a lot of time in Leiden.
54:21
It's a city that you can take a train from Amsterdam right
54:24
there. So anyway, you, you enjoy that?
54:29
Yeah. I will.
54:31
Eric, is there anything else or I guess we can wrap up this
54:33
episode? I think it's been a really
54:35
educational good good. I'm, I'm glad now.
54:38
I think if you, if you let me go too long, I'll just keep going
54:42
forever. So I'd I'd say we could probably
54:43
wrap it all right. Well, good.
54:46
I think the first thing I wanted to do is remind everybody about
54:49
the HIP conference. You can go to hipconf.com.
54:54
I was out at the website already.
54:56
The the conference is what, December or November 13th and
55:02
14th? I think it's, it's, it's in
55:05
November now. I can't remember if it's 12th,
55:08
13th or 13th, 14th. It's it says that the the site,
55:11
it says it on the website. That's right.
55:14
So if you go to hipconf.com, if you do decide to register, if
55:19
you look at the awesome speaker list, use the the discount code
55:24
IDAC pod, IDACPOD. We'll get you 20% off as the
55:30
best discount code that's out there and available.
55:34
You also find this podcast on any podcast platform that you
55:39
want to listen to Apple Podcasts or Spotify or there's a million
55:44
others that are much smaller and we're available in all of them.
55:50
We are also available on YouTube.
55:52
If you go to idacpodcast.tv, they'll take you right to our
55:57
YouTube page. We would appreciate if you enjoy
56:00
the podcast to go out there and subscribe.
56:02
Check us out. We're putting up new content at
56:05
least every week and we're trying to do even more than that
56:08
with like stories and outtakes. We also on we have our own
56:13
website idacpodcast.com and we're on Twitter or X at with
56:20
the at symbol IDAC podcast. We're also on Mastodon.
56:24
Now I've never been to that myself, but it's at IDAC podcast
56:30
at Infosec dot exchange. And our sponsor for this week is
56:36
Sempress or Sempress. I was told by Eric before the
56:40
episode that both are used pretty commonly and
56:43
interchangeably. And so it's at Semperis or
56:48
semperis.com, SEMPERI s.com and we'll have all those notes in
56:55
the show note. So for this week, thanks
56:59
everyone for tuning in and we'll catch you on the next one.
57:04
You've been. Listening to Identity at the
57:06
Center? We hope you've enjoyed the show.
57:09
Make sure to like, rate and review, and we'll be back soon.
57:13
But in the meantime, hit the website at
57:16
identity@thecenter.com. See you next time on Identity at
57:22
the Center.