New In Nessus: Find and Fix These 10 Active Directory Misconfigurations

Let's face it: Active Directory is a feeding frenzy for hackers. Here's how our updated Nessus scan engine can help you disrupt attack paths.

Active Directory (AD) has been the leading identity and access management solution for organizations over the past 20 years. It's an impressive lifespan for a product that hasn't fundamentally evolved since its first release.

Such stability is commendable and has allowed Active Directory users — a whopping 90% of the Global Fortune 1000 — to implement longlasting authentication and authorization strategies rooted in solid ground. 

On the downside, this stability gave plenty of time for threat actors to skill-up and design equally solid AD-centric attacks from external and internal positions alike. The situation is compounded by the fact that most organizations designed their AD implementations years ago and rarely revisit them with an eye toward present-day security threats.. 

Today, let's face it: AD is a feeding frenzy for hackers. 

Behind every headline-grabbing breach or critical infrastructure-crippling ransomware attack is a misconfigured AD deployment. Ok, maybe not all of them, but the vast majority of attacks — whether sophisticated or by-the-book — require flaws in AD which allow an attacker to move laterally and gain those all-important admin privileges.

If cybercrime is an existential threat to our society, then all organizations need to be informed immediately of the state of (in)security of their AD. Only then will they be able to truly align their security tactics with the reality of their threat landscape.

This is why Tenable recently acquired Alsid and released Tenable.ad. We understand how AD plays a critical role in managing single sign-on processes and the level of access users are granted once authenticated. Tenable.ad provides holistic AD security enabling you to find and fix existing weaknesses and detect ongoing attacks in real time without the need to deploy agents or use privileged accounts. And when combined with our industry-leading Risk-based Vulnerability Management solution, Tenable.ad can disrupt the attack path, ensuring attackers struggle to find a foothold and have no next step if they do.

Today, we're going a step further in our AD security journey. We have incorporated 10 foundational AD checks directly in Nessus. Now, users of Nessus Essentials, Nessus Professional, Tenable.sc, Tenable.io and Tenable.ep can detect commonly exploited weaknesses to help protect credentials and prevent privilege escalation. These plugin checks generally fall into two categories:

1. Password and credential protection to help prevent attackers from implementing brute-force attacks on credentials and impersonating other users or accounts.
2. Privilege escalation and lateral movement to limit the ability for attackers to obtain excessive rights or privileges to move across domains.

The full list of AD plugins are as follows:

Password and Credential Protection

Privilege Escalation and Lateral Movement Prevention

In addition to the new AD plugins, we have also created a new scan template (Active Directory Starter Scan) and a preconfigured dashboard (Getting Started with Active Directory Security) to help you easily discover and analyze these basic AD weaknesses. The new AD plugins and scan template are available in Nessus Essentials, Nessus Professional, Tenable.sc, Tenable.io and Tenable.ep. The new preconfigured AD security dashboard is available today in Tenable.sc and will be available in Tenable.io and Tenable.ep on August 5.

Tenable has created a new scan template to support AD security.

Example of the new pre-configured Tenable dashboard for getting started with AD security.

These new AD security capabilities in the Nessus scan engine are a great first step toward disrupting attack paths before you are ready to embark on a more comprehensive AD security program. 

While we're on the topic of AD security, we're excited to announce the release of Tenable.ad 3.1 with a number of enhancements to help you detect critical Indicators of Attack (IoA) faster. New filters and visualizations help threat hunters accelerate their efforts to isolate malicious behavior and turn attacks into attempts.

자세히 알아보기

• Register for our upcoming Customer Update webinars to learn more about these new AD plugins: Tenable.io, Tenable.sc and Nessus.
• Visit https://www.tenable.com/products/tenable-ad to learn more about AD security or to request a demo of Tenable.ad.