In a business and IT context, there’s only one constant: change. Think of hybrid IT landscapes that keep on evolving, tens or even hundreds of systems and applications that need updates on a regular base, a growing number of temporary contractors such as freelancers and consultants, etc.

Considering this pace of change, maintaining an overview of the situation has become more challenging than ever. But if you can’t see all the users across your IT environment and if you don’t know what applications and data each of those users can access, it is close to impossible to control risks and prevent threats. Understanding the relationships between people, access and data is a crucial factor in this regard. In other words: getting to know the unknowns.

In this guide, we bundled the identity controls that apply to Active Directory. Moreover, this set of controls has proven to be applicable to the majority of the organisations. In the ebook ‘How to build the perfect risk cockpit for Microsoft Active Directory’ we discussed the six steps to set up comprehensive and scalable risk cockpit.

This guide is written for IAM, IT and security professionals. The contents are not limited to any organizational size, structure or industry. The premise is, however, that the organization uses Active Directory. Nevertheless, most of the controls also apply to other applications albeit with some adjustments.

Employees use more and more applications, of which a growing number is cloud-based. Besides, hybrid environments are becoming the new standard. Maintaining an overview of who can access which application therefore becomes increasingly difficult. And increasingly important as well. Think of security breaches, compromised data, all of the regulations your organization needs to comply with, … Using a well-designed risk cockpit, you can easily assess and audit access to your critical applications, gain actionable insights, and control the users and their access rights.

2. EMPOWER YOUR IT TEAM

In many organizations information security audits and other identity controls are still based on the use of spreadsheets. However, this method is very time-consuming and cumbersome, and often leads to inaccurate results, and therefore in wrong decisions. Moreover, the relations between people, access and data are often hard to spot in non-dedicated identity tools such as Excel. 

3. GAIN ACCESS CONTROL

Today, many employees don’t simply climb the ladder within a single department. Instead, they regularly switch across departments and functions. If you sit back and relax, access rights and permissions will inevitably pile up and users will end up with excessive access rights they no longer need to do their job. These excessive access rights pose a risk to the organization as they can be misused or compromised. 

In summary, a comprehensive risk cockpit allows your IT team to easily detect and reduce risks. Moreover, passing your next internal or external audit will happen much smoother and faster. 

Regulations concerning information security are primarily developed to protect employees and customers against the misuse of their personal (and sensitive) data, such as GDPR and CCPA. In doing so, those regulations force companies to take certain measures to protect themselves and to protect the data they keep from potential threats. The threats that could jeopardize the security of your sensitive and business critical data play an important role in this. 

For many organizations, striving for compliance with relevant regulations is an important driver to implement or improve their security processes and controls. While this is of course a valid and very useful reason, there are companies out there that also use these regulations as the basis for their security program because they consider this good business management. In fact, more and more stakeholders attach importance to organizations using the data entrusted to them in a sensible and responsible matter.

Understanding the business and regulatory context you are operating in allows you to align your risk management strategy with your business needs and set the right priorities. Moreover, this is a prerequisite to design and build an appropriate risk cockpit. Note that, next to the purely objective aspects (such as regulations imposed by a governmental body), it’s also about the issues that you and your team are concerned about. What’s in your head all day and what keeps you awake at night? 

Fact is that the success of your security efforts greatly depends on your ability to focus energy where it really matters.

Before setting up the relevant control sets, it’s important to know which groups, and therefore which user accounts, are critical for the mission and security of your organization. Nowadays it’s common practice to use standard rules to give you an indication of these groups. Those rules are often based on the use of AD default security groups, such as Administrators, Domain Admins and Enterprise Admins. However, those groups do not take your business context into account, nor your organizational and AD structure (e.g. custom groups). Nevertheless, those standard rules are a good starting point. 

Once these ‘default critical’ groups are identified, you should evaluate whether they are actually critical and actively used in your organisation. Additionally, identify custom groups (if you have any) and check - keeping the business and regulatory context in mind - which  groups  are critical or riskier than others.

In the section about privileged accounts you can find some elements you should definitely look into.

In order to properly execute this step, gaining full visibility and understanding across all groups and other AD objects is essential. If you don’t know how to get started, don’t hesitate to contact us and get some more detailed instructions.