(TLP:CLEAR) CISA Highlights Multinational Guidance on Detecting and Mitigating Active Directory Compromises

Summary: CISA has published Detecting and Mitigating Active Directory Compromises, guidance developed by the Australian Signals Directorate’s Australian Cyber Security Centre with CISA, the NSA, and cyber security partners in Canada, the U.K., and New Zealand. The document covers the 17 most common techniques adversaries use to compromise Active Directory, explains how each can be leveraged, and recommends strategies to mitigate them. It assumes a basic understanding of cyber security and is of moderate technical complexity.

Analyst Note: Active Directory is the backbone of authentication and access control in most enterprise Windows environments, including many at water and wastewater utilities. Because it governs who can reach IT and, in some architectures, adjacent OT systems, a compromise can hand an attacker broad, persistent control. WaterISAC encourages members with Active Directory deployments to review this guidance with their IT teams, prioritize the techniques most relevant to their environment, and validate detection and logging coverage against the methods described.

This guidance maps most directly to Fundamental 6: Enforce Access Controls, from WaterISAC’s 12 Cybersecurity Fundamentals for Water and Wastewater Utilities, since Active Directory is the access-control system that manages authentication, privileged accounts, and group membership, and nearly all 17 techniques target credential hygiene and privileged access. It pairs closely with Fundamental 4: Implement System Monitoring for Threat Detection and Alerting, because much of the document’s value lies in the event logging and behavioral indicators needed to detect these attacks. Members can also connect it to Fundamentals 5 (Account for Critical Assets), 9 (Embrace Risk-Based Vulnerability Management), and 1 (Plan for Incidents, Emergencies, and Disasters), as domain controllers rank among a utility’s most critical assets and a full compromise can require forest recovery.

Original Source: https://www.cisa.gov/resources-tools/resources/detecting-and-mitigating-active-directory-compromises

Additional Reading:

• WaterISAC’s Cybersecurity Fundamentals for Water and Wastewater Utilities
• Principles of Operational Technology Cyber Security
• Primary Mitigations to Reduce Cyber Threats to Operational Technology

Related WaterISAC PIRs: 6 – 12