Back To The Old School? Why Mapping Your Ancient Active Directory Might Be The Best Way Of Disrupting Novel Threats

Speed is an intriguing concept when we’re talking about cybersecurity. Firstly, whose pace should we be most concerned about? Is it the developers of new business-enabling digital tools, and the rate at which they go from being nice-to-haves to business-critical technologies? Is it the alacrity with which the organisation’s leaders rush to embrace developments that promise to enhance productivity and profitability, regardless of their impact on data security? Is it the breathless dashes through defences that attackers increasingly seem able to make, and how fast they can move laterally within the organisation’s carefully structured information silos? Or is it all of that and more – the relentless, unceasing waves of change, the ebb and flow of risk, and the fact that the average CISO has no means whatsoever of slamming on the brakes even if they knew which bit they wanted to try to slow down?

Sometimes, it seems, the best way to disrupt the most furiously focused and speed-enhanced attacks might be to return to some of the forgotten corners of the corporate network and take some time – not loads of it, either – to understand exactly what’s going on. This was the perhaps paradoxical lesson that leaped out of a recent RANT roundtable held in London where a selection of harried senior cybersecurity leaders engaged in a lively discussion with staff from SpecterOps. The company, which offers a wide range of security consultancy services, including Red Teaming and penetration testing, as well as the open-source and enterprise versions of a tool called BloodHound, has extensive experience working with some of the most demanding and technologically advanced organisations in the world.

When SpecterOps lets BloodHound off the leash in a large business, it romps through the active directory and worries away at the problem. It produces a graph, showing the myriad ways an attacker could move laterally, vertically and undetectably through the nodes of an organisation’s network. How shall they Pwn thee? BloodHound counts the ways. In one recently mapped financial-services giant – around four billion viable pathways that an attacker could use to reach the crown jewels. BloodHound doesn’t fix anything – but it shows users the pathways attackers could use, enabling network defenders to dynamite the road underneath an adversary’s digital army and deny them access to what they’re seeking.

Turbo Charged

In those businesses with huge numbers of attack paths, not only will many pass through the active directory, but most will be faster to travel down in organisations which give largely free rein for so-called “AI” agents to operate without direct human oversight or instruction. So it was little wonder that AI should surface very early in the evening’s discussion, as the advent of machine-speed automated tools has raised the stakes in identity and access control circles.

   “We’ve got an early ringside seat to AI,” Mark Wilson, SpecterOps’ senior sales engineer, told the gathering. “We’re building cyber ranges for Open AI, Anthropic, the UK AI institute. We’ve got access to models that haven’t been released yet. So we’ve had a lot of early insight into what that means.”

Largely, what it means is that everything – for good, or for ill – is happening faster.

   “The principle of assume-breach has moved to a point of certainty – we’ve absolutely seen that,” he continued, referring to the mindset advocated in hitherto forward-leaning companies, to forget about keeping attackers out, and work out how to deal with them once they get inside. “The other thing is machine-speed lateral movement. All the high-profile companies who’ve been compromised in the last few months, they all have the latest EDR, they have their own SOC, 24-7 monitoring, and they still got hit really quickly.”

And this, he noted, is – if not always because of; but certainly increased by – the ways agentic AI systems work. To properly benefit from the machine-speed enhancements these tools and technologies promise, a business has to allow them to not just create and deploy agents autonomously: but to ensure that those agents are given access to the other parts of the system they need in order to carry out their promised functions. Even if a tool is working entirely benignly, and only carrying out the tasks its makers and users intend, the knock-on effect on access management is profoundly unsettling. New identities, created by automatic processes, authorised to access disparate parts of the corporate infrastructure, and not just operating but being created without any awareness from the security teams – it drives the proverbial coach and horses through most organisations’ access-management processes. And once those are disrupted, disturbed, destroyed, then attackers will find it far easier not just to get in – because we know that they’re going to get in anyway – but to operate inside the enterprise without much danger of being discovered, never mind ejected.

   “The thinking needs to change,” Wilson said. “The reason adversaries use identity is because it’s very difficult to pick up a signal you can respond to. We take the approach of not trying to have that fight. We change the focus. Our red team don’t use a single vulnerability, ever. It’s the quickest way to get picked up.”

Get Into Something

There were those in the room who seemed to still cling to the hope that some form of machine-speed agentic responses may help solve this burgeoning identity crisis. Though even those who voiced these thoughts did so in a way that implicitly acknowledged the almost magical thinking – or belief in the supernatural – that perhaps lies behind them.

   “For me, if I had a magic wand…” one CISO began, before essaying a different analogy.

“Imagine you have a house and you keep building it,” they posited. “You keep on adding extensions. And if I want to know whether it leaks, I pour water over the top, and I see where it comes out. If I transfer that idea to IT, this is the policy area we’re supposed to be in. I’d love to have an AI agent based on that. Regardless of any access privileges, what should we have access to? The agent could help you determine which people shouldn’t have access, all based on the policy. So what I’m looking for, one day, is an application that can do that. Whether an identity is coming from AI, an API, a misconfiguration, won’t matter – if says you shouldn’t have access, so you don’t have access.”

Reactions to this proposal were ruminative, respectful, and reflective. But there was little sign of anyone in the room sharing any sincere belief that such a tool might soon exist.

   “If you take away the hype around the Open AI breakout and the Hugging Face debacle, all this is about behaviour,” one security leader said. “Will we really be able to rely on policy when agents will work together, and find ways of circumventing policy? And will we ever get to a policy that’s that granular? When you’re issuing policies, a human is still making a decision about what’s right or wrong. You can set technical policy guardrails, but when you give an agent an objective, it’ll work out how to get around them.”

“Agents don’t have the context,” said another leader, evidently struggling to balance optimism and cynicism but giving it a good go. In response to another attendee, who had noted that, in most contexts, access is conditional, this leader agreed: but wasn’t convinced this would ultimately make much difference to the challenges posed by agentic systems. “If you look at policy without conditions you’re probably playing 3D chess,” the suggested. “And the machine will be better at playing it than you are.”

Going Way Back

Perhaps, other attendees mused, the conversation – as so many in cybersecurity at the moment – had become dominated by AI concerns, when the nub of the matter was something more fundamental and less troublingly novel.

   “We talk a lot about AI, but users are far better at circumventing things than agents,” they argued. “Of our top 100 users who are using things they shouldn’t, they’re not using AI to do them – they’re using platforms. Our backup has been around for so long, and no-one’s found a better solution. The requirement hasn’t changed, but the products haven’t matured. Some organisations now are looking at completely de-coupling identity [and considering it as] a completely separate layer: with the identity enabled for the service.”

“When we talk about policy and zero-trust, those are what we think we’ve applied permissions to,” Wilson said. “We think of them as vertical silos – and when you look at them in a silo, they’re alright. But there’s integrations; and you move laterally through them. When you think about those silos, there are going to be collisions. When we’ve compromised clients, it’s where we’ve moved things over. The attacker lives in that space, and they don’t care about governance or policy.”

It’s a recipe for, if not disaster, then something seriously unappetising, as Wilson’s colleague, Europe, Middle East and Africa region sales director Colin Makin, pithily put it.

   “It’s like cooking,” he said. “You can have the very best ingredients, but the meal may still end up being terrible.”

Stepping away from metaphor, Wilson sketched out a real-world example of how lateral movement through and between vertical silos can be conducted easily by adversaries, with devastating responses. His vignette came from some recent Red Team work with a large software vendor.

   “They said, ‘We’ll give you a Git user account – do your worst’,” he recalled. “Their expectation was that we’d quickly get stuck, but that wasn’t the case at all. Just using that identity we were able to move into the Git repository, elevated our access, and within a short space of time, finding stuff that had been forgotten about, we’d gained control of their tenant and could have compromised 5,000 other organisations through a supply-chain attack. The reason we could do that is because everyone’s thinking about a least-privilege model. But the attacker’s mindset is: ‘If you give a non-human identity or an agent Slack access, what can it get to through those channels?'”

Cold Gettin’ Dumb

“I think we’ve known this is a challenge for a very long time, and we’re always trying to chip away at it,” RANT’s guest host for the evening, Paul Griffiths, CISO of financial data and publishing business Delinean, said in his summation. “But it’s been bare bones, almost – just what we’ve needed to get through audits. Now, I think it’s become an insurmountable problem. We’ve used the old-school approach of doing policy and compliance, and increasingly we’re moving into activity monitoring. But AI is increasing the identity requirement. This is a real problem, not an invented problem.”

Underlining that assessment, Makin pulled few punches. The companies represented round the room ranged from relatively small to globally significant, yet were all experiencing these problems. None of these entities, he stressed, should feel as though they were on their own in this regard. SpecterOps’ clients include giant firms whose products sit at the heart of the majority of the world’s digitally enabled businesses, and even they don’t really know how to respond.

   “Microsoft are one of our biggest customers – they can’t solve the problem that AD has created,” he said. A chilling revelation, met with stunned silence – but help is at hand, he promised. BloodHound, he said, “is the cheat code. If your Blue Team uses it, they can get rid of not just the quickest routes, but all the routes.”

SpecterOps issued an open invitation to those around the table: let the firm loose in your active directory for a few hours, and BloodHound will lead your business to the sunlit uplands of cybersecurity heaven. Well, maybe not exactly – but they’ll at least promise to point you on your way.

   “If you want to know how big the problem is, rather than taking the narrow view – this is what we do,” Wilson said.

“Give us the lowest identity possible, and an hour and a half, and we’ll show you how many attack paths you’ve got,” Makin added.

“If you want to find out what the risk looks like,” Wilson said, “let us know.”