More Companies Will Follow New NIST Guidelines & MITRE Security Matrix: 2020 Predictions (1 of 7)

In 2020, we’ll see NIST guidelines and MITRE ATT&CK security mitigation recommendations adopted by a growing number of enterprise organizations to safeguard their Active Directory and Office 365 data. Neither of these guidelines are required, but they sure provide best practices around 2FA, passphrases and Zero Trust as well as insight into the likely avenues of attack and how to defend against them.

This post is my first in-depth prediction for 2020 (see all 7 predictions here) , and I will outline what each of these organizations provide, how that impacts Active Directory security and where you can go to get more information.

What is the NIST Cybersecurity Framework?

On February 12, 2013, in Executive Order 13636, the National Institute of Standards and Technology (NIST) was directed to work with public and private stakeholders to develop a voluntary framework for reducing cybersecurity risks to critical infrastructure.

The resulting NIST Cybersecurity Framework applies to every organization, regardless of size, industry vertical and IT complexity. The standard is not mandated or compliance-focused; rather, it empowers IT organizations to establish an ongoing process for improving their cybersecurity posture.

In regards to Active Directory, there is no better place to apply the five cybersecurity functions of the Framework:

  1. Identify: Which assets need protection? i.e., identify highly privileged users and groups.
  2. Protect: Which safeguards are available? e.g., 2FA, Zero Trust on changes to objects in the directory, etc.
  3. Detect: Which techniques can identify incidents? e.g., endpoint monitoring, PowerShell monitoring, Active Directory changes, etc.
  4. Respond: Which techniques can contain the impact of incidents? e.g., automatic roll back of group policy changes or temporarily disabling the offending account or unauthorized PowerShell script.
  5. Recover: Which techniques can restore capabilities? i.e., how do you recover from a ransomware attack that takes down all of your domain controllers?

Shielding user credentials from attacks with NIST is a must do for every organization.

Reduce your AD attack surface

Reduce your AD attack surface.

See where you’re exposed and how to remediate it.

What is the MITRE ATT&CK Matrix?

Another way to secure your environment is to understand the methods attackers employ from their tool box. Enter the MITRE ATT&CK , a “knowledge base of adversary tactics and techniques based on real-world observations.” This is a free resource built by the collective cybersecurity community.

Of particular interest to you is the Enterprise Matrix for Windows. Here you can dive into the various attack methods according to the attack tactics and learn more about how it’s used, what permission is required to run that attack, mitigations and how to detect the attack.

Every attacker has their methods and MITRE ATT&CK has quickly become the place to go to understand those methods and take steps to protect your environment.

Resources to help you get started with NIST and MITRE ATT&CK

To get started with NIST, I encourage you to read more about the framework and how it complements Microsoft’s ESAE (“Red Forest”) as models for protecting credentials, particularly those that reside in Active Directory in the whitepaper entitled How to implement NIST, ESAE and Red Forest Cybersecurity Principles in Active Directory.

  • Domain groups and members
  • Domain users
  • Domain summary
  • Active Directory permissions

About the Author

Jennifer LuPiba

Jennifer LuPiba is the Chair of the Quest Software Customer Advisory Board, engaging with and capturing the voice of the customer in such areas as cybersecurity, disaster recovery, management and the impact of mergers and acquisitions on Microsoft 365, Azure Active Directory and on-premises Active Directory. She also writes thought leadership articles and blogs aimed at the c-suite to evangelize the importance of these areas to their overall business. She chairs The Experts Conference, a yearly event focused on pure Active Directory and Office 365 training at the 300 and 400 level for the boots-on-the-ground Microsoft admins and managers.

Related Articles