This session provides examples of attacks against Active Directory and shows how you can protect your enterprise directory against them. The attacks addressed in this presentation include password cracking-, elevation of privilege-, and denial-of-service-based attacks. The session will help you understand some of the inner details of the AD authentication and authorization systems – such as LM hashing and Kerberos pre-authentication, cached credentials, SIDHistory, and token bloat… – and how these can create attack opportunities. Most importantly, this session illustrates the need for organizations to have a rock-solid AD administrative delegation and auditing model and a proven AD disaster recovery plan.

Jan De Clercq is a member of the HP Security Office, where he focuses on identity management and security for Microsoft platforms. He's author of Windows Server 2003 Security Infrastructures and co-author of Windows Server Security Fundamentals (Digital Press). He has been a speaker at several Microsoft and security-focused conferences. Jan has been involved in Windows, security and PKI-, SSO- related projects for large Compaq and HP accounts. Jan is based in Belgium.

 PowerPoint
Download