I was invited to speak at Insomnihack 2018 (annual Swiss computer security conference) on the subject of tiered access. These are the slides I presented at my talk. It was better in person, with all the animations and anecdotal information I provided =)

1. Securing Assets Against
Malicious Internal Users
Through Tiered Access
Joel M. Leo – 3/22/2018
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
1

2. Disclaimer
This presentation represents my own experience, thoughts, and
opinions and is not representative of Gap, Inc.’s opinions or positions.
This presentation is not endorsed or approved by Gap, Inc., nor does
Gap, Inc. assume any responsibility or liability for the content, accuracy
or completeness of the information presented.
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
2

3. About me
• Live and work in Honolulu, Hawaii
• Principal Systems Engineer and Active Directory Architect for Gap, Inc.
• Trainer for ADSecurity.org ( https://www.adsecurity.org )
• Principal Consultant for Hi Tech Hui ( https://www.hitechhui.com )
• Consultant for several other organizations, focusing primarily on Active Directory
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
@joelmleo
https://www.linkedin.com/in/joelmleo
3

4. Contents
 Background
 Addressing the Problem Through Tiered Access
 Important Considerations
 Pitfalls
 Alternatives
 Conclusion
 Q&A
 Resources for Further Research
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
4

5. Background
What’s the problem Earthman?
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
5

6. Insider Threats are Real
I’ll take “Things I Already Knew” for $1,000, Alex
• 90% of organizations feel vulnerable to insider attacks [1]
• Organizations surveyed indicate “users with excessive privileges” is the highest risk factor (37%)
for insider threats [2]
• Insider threats are cited as the second highest concern (after ransomware,) while “User
credentials and privileged accounts represented the most common data types” exfil’d [3]
• US CERT has an Insider Threat Center to “conduct empirical research and analysis to develop
solutions that combat insider threats” [4]
• Edward Snowden [no citation needed]
[1],[2] – Insider Threat Report 2018, by Crowd Research Partners http://crowdresearchpartners.com/portfolio/insider-threat-report/
[3] – SANS 2017 Data Protection Survey – SANS https://www.sans.org/reading-room/whitepapers/analyst/sensitive-data-risk-2017-data-protection-survey-37950
[4] – Carnegie Mellon University Software Engineering Institute - https://resources.sei.cmu.edu/library/asset-view.cfm?assetID=91513
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
6

7. Problem Statement
Network deployments often leave administrative resources and accounts
exposed to abuse from inside the organization. Perimeter measures, such as
firewalls, do not mitigate these risks. Other tools, including endpoint
protection, alerting, etc., have varying levels of efficacy taken on their own.
By segregating administrative accounts & resources away from standard
accounts & resources, and separating administrative responsibilities and
infrastructure in to “tiers,” we can greatly improve our organization’s security
posture, helping to prevent internal misuse.
However, there are numerous pitfalls that can result in the feels of security
without actual improved security. I’ll try to help you avoid them.
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
7

8. These concerns are OS agnostic, but I’ll be focusing on Microsoft-based
problems and solutions, with a particular focus on Active Directory and
administrators that have control over the domains. Other operating
systems will have their own concerns and methodologies against which
this conceptual framework can be leveraged
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
8

9. Killchain
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
Image credit: Microsoft
https://docs.microsoft.com/en-us/advanced-threat-analytics/ata-threats
9

10. Null Tier, aka “The Swamp”
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
10

11. Null Tier Admin
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
T3h intertubes
11

12. Null Tier Admin Compromise
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
12

13. Addressing the Problem Through
Tiered Access
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
13

14. What Is Tiered Access?
“Tiered access” in this context means
A system by which administrative access to applications and infrastructure is
separated from normal user access through “tiers,” improving security by
controlling the flow of administrative access to, within, and between tiers
A “tier” is a logical collection of roles, responsibilities, resources and infrastructure
that work together to deliver a service in a relatively secure fashion, separated from
other tiers and non-admin users and computers through policy and technical
controls
Fundamental goal is to ensure different tiers and regular users cannot mix to help
protect against PtH/PtT and to limit exposure in the case of a compromise
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
14

15. Tiered Access High-Level Requirements
• Defined tiers with all elements (servers, software, storage etc.) necessary to
deliver a service
• Based on org’s administrative responsibilities
• AD
• Storage
• Workstations
• Servers
• Etc.
• Clearly-defined administrative boundaries
• Policy controls
• Technical controls
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
15

16. Security Slide Rule
The more security you have the less usability you have, and vice versa.
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
Usability Security
You need to identify the best balance of security and usability for your organization
16

17. Summary of Tiered Access
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
Yellow Tier
Green Tier
17

18. Admin Compromise, Interrupted
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
18

19. Extended Tiering Model
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
19

20. Important Considerations
Successfully implementing tiered access requires coordination across multiple
domains with orchestration between multiple technologies and concepts
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
20

21. Important Considerations 0x0
• Security requirements of the org are key
• Reference the security slide rule. Where do your org’s needs lie?
• Requires ongoing executive support
• Should be considered a tactic within a larger security strategy
• Organizational security policies need to be considered and potentially modified
• The first/highest tier should be your domain controllers/domain admins
• Addressing these first nets the biggest bang for the buck (or CHF) from a security perspective
• Scope needs to be reasoned and clearly defined
• “Scope creep” is a real thing
• Language and nomenclature used needs to be consistent and understood
throughout the org
• “Red/Yellow/Green tier” vs. “Tier 0/1/2” vs. “Tier 2/1/0” etc.
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
21

22. Important Considerations 0x1
• Trust needs to be established appropriately
• And revoked! Full role lifecycle management all the way through is requisite
• RBAC is a huge component of this concept
• If a technology doesn’t support RBAC toss it in the bin!
• There will be some bleed-through between tiers that may need to be
addressed
• Ie. virtualized domain controllers – how do you control access to the files that
comprise the VM? Should it be your domain admins, virtualization admins or
storage admins? Root (hint: No)?
• Support stack needs to be clear
• All should know which support group to talk to for issues at the different tiers
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
22

23. Important Considerations 0x2
• Automate, automate, automate all the things, as much as possible
• Self-service with structured approvals is handy
• Bastion hosts/jump boxes
• Hardened servers available only to members of the appropriate tier, which have
access through technical controls to the appropriate admin interfaces and networks
• Bastion workstations
• Hardened workstations that only allow access to appropriate tier accounts and
bastion hosts over appropriate networks
• Credential Guard, Device Guard, endpoint protection, close monitoring etc.
• Management (updates, config, etc.) should be separate from standard workstations
• Yes, this means admins may need multiple workstations
• SIEM/monitoring/alerting/defense is critical
• Documentation is critical (design documents, role runbooks, etc.)
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
23

24. Important Considerations 0x3
• Which environments are in-scope?
• AD DFL/FFL, supported DC OS, physical sites, etc.
• Available technical controls
• GPO, startup/shutdown/logon/logoff scripts, SCOM/SCCM, IPSec, MFA etc.
• Which technologies should be considered, utilized, & addressed
• Compute, networking, storage, virtualization, cloud, automation, identity
management, UEBA, SIEM, etc.
• Security is never done. There is no “secured,” only more or less secure
• This is not a panacea – still need to follow general best practices
around automation, user management, patching, configuration
management, endpoint protection etc.
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
24

25. Pitfalls
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
25

26. Pitfalls 0x0
Or: oh, the things I’ve seen 0.o
•Thinking this makes you “secure”
• There is no such thing as “secure.”
•Dictate action instead of collaborative planning
•Mushy tier definition
• Tiers should be clearly defined and documented
•Incomplete execution
• Half measures can leave you in a poor state
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
26

27. Pitfalls 0x1
•“Fire and Forget”
• Review the infra and execution on a regular basis to ensure you’re meeting
your goals and to see if there is room for improvement
•Insufficient documentation
• Documentation should be considered “living” and be validated as complete,
then kept up to date over time as things evolve
•Insufficient training
• Along with documentation should come training. Admins’ processes will
change in potentially dramatic fashion
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
27

28. Pitfalls 0x2
•No/insufficient monitoring
• No news is good news, right? Right?
•All ‘permit’ and no ‘deny’
• Implicit/explicit deny. Saying something shouldn’t be done isn’t the same as
preventing it from being done.
•Bespoke ACLs
• ACLs should be clearly defined and should grant/deny based on groups, not
individual accounts. Customizing ACLs ad hoc can expose the org more than is
immediately clear.
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
28

29. Pitfalls 0x3
•Incomplete application of policy and/or technical
controls
•Restricted Groups vs. GPP for controlling local
group membership
•Not addressing existing sensitive group
memberships and permissions
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
29

30. Pitfalls 0x4
•Reusing existing management infra for bastion
hosts/workstations
• These should be managed separately. If nothing else, ensure
automation/management creds between tiers aren’t shared (SCOM “runas”
and service accounts for instance)
•Attempting “big bang” in existing environments
• Tiered access can and should be approached in phases/stages/milestones
• Go for the big ticket items first: Domain controllers/domain admins
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
30

31. Alternatives?
• “Air-gapped” administration model
• “Zero Trust”
• Temporal group membership
• Protected Users Group
• “Red Forest”
• Credential Guard
• Device Guard
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
31

32. Conclusion
Implementing the tiered access concept is challenging, cutting across a
number of different technologies, organizational elements, and
organizational concerns, but can result in greatly improved security for the
organization that implements the concept well
• Take the “Important Considerations” section in to account before you
implement, preferably in the design phase
• Even after implementation, the “Pitfalls” section can help you identify
areas where your implementation may have fallen short, so they can be
addressed in the future
• Sometimes, the completed implementation barely resembles the original
design. If it works and provides the desired functionality and security,
update your documentation and go with it!
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
32

33. Q&A
@joelmleo
https://www.linkedin.com/in/joelmleo
Insomnihack 2018 - Securing Assets Against Malicious Internal
Users Through Tiered Access -© 2018 Joel M. Leo
33