Active Directory Security Assessment
Active Directory Security Assessment ⫘
Service Overview ⫘
The Secureworks Active Directory Security Assessment (ADSA) enables you to leverage the experience and insights of the Secureworks Incident Response team to understand how attackers can exploit Active Directory (AD) misconfigurations and security control gaps to achieve their objectives.
Service Methodology ⫘
During the ADSA, Secureworks uses configuration review toolsets and interviews with your internal personnel to identify AD configuration management practices and relevant cybersecurity controls. Secureworks provides step-by-step instructions for you to collect the AD configuration data required to perform the technical assessment. Secureworks does not require interactive access to your IT environment.
Secureworks will examine the following:
-
Overall state of your AD
- Forest and domain levels
- Administrative model and delegation of administration
- Management of group policies
-
Attack vectors
- Shortest path to Domain Administrator
- Protected groups and overprivileged objects
- End of Life operating systems
- Domain trusts
- Kerberoastable accounts
- Unconstrained delegation
The ADSA is performed remotely (through online collaboration tools) and consists of an initial meeting, the assessment process, and a debrief. Additionally, a final report will be delivered to your point of contact.
Outcome ⫘
Secureworks will provide a point-in-time evaluation of the organization’s AD security configuration. The outcome of the evaluation will consist of the following:
- Practical recommendations to rectify identified deficiencies
- Recommendations for further strengthening AD security, based on Secureworks and industry-accepted practices for securing AD
- Identification of design flaws and vulnerable configuration
- Risk-prioritized action items and remediation guidance that includes levels of effort to implement
- Virtual debrief session with your key stakeholders to review findings and recommendations as well as provide a forum for a Customer-driven question and answer session
Secureworks will not perform remediation steps; however, our partners can provide such service as a part of a separate engagement.
Scope and Service Units ⫘
| Scope | Description | Service Units |
|---|---|---|
| Small | Assessment of up to 2 Active Directory domains | 10 |
| Medium | Assessment of up to 5 Active Directory domains | 20 |
| Large | Assessment of up to 10 Active Directory domains | 40 |
The Service Units listed in the table above are used for estimation purposes only. Complex environments may require additional Service Units and will be estimated in advance of engagement commencement.
Scheduling and Booking Information ⫘
See Service Scheduling for information about scheduling this service.