Believe it or not, it’s more and more common to find directories within organizations that no one knows exist. Unfortunately, an increasing number of cyberattacks are acutely focused on obtaining the keys to the kingdom – the identity infrastructure itself and its directories. This, after all, is what makes comprehensive ITDR so valuable for any organization. If a threat actor can successfully get in through this channel, they can more easily cause havoc.
So, what is a “shadow directory,” exactly? This surprising problem is rearing its head more and more. An organizations’ IT personnel don’t really know what constitutes their identity infrastructure. Not to mistake this challenge with the parallel need to determine what is best to use within an identity infrastructure, this ever-increasing hurdle surrounds items that organizations just don’t know what is present within their existing infrastructure. It’s crucial to find these shadow directories. After all, they’re not being monitored whatsoever. For example, perhaps by mistake, a developer or engineer is deploying services that were intended to only act as a client for authentication, but they instead deployed the full directory services. The result? Now, the organization is suddenly unaware that it has an active directory service that can manage users within the network.
The scenarios where a shadow directory can be created and forgotten are numerous, however various types of testing and/or misconfigurations are a common theme within many discovered causes. It can be a simple case of a huge workload that led to distractions or other incidents that resulted in the directory lurking within. Alternatively, more complex environments can lead to IT teams inheriting items they were not known to them in the first place. Additionally, employees that opt to not follow company policy and use an unauthorized password manager service can also end up creating a scenario where IT loses the controls it needs to maintain a secure identity and access management posture. Allowing other outside systems to manage access simply can’t be permitted.
AuthMind’s neuro graph automatically arms organizations with a consistent and fast tool to find and remediate these unknown pests that can, unfortunately, serve as a powerful pathway for cybercriminals. By running numerous data models, heuristics and protocol analysis as well as looking at all traffic within the neuro graph, personnel can be made aware of what hosts and IPs are acting as directories. Uniquely looking at the authentication attempts involving them and what apps and identities are involved play an important, accompanying role as well. Grouping all that information into one view is a gamechanger for the ITDR space, as it stands as a clear call out to staff to fix these lurking issues.
Armed with this full context, users are not only shocked in some cases, but also highly appreciative of the new capability – and it’s because they’ve realized (as so many do in the IT space in general), that we can be our own worst enemy when it comes to maintaining a strong security posture. And that’s especially true in regard to the identity infrastructure because it’s so relatively easy for developers and engineers to create something and accidentally leave it there, often for years. It’s not being maintained. It’s not being updated. That’s a recipe for problems.
Schedule a time for a quick demo of the AuthMind platform at www.authmind.com.
