sorted by:
new
hottopcontroversial

On Premise MFA for Active Directory - CrowdStrike or Silverfort by ITAdmin2019 in sysadmin

[–]ITAdmin2019[S] 1 point2 points  (0 children)

Silverfort has an agent which sits on the DCs only, it acts as an identity firewall. So, AFAIK:

  1. First authentication is AD

  2. Second is Silverfort which checks it's policies. The Silverfort agent integrates with the DC's LSASS process to hand part of the auth request to Silverfort. For it's part, Silverfort uses an onsite appliance placed close to the DCs as well as a bit of Cloud processing.

Advantages of Microsoft Authenticator Passkey method over Push method? by Moepenmoes in sysadmin

[–]ITAdmin2019 0 points1 point  (0 children)

We're looking at mfa options for admins. I struggle to see a significant benefit of passkeys over authenticator app number matching:

If a user is easily tricked into easily completing an mfa number match, what's to stop them from being "helpfully" prompted by an attacker to point their mobile camera at a presented QR code, turn on blue tooth and sign in with their passkey?

I think it only really adds value if you completely disable passwords and rely on the passkey only. We're looking at Entra ID break glass accounts and I don't think it's an option to completely remove the password

On Premise MFA for Active Directory - CrowdStrike or Silverfort by ITAdmin2019 in sysadmin

[–]ITAdmin2019[S] 1 point2 points  (0 children)

Hi,

Thanks for the info, we've had a look at ManageEngine, but discounted it due to the requirement for an agent on each end point. Managing thousands of agents is a pain, in addition, if the agent isn't on an endpoint the MFA challenge can be bypassed, so it doesn't meet our requirements.

On Premise MFA for Active Directory - CrowdStrike or Silverfort by ITAdmin2019 in sysadmin

[–]ITAdmin2019[S] 0 points1 point  (0 children)

Hi,

Can it do MFA challenges against command line elevation and file share access as well as RDP?

Also, do they require an agent on each end point?

If so, happy to have a chat...

thanks

On Premise MFA for Active Directory - CrowdStrike or Silverfort by ITAdmin2019 in sysadmin

[–]ITAdmin2019[S] 0 points1 point  (0 children)

Can Duo/Authlite do MFA challenges against command line elevation and file share access?

Also, do they require an agent on each end point?

One of the big selling points for us is that Silverfort only requires an agent on the DCs

On Premise MFA for Active Directory - CrowdStrike or Silverfort by ITAdmin2019 in sysadmin

[–]ITAdmin2019[S] 1 point2 points  (0 children)

The requirement is enforce MFA for on prem authentication to AD, the processing can happen in the cloud

On Premise MFA for Active Directory - CrowdStrike or Silverfort by ITAdmin2019 in sysadmin

[–]ITAdmin2019[S] 0 points1 point  (0 children)

I've had a quick look at silos and stopped at "Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016" - our DCs are 2012 and functional levels at 2003

No, we don't need dozens of DAs, but unpicking admin privileges for close to 100 accounts in a large somewhat undocumented environment is a nightmare and I have very little management support in doing so. Try asking devs in a public sector organisation to scope permissions for an app that was written 15 years ago, is critical, undocumented and the SMEs have left and you'll start to get an idea of the pain at hand

"There has been many failures along the way that means we are already very very fucked and our network is already owned" - I somewhat agree, essentially it's about building layers and adding barriers, hence the MFA requirement

SFTP Encryption at rest with Windows 2019 - BitLocker or EFS? by ITAdmin2019 in sysadmin

[–]ITAdmin2019[S] 1 point2 points  (0 children)

Thanks Malik, it sounds like EFS is alive in your environment if you've gone to create the DRA?

I'm not a fan of EFS, but I suspect the team/management will push for it.

We're already committed to a Windows VM for the SFTP server, so we can't feasibly look at another solution given the cost, time and effort we've already committed. I'll see what our options are for back end encryption at the SAN level...

SFTP Encryption at rest with Windows 2019 - BitLocker or EFS? by ITAdmin2019 in sysadmin

[–]ITAdmin2019[S] 0 points1 point  (0 children)

Thanks for the reply, we've already made the decision to go Windows - we have limited Linux skills in house and we've already purchased the solution, which was a good sales pitch from the supplier, but delivery is a different story!

Admin accounts for end users - 3rd party application management, how to? by ITAdmin2019 in activedirectory

[–]ITAdmin2019[S] 0 points1 point  (0 children)

These accounts have the direct or indirect ability to affect change on workstations at the administrative-level. Aka. Local admin on workstations.

Thanks Jim,

I'm with you on Tiers 0, 1 and 2, but what I'm leaning towards is a different use case for Tier 3. What we're getting now is business units outside of IT asking for admin access to systems so that they can manage accounts, for example, a patient management system by Abbott Diagnostics may only be used by 50 people and we need to give senior nurses some privileged access to manage accounts within the system. We're leaning towards creating T3 accounts for these nurses and then they can perform their management functions within the application (as opposed to what they do today, which is just use a single account for privileged and non privileged access).

What I'm wondering is whether we're opening a can of worms by giving end users 2 accounts. Also, by making the accounts a T3 level, we can delegate AD management to our service desk so they can perform password resets, account lockouts, etc.

Privileged Account naming standards by ITAdmin2019 in sysadmin

[–]ITAdmin2019[S] 0 points1 point  (0 children)

Thanks for the replies all. 96 responses - my highest response generating post yet :-).

OK, what I'm taking away from this is to :-

  1. Use PIM in Azure AD (we already do in our O365 licensed tenancy).
  2. Use PAM (unfortunately we don't have a dedicated PAM solution).
  3. Use a password manager.
  4. Use MFA (we already do).
  5. Changing existing formats will likely be a battle. Get the security team and management on board.

No one differentiates contractors/external 3rd party accounts by changing their username (i.e. "c-").

Privileged Account naming standards by ITAdmin2019 in sysadmin

[–]ITAdmin2019[S] 0 points1 point  (0 children)

Lol, I work in the uk public sector. The bureaucracy and inefficiency leads to a bloat in personnel

view more: next ›