SPHERE Insights is an ongoing column written by various members of the SPHERE team, highlighting unique viewpoints and expertise. This article comes to us from our product wonder, Rosario Mastrogiacomo.
Having strong controls on Active Directory policy and objects has a positive impact on many security work streams as they are used for access provisioning across many assets and setting enterprise policies. Not having the deep visibility into Active Directory creates a huge gap in many critical governance, risk and compliance initiatives.
Here’s what you need to know about Active Directory risk.
- Active Directory is the mechanism for enterprise access. Access governance starts with gaining better control over Active Directory and this begins with establishing necessary policies.
- Control standards need to be your baseline. The Control Standards create the definition of what constitutes a properly created structure, and is crucial to building a baseline that drive what requires remediation.
- Documented controls are foundational. Having definitive controls that are documented is always the initial stage for implementing governance and stops the bleeding.
- One word: standardization. The ability to create clear definitions of what was successfully remediated during campaign cycles relies on a well articulated and documented set of standards.
- Gap analysis can drive a future state. Current gaps in AD management that exist that are not documented (which in effect creates the proliferation of issues) will be identified and guidelines will be put in place to resolve these gaps. This builds necessary drivers for other teams to comply with new standards and allows for standardization.
- Enforcement requires policy management. Without clear written and published policy, the ability to enforce governance is directly impacted. There will be a significant amount of pushback and it will be difficult to achieve any effective percentage remediation rate.
Existing issues will only proliferate if no documented standards are socialized, thereby adding risk of a security incident. Consider the controls, standards and policies you have in place (or lack). We’ll help you identify and manage the gaps to kick-start your governance and compliance initiatives. Learn more about SPHERE‘s Active Directory Governance.
