Attivo Networks Extends Active Directory Protection to Mac, Linux, IoT/OT and Unmanaged Devices

Attivo Networks, which specialises in identity security and in preventing lateral movement attacks, has added a new product to its Active Directory Protection portfolio. Called ADSecure-DC, it is designed to detect identity-based attacks at the domain controller whichever endpoint they come from. According to the company, that covers attacks launched from Windows machines as well as from Mac, Linux, IoT/OT and unmanaged devices, many of which cannot easily run conventional endpoint protection software.

Attacks on Active Directory domain controllers rose sharply in 2021. Attackers target them to obtain the privileges needed to plant backdoors, alter security policies and spread ransomware or other malware. Frost & Sullivan estimates that more than 90% of Global 1000 enterprises rely on Active Directory for authentication and authorisation. In a research report by Enterprise Management Associates (EMA), half of the organisations surveyed had seen an attack on Active Directory (AD), and over 40% said the attack had succeeded. Some 86% said they planned to put more investment into protecting it.

ADSecure-DC spots enumeration and attacks aimed at Active Directory, and uses deep packet inspection and behaviour analytics to pick up suspicious user activity, issuing high-fidelity alerts. Attivo says this gives organisations AD protection against attacks from managed and unmanaged systems, IoT and OT devices, and common Windows and non-Windows platforms such as Mac and Linux, all without disrupting domain controller operations.

Srikant Vissamsetti, SVP of engineering at Attivo Networks, described Active Directory services as the store of all critical information, which helps adversaries push their attacks further, easily and unseen. For organisations running a managed Active Directory service, he said, extra protection for domain controllers stops attackers from carrying out ransomware, Kerberoasting, Silver Ticket compromise, Domain Replication and other advanced AD attacks.

Christopher M. Steffen, CISSP, CISA, Research Director at EMA Research, called Active Directory one of the assets threat actors target most. By exploiting its weaknesses, he said, attackers can get into an enterprise's whole network and move across multiple attack paths without being detected. He added that enterprises now understand the risks and vulnerabilities AD faces, which has made its protection a top priority in 2022.

ADSecure-DC sits alongside the company's existing Active Directory protection products. They include ADSecure-EP, which runs on the endpoint and stops attackers from seeing or reaching privileged credentials in Active Directory; ADAssessor, which provides continuous visibility of AD exposures; and ThreatPath, which finds and fixes exposed and risky credentials on endpoints. Attivo describes the combination as easy, efficient and effective protection for an organisation's AD environment.