Archives: Articles

The Millennium Alliance is thrilled to welcome Jason Wright, CISO of The United States Department of Defense, as the keynote speaker for our  Transformation CISO Assembly Assembly on November 2-3 in Denver! Jason is a talented senior leader that carries a passionate focus on people and using technology to enhance the human experience, and enable, transform, and improve business.

Interested in networking with Jason and more cybersecurity leaders? Click here to request an invite. Click here to request an invite.

About Jason Wright

From his peer’s perspective, Jason has been said to be one of the most capable leaders in any organization that he has or is working in, a solid performer and his attention to detail in all tasks have been a refreshing reminder to them that every job worth doing is worth doing right.

Jason has over 20+ years of progressive experience in highly dynamic, complex, and evolving global technology environments and servant leadership and success in myriad areas, including strategic planning, cloud computing, risk planning and management, change management, relationship and partnership building, IT and cyberspace operations, IT security policy and procedure development and implementation, service delivery, product development, digital transformation, business excellence, talent management, and portfolio, program, and project management.
Jason is thought leader that has consistently demonstrated positive results for every organization and stakeholder that he has had the pleasure of serving.  He has strong aptitude to understand evolving business needs, is expertly skilled and experienced in acquisition strategy and budget planning, execution, and control, with focus on short- and long-term strategy and transformation.

Contributed by Sempris

Sixteen years ago, Gil Kirkpatrick (Semperis Chief Architect) and Guido Grillenmeier (Semperis Chief Technologist)—each working for different companies at the time—got together to share their experience and expertise in protecting and recovering Active Directory (AD). The result of this collaboration was the publication in 2005 of the whitepaper “A Definitive Guide to Active Directory Disaster Recovery.” The whitepaper served a critical need in the industry, as most companies had accepted AD as the de facto standard directory service to use for controlling access to their corporate network, applications, and services for their users. Back then, information about recovering all or part of an AD was scarce, and not many AD practitioners understood the reality of the challenge. The whitepaper explained the mechanics of AD recovery and clarified how necessary it was for companies to prepare themselves to properly recover from various AD problems. It described how to recover from several types of disasters, including inadvertent deletion of AD objects, group policy misconfiguration, and failed AD domain controllers. The document ended with a brief outline of the process to recover an AD environment after a complete meltdown, with the caveat: “However, the likelihood of [needing] a full AD forest recovery is very small.“That was then, this is now. The cybersecurity landscape has drastically changed. A week doesn‘t go by without some organization‘s on-premises Windows network being flattened by a ransomware or wiper attack. For instance, from 2019 and early 2020 (with estimated recovery costs):

• City of New Orleans ($3M+)
• City of Baltimore ($18M)
• Norsk Hydro ($70M)
• Demant ($80M)

And there are dozens more. The point is that the ability to recover your AD environment entirely from backup is no longer a nice-to-have response to a highly unlikely event. It is a requirement. As the threat model has changed dramatically since  2005, so too has the Windows Server Operating  System (OS) and its built-in Active Directory service. Microsoft has improved Windows security substantially, added features and capabilities to simplify AD object recovery, and improved the behavior of AD when running in a virtualized environment. But the fundamental problems of recovering an entire Active Directory forest from backup haven‘t changed. It‘s still an error-prone,  complex process that requires planning and practice for all but the most trivial AD deployments.

It‘s notable that the two latest Windows Server releases (Windows Server 2019 and 2022) are the first versions of Windows Server with no relevant updates to the AD service itself. Apparently, in  Microsoft’s view, there are no more issues in AD to fix and no more service improvements required.  More to the point, AD disaster recovery is not going to get any easier. 

We now need to evaluate a company’s recovery capabilities in the context of the new cyber threats targeting AD today, which we didn’t have to worry about in 2005. Sadly, the increase in attacks means that companies urgently need to prepare for fast remediation of attacks against their corporate AD.  The improvements Microsoft has made to the core of the AD service over the years might still prove  of little help in recovering your AD if you are hit. Is  your company ready to quickly recover your own  corporate AD in case of a true disaster that wipes  out the complete AD service? 

Why Protecting Active Directory is so Important 

Active Directory (AD) has been in production for more than 20 years. As it was originally designed, this  Microsoft server role provides: 

Authentication: Authenticates on-premises users logging in to their PCs and the corporate  network and remote users logging in to in-house hosted applications or virtual desktops  

Authorization: Controls which AD-integrated resources—such as file services, printing, Exchange  Server, SharePoint Server, and SQL Server—they have permissions to access 

Security and control: Group Policy can apply policy configurations to every computer, server, and  user that is joined to AD 

Directory: A single location to discover users and resources 

DNS: AD-integrated DNS to provide network name resolution 

PKI: Active Directory Certificate Services provides certificates for domain users and computers 

The rise of popularity of the Windows Server OS to  provide basic file- and print-sharing services—and  other back-office services such as email, messaging,  and collaboration—helped cement AD as the network  directory of choice. Microsoft evolved practically  all its popular applications to rely on it, making AD  one of the most ubiquitous software services in  the enterprise today. Over 90% of organizations  worldwide larger than 500 employees use AD. 

The rise of cloud computing has not changed this  reliance. In fact, cloud computing has increased AD’s  importance to the enterprise. There are two factors  behind AD’s importance to the cloud. 

First, the cloud computing model doesn’t depend on  trusted networks in the way traditional on-premises  computing does because, unlike traditional corporate  networks, traffic between clients and the resources  they access most often occurs over the public  internet. This traffic is not secured by WHERE you are,  but by WHO you are. As Microsoft puts it, “identity is  the control plane” by which access to cloud resources  is controlled. A user’s identity is front and center in  cloud security. 

“As with system state backups, caution is needed when restoring AD from BMR backups after a cyberattack to avoid re-introducing malware.”

Click here to to read more 

About Sempris 

For security teams charged with defending hybrid and multi-cloud environments, Semperis ensures the integrity and availability of critical enterprise directory services at every step in the cyber kill chain and cuts recovery time by 90%. Purpose-built for securing hybrid Active Directory environments, Semperis’ patented technology protects over 50 million identities from cyberattacks, data breaches, and operational errors. The world’s leading organizations trust Semperis to spot directory vulnerabilities, intercept cyberattacks in progress, and quickly recover from ransomware and other data integrity emergencies. Semperis is headquartered in Hoboken, New Jersey, and operates internationally, with its research and development team distributed throughout the United States, Canada, and Israel. Semperis hosts the award-winning Hybrid Identity Protection conference and podcast series (www.hipconf.com) and built the free Active Directory security assessment tool, Purple Knight (www.purple-knight.com). The company has received the highest level of industry accolades, recently named to Deloitte’s Technology Fast 500™ list for the second consecutive year (2020-2021), and ranked among the top three fastest-growing cybersecurity companies in the 2021 Inc. 5000 list. Semperis is a Microsoft Enterprise Cloud Alliance and Co-Sell partner. To learn more visit https://www.semperis.com/

The Millennium Alliance is thrilled to welcome former White House intelligence professional Olivia Troye as keynote speaker for our upcoming Transformational CISO Assembly on August 30-31. Troye served as Vice President Mike Pence’s Homeland Security and Counterterrorism Advisor from 2018 to 2020 and brings over 20 years of experience providing strategy, policy & operations expertise to Cabinet-level officials and private sector executives in the intelligence, counterterrorism, homeland security, risk management and international affairs arena.

Click here to request an invite to the Assembly.

About Olivia Troye

Olivia Troye is a former career intelligence professional who served as Vice President Mike Pence’s Homeland Security and Counterterrorism Advisor, as well as his lead staffer on the White House Coronavirus Task Force.

Originally from El Paso, Texas, Troye is fluent in Spanish. She received her Bachelor’s in Political Science from the University of Pennsylvania and a Master’s in International Security Studies and Counterterrorism from the National Defense University College of International Affairs. In 2019, Troye graduated from the Naval Postgraduate School’s Executive Leaders Program, an exclusive opportunity for senior-level homeland security & public safety leaders.

After graduating from college, Troye worked for the Republican National Committee. The September 11 attacks prompted her to begin a career in national security, where she first served in the Pentagon as a George W. Bush Administration appointee. Troye was an intelligence official in the DHS Office of Intelligence and Analysis serving as chief of strategy, policy, and plans and worked in the Office of the Vice President of the United States as the homeland security and counterterrorism advisor to Vice President Pence and an aide to the White House Coronavirus Task Force.

After leaving the White House, Troye went on to found The Troye Group, where she currently serves as director of the Republican Accountability Project and Republicans for Voting Rights. Troye uses her expertise and platform to advise private sector and non-profit organizations on global & domestic national security initiatives, educate clients on misinformation and disinformation threats on a variety of issue areas, including election security and political violence prevention, and support non-partisan and non-profit organizations on initiatives related to national security, voting rights, and defending democracy.