Football and Active Directory Security

Similarities between good identity infrastructure security and a winning football team.

1.???? Blocking and Tackling:

These two things are fundamental in football. If you can’t block or tackle, you won’t win. PERIOD. Sure, everyone loves the flashy player high stepping down the sidelines for a score, but without the basics of blocking and tackling the touchdown celebration will never happen.

Similarly in Security everyone is drawn to the latest flashy security tool (i.e. Next Gen, AI, Machine Leaning, etc.) and mistakenly look to prioritize those things, but without security fundamentals none of those flashy tools matter. ?

There is nothing more fundamental than securing your Active Directory Environment. As they say, “If your AD environment is not secure then nothing is”.?

You can have all the newest trendy security tools available, but if a bad actor accesses your AD environment and laterally moves around or encrypts AD in a ransomware event…. The game will be over.

?

2.???? Defensive Strategies:

A strong defense in football is vital to prevent the opponent from scoring. Hit ‘em hard and make ‘em fumble.

A defensive approach for Active Directory (preventing security breaches, unauthorized access, and data loss) is just as essential.? A company needs to quickly spot misconfigurations, vulnerabilities, Indicators of Exposure, and Indicators of Compromise.?

“Hit ‘em hard” by quickly finding and remediating these things is one of your best chances to stop the bad guys from "scoring" and causing them to fumble.

3.???? Recovery and Resilience:

In football, the best defense may occasionally let a score slip through. (Even the 1985 Bears gave up a touchdown or two). And when a touchdown happens a team needs to bounce back quickly.

And despite robust security measures, Active Directory outages and breaches can and will occur. When this happens, a company needs to rapidly recover and restore their Active Directory Forest. When AD goes down a business grinds to a halt. A company’s ability to recover AD in minutes without reintroducing malware is paramount to being resilient and getting back in the game.

?

4.???? Offensive Strategies:

The best defense is a good offense and football teams require a talented offense that can score to win.

You may be wondering “how do you score" when it comes to AD security? ?Well, to me scoring is simply getting ahead of your opponent. A great way to stay ahead in AD security is to have a technology solution that automates remediation. Things like automatic roll back of malicious changes in AD that are too risky to wait for human intervention, auto undo of unwanted changes in Azure AD, intel on who is making a change, or automatic alerts of critical system changes will keep a company ahead of their adversaries every single time. ?

?

5.???? Teamwork and Collaboration:

Football is a team sport that requires coordinated effort among players to achieve success.

Security, IT, IAM and Cloud teams also need to work together to ensure their Identity Infrastructure (AD, Azure AD and Okta) environments are protected before, during or after an attack.

Having a single technology solution to help those teams deploy their offense and defense is the best way to succeed. It allows them to all operate from the same playbook.

?

In summary, just as the best football teams strive for victory on the field, companies should aim to secure the playing field of Active Directory to ensure a winning approach to Identity Security. Fundamentals, defense, recovery, offense, and teamwork are all ways to ensure a Super Bowl Season.

?