Hi.
Welcome to this course in Active Directory Protection
and Tiering, in which we work through a journey
of common pitfalls and misconfigurations
that we must be aware of and implement protective measures
against.
I'm Slavi, a security instructor at INE
and I will be running this course for you.
I hold a number of industry recognized certifications,
some of which you can see currently on the screen.
You're welcome to contact me via any of the provided contact
details.
Let's move ahead and see some of the topics
that we'll be talking about.
When we talk about securing Active Directory,
we have to start with the current state of it.
Therefore, we'll begin by looking
at some of the common, but highly impactful
attacks in Active Directory.
We'll do a technical deep dive into them
to understand when are they possible, how
do attackers exploit them, and finally, discuss prevention
methods against those attacks.
To name a few, we'll look into attacks such as Kerberoasting,
DCSync, and Golden Ticket.
Don't worry if you're not familiar with this yet.
It will all be explained shortly.
We'll then look into three of my favorite tools
which are used to perform analysis
in Active Directory that will help
me discover a large range of potential misconfigurations.
As an example, this can be a misconfiguration
where a non-privileged user have full rights
to modify a GPO in the environment.
When we finished discussing the tools
and analyzing the current state, we'll
move into the core concepts of this course.
Namely, that will be the Active Directory tiering
model and privileged access workstations.
We'll really take this into deep discussion
and go through a technical implementation
to demonstrate the benefits from having
these protective measures implemented.
As part of this section of the course,
we'll also talk about passwords and dig more
into the fine-grained password policies in Active Directory.
Finally, at the end of the course,
we will look into Windows Defender for Identities,
which is the new name of the tool Azure ATP.
This tool is one of the more automated options
for discovering anomalies related
to users and some of the attacks that we'll
be discussing in this course.
Thank you for watching, and I hope you enjoyed this course.