Chapter 7 — Identity and access foundations | Technologist Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Identity and access foundations

Lesson map

Lesson 07 published. Map, example, EX019.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Accounts and groups"]
  N2["7.2 Local administrator accounts"]
  N3["7.3 Evidence in identity logs"]
  N4["7.4 Privilege review"]
  N5["7.5 Least privilege"]
  N6["7.6 Service accounts"]
  N7["7.7 Joining evidence"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX019"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Accounts and groups"]
  N2["7.2 Local administrator accounts"]
  N3["7.3 Evidence in identity logs"]
  N4["7.4 Privilege review"]
  N5["7.5 Least privilege"]
  N6["7.6 Service accounts"]
  N7["7.7 Joining evidence"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX019"]

[Learning outcomes]
    |
    v
[7.1 Accounts and groups]
    |
    v
[7.2 Local administrator accounts]
    |
    v
[7.3 Evidence in identity logs]
    |
    v
[7.4 Privilege review]
    |
    v
[7.5 Least privilege]
    |
    v
[7.6 Service accounts]
    |
    v
[7.7 Joining evidence]
    |
    v
[Worked example] --> [Exercise EX019]

Learning outcomes

You will (1) explain accounts, groups and privileges; (2) review local and domain administrator use; (3) find risky identity configurations; (4) read identity evidence in an incident.

7.1 Accounts and groups

Users have accounts; accounts belong to groups that grant permissions. Domain accounts are managed centrally; local accounts exist only on one machine.

For an investigation the distinction decides where to look. A domain account's logons are recorded on the domain controllers as well as on the machine; a local account's logons are recorded only on the machine itself. The admin account used on CLERK-03 was local, so the evidence of its use lived on that desktop and nowhere else, which made preserving the desktop's logs urgent before anyone reimaged it.

7.2 Local administrator accounts

Many organisations once set the same local "admin" password on every desktop for convenience. If one machine's password is guessed or stolen, every machine is exposed. Unique, managed local passwords prevent this.

At Alder Falls the same local password was set on 140 desktops in 2019, so the logon on CLERK-03 raises an immediate question about every one of them. Unique passwords per machine, rotated by a managed tool, mean that a password learned on one desktop opens nothing else, and an investigation can focus on fewer machines with more confidence.

7.3 Evidence in identity logs

Domain controllers log domain logons; local logons appear only on the machine's own log unless forwarded. That is why CLERK-03's local admin logon was visible only after examining the PC.

Forwarding local security logs to the central collector would have made the CLERK-03 logon visible without touching the desktop, and would have protected the record if someone had cleared the local log. Jonah adds this to his readiness list: identity evidence for local accounts should not depend on the machine that may be compromised.

7.4 Privilege review

Who is in administrator groups? Jonah finds nine accounts in the domain admins group, three belonging to staff who left.

Three domain administrators belonging to departed staff are a risk and a lead at once. Each enabled account is a way in that nobody watches, and any recent use of them needs explaining. Jonah lists the nine accounts with owner, last logon and the reason each needs the rights, and gives the list to Renata rather than disabling anything himself during an open case.

7.5 Least privilege

Users get what they need; admins use separate accounts for admin work.

Separate admin accounts make evidence clearer too. If staff browse the web and read email with ordinary accounts and use a distinct account only for administration, an admin logon at an unusual time stands out. When one account does everything, nothing about its use is unusual, and an intruder using it blends in. Least privilege limits both damage and ambiguity. Jonah notes that several IT staff at Alder Falls still use one account for everything, and proposes separate admin accounts as a quick win.

7.6 Service accounts

Accounts used by applications often have broad rights and old passwords; they need owners and reviews.

At Alder Falls Jonah asks each application owner which accounts their system uses, what rights they hold and when the password last changed. Accounts with no known owner are listed for review rather than disabled outright, because an unknown dependency might stop a city service. Service account logons should follow a predictable pattern, which makes an unusual one easy to spot in the logs.

7.7 Joining evidence

The admin logon on CLERK-03 at 08:02:40 came from network logon type with source 10.20.4.12 — another desktop. That expands the investigation.

The source address turns one machine's story into two. Jonah checks the DHCP log to confirm which desktop held 10.20.4.12 at that time and notes that it is also the address behind the burst of failed logons on the file server. Renata adds that desktop to the collection list, since whatever happened there began earlier than anything seen on CLERK-03. He records the address, the lease and the time together, as in the earlier correlation of CLERK-03's address.

Leavers

Accounts of staff who left must be disabled promptly. Jonah compares the HR leavers list with active accounts and finds five still enabled; one signed in last month, which itself becomes a lead for Renata.

Worked example

Renata checks whether the same local admin password is used elsewhere. The city's configuration records show it was set identically on 140 desktops in 2019. She prioritises rotating all local admin passwords using a managed solution and searching other desktops' logs for admin logons in the same period.

Synthetic case. The configuration is invented.

Errors and limits

Identity logs show account use, not who was at the keyboard; shared accounts make attribution harder still.

Exercises

EX019 — Shared admin password. Why is one local admin password on many desktops dangerous? Rubric: 3 = one compromise exposes all; 2 = partial; 1 = convenient; 0 = none.
EX020 — Local log visibility. Why was the local admin logon only visible on CLERK-03? Rubric: 3 = local logons logged locally unless forwarded; 2 = partial; 1 = hidden; 0 = none.
EX021 — Expanding scope. What did the logon source reveal? Rubric: 3 = came from another desktop 10.20.4.12; expands scope; 2 = partial; 1 = vague; 0 = none.

Synthesis

Identity design determines how far an intruder can move and what evidence their movement leaves.

Continue studying — chapter 07 of 30

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →