Enterprise identity: measuring privilege paths and tiered administration
You graph directory relationships in the lab domain and measure the privilege paths to critical assets; you close them with tiered administration, privileged access workstations and time-bound admin access, and review hybrid identity and the recovery plan.
Level 501 · 14 lessons · 12 practice labs
Lessons
Privilege paths
- Privilege-path graphs: who can reach whom, and how
- Collecting directory relationships and graphing them
- Critical assets and the paths that lead to them
- Short task: find the three shortest paths to domain-admin rights
Closing
- The tiered administration model
- Privileged access workstations
- Just-in-time, time-bound admin access
- The Protected Users group and authentication policies
- Short task: close three privilege paths and regenerate the graph
Hybrid and continuity
- Hybrid identity: cloud directory sync and its risks
- Continuous directory assessment and scoring
- The directory recovery plan and backups
- The identity risk report for management
- Capstone: apply tiered administration to an organisation’s identity infrastructure and close its privilege paths
Practice labs
- Collect directory relationships and graph them: Collect membership, session and permission data from the lab directory, load it into the graph tool and mark critical groups.
- Find the three shortest paths to domain admin: Extract the three shortest paths with a graph query and name the weak link in each.
- Close three privilege paths and regenerate the graph: Fix the permission, session and membership issues on the paths, recollect and show the paths are gone.
- Assign assets and accounts to admin tiers: Split servers and accounts in Yelkovan Bankası's lab inventory into tiers 0, 1 and 2.
- Block cross-tier logons by policy: Apply policy stopping higher-tier accounts logging on to lower-tier machines and verify with a test.
- Apply the Protected Users group and authentication policies: Add admin accounts to the group, set a policy allowing logon only from the privileged workstation and test it.
- Audit a privileged access workstation's settings: Check internet access, local admins and app restrictions on the workstation and fix the gaps.
- Set up just-in-time admin access with timed group membership: Add a timed membership to an admin group and confirm the right drops when time is up.
- Convert standing admin rights to timed access: List standing privileged memberships, move them to timed access and report the drop in permanent admins.
- Produce a continuous assessment score for the directory: Produce a score from account, permission and protocol checks and list the five items costing most points.
- Audit the cloud directory sync account's rights: Extract the sync account's directory rights and synced object scope, and narrow the unneeded scope.
- Test the directory recovery plan and write an identity risk report: Test restoring a single object from backup, update recovery steps and prepare a one-page identity risk report.
About this course
You graph directory relationships in the lab domain and measure the privilege paths to critical assets; you close them with tiered administration, privileged access workstations and time-bound admin access, and review hybrid identity and the recovery plan.
What you will learn
- Privilege paths
- Closing
- Hybrid and continuity
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.