How weak passwords and other failings led to catastrophic breach of Ascension

A deep-dive into Active Directory and how "Kerberoasting" breaks it wide open.

See full article...

 

[jdhardy]

I haven't worked as a Windows sysadmin in 15 or so years, as my first "real" job, and I knew even then that NTLM was insecure. There was plenty of guidance from Microsoft on how to secure AD properly and avoid all of these problems. Any competent, properly-resourced IT department would have been able to do this, which strongly implies senior leadership didn't consider it to be a priority (let me guess, offshored IT handed out to either the lowest bidder or the CIO's nephew...).

Maybe jail time for CEOs whose companies fuck up this badly would prevent some of these issues, but somehow I doubt it.