How a key DOD agency protects digital identities 

Security professionals are often asked to name the most important element of securing an environment. While firewalls, antivirus software and other perimeter security measures are still necessary, user identification, authentication and privileged identity/access management have increasingly emerged as the most pivotal aspects of cybersecurity.

Government agencies are high on the list of cyber adversaries’ targets. If attackers can disguise themselves as a legitimate users at a federal agency, they can cause extreme disruption and exfiltrate data that involves federal employees, partners and constituents.

One Department of Defense agency recognized that the key to creating a strong security footprint was to secure identity and access controls for its privileged users -- such as network administrators -- and create a system that prevented lateral movement and unauthorized privilege escalation. The case study offers rare insight into how protecting privileged users truly works in the public sector.

The DOD’s privileged identity problem

In the late ‘90s, DOD adopted a chip-enabled common access card (CAC) that supported public-key infrastructure credentials as its standard identification credential. As digitalization evolved in the early 2000s, the department began to replace usernames and passwords with these “tokens” for stronger authentication.

In 2005, DOD mandated the use of the CAC for initial user workstation authentication across the entire network, as well as for web-based applications. While the use of a token dramatically increased the security of initial logins, privilege elevation by administrators was still accomplished with plain-text usernames and passwords.

Unfortunately, due to the sheer number of privileged accounts, there was no standardized approach to managing them, and it was clear that the lack of control was expanding the agency’s attack surface. Using a sheet of paper with a list of shared passwords to grant privilege meant there was also no easy way to track access removals or replacements every time an employee left the job. With former employees still able to access sensitive information, the risk exposure was multiplied.

If adversaries were able to penetrate any of the administrative workstations, they could mount a “pass the hash” attack. During these attacks, a hacker captures a password hash and then simply passes it through authentication. An attacker could then escalate privilege and move laterally across the network, potentially to mission-critical servers and applications.

These attacks have been significantly mitigated with Windows 10, but variants still exist today. Government agencies have adversaries willing to spend thousands to millions of dollars and take their time to exploit any control gap they find in the system.

After an audit of the entire process, the U.S. Cyber Command issued a communications tasking order that identified the privileged user access issue, described the actions required to address it with the appropriate deadlines and began the process of implementing a reporting structure for compliance. The security and engineering teams for the agency were put to work to find a quick and effective solution.

Protecting DOD privileged users

The DOD agency in question had dozens of disparate Microsoft Active Directories as well as local account stores in many systems, with an entirely separate infrastructure to support Linux servers. Any time a user needed privilege on any one of those systems, a new login credential was created. Administrators often needed access across multiple systems, resulting in a multitude of privileged logins and poorly audited, poorly controlled accounts. The identity sprawl prevented the agency from understanding the extent of privileged user access.

The individuals tasked with building the solution knew that one of the most critical requirements was to centralize all of the account information and identities associated with authentication and knew they needed a third party to help.

With assistance from its vendor partner, DOD successfully combined the disparate identity repositories into one centralized, bridged Active Directory, which became the single “source of truth” for storing privileged user accounts and their entitlements. The solution also enabled authentication for Linux servers, further reducing the number of privileged accounts.

Today, the agency’s employees are provisioned into the Active Directory once. If they must elevate privileges, they are provisioned and deprovisioned quickly and easily with minimal human intervention. The process allows a stronger security foothold and also results in considerable cost savings.

DOD has also updated its infrastructure to include identity synchronization, where the authentication infrastructure connects to master personnel databases. When employees leave for any reason, the database is updated and synchronized to Active Directory, which immediately and automatically eliminates all of their privileged user entitlements.

Digital identity security must be a top priority for all federal agencies. While adversaries will continue to attempt to penetrate boundaries using credential-based attacks, it is encouraging to see agencies like the DOD taking the appropriate steps to thwart attackers through a centralized identity and least-privilege approach. Hopefully other agencies will soon be inspired to follow in their footsteps.