A featured contribution from Leadership Perspectives, a curated forum for enterprise technology leaders, nominated by our subscribers and vetted by the CIOApplications Editorial Board.

Metropolitan Water District of Southern California

Breaking Up is Hard to Do: Is it time to Separate Domain Joined Machines from Active Directory?

Most of us have experienced a time in our life when a relationship has run its course, and due to some circumstance or irreconcilable differences, we end the relationship. It is no small emotional feat to break up a relationship with another person, and the aftermath can be painful. I think what may make breaking up most difficult is that more times than not, we actually see the breakup coming. This is not to say that we see it coming when we are in the midst of our relationship woes, but when we look back with the benefit of hindsight, we realize that we should have, or we actually did see it coming. The signs were there all along. There were problems, and we just accepted them because, at the time, we did not contemplate alternatives, or the alternatives seemed more difficult or painful than the problems we faced. This latter situation seems to be analogous to our relationship with Active Directory and windows-based end-points being members of our domain. I know what you are thinking; that was a big leap and subject change. You would be right, except that our end user computing relationship with Active Directory and our corporate resources is like a bad relationship we still cling to because the structure of Active Directory and Windows domain joined machines is what we have known and has worked for us for many years despite what we know about the problems because we often don’t contemplate the alternatives.

How bad is this relationship? Well, first off, think of the number of network compromises that started at the compromise of an end-point computer. It is pretty well established that any domain-authenticated user can view SYSVOL, and it is a share that can be reached from a domain-joined system. This is problematic because SYSVOL is a domain share that contains group policy information, logon scripts, and other information that is exchanged between other Active Directory Domain Controllers. If you are concerned about this information being so easily accessible, you would be correct to be so concerned. There are other issues that can lead to credential theft as well, such as local machine-cached user credentials. Also, end-user machines can be compromised by account takeovers, and if they access Active Directory, the attacker can browse and gain access to a number of sensitive objects within the systems. I know this sounds like a bunch of what-ifs, but it is actually pretty commonplace that Active Directory is exploited as part of many cyber attacks.

This is not to say that Active Directory is all bad or that it does not possess many security features that serve to protect the enterprise. It is just that the end user workstation represents a significant part of the attack surface, which is easily exploited by attackers and provides a jumping-off point into the enterprise networks where an attacker can cause real harm from their malicious efforts. So, we can see the signs are there. There is an unhealthy relationship between our cybersecurity posture, Active Directory, and the end-user computing environment. But like a bad relationship, we are attached to Active Directory and its functionality, or maybe we are attached because it is all we know.

Active Directory is not all bad. It provides Group Policy features, provides excellent central management of security policies, can store encryption keys, and provides an excellent security boundary to internal on-premises systems, and it is easy to synchronize identity with various cloud environments. But is it really needed? That answer would be, “it depends.”

Whether or not one needs to have Active Directory, as it is traditionally, or rather typically deployed, in their environment is a matter of examining how many and what cloud services and environments are being used by the organization, how many users, what type of internal resources are needed to be accessed remotely, and just how users work day-to-day. For example, are users still dependent on file shares and mapped network drives to collaborate or store information? If so, then Active Directory will still be needed for those transactions, or at least Active Directory makes managing such working environments much easier. If employees rely more heavily on cloud environments with all collaboration tools, email, and shared files exchanged via the cloud, then the answer would probably be no Active Directory is not needed as much. But in most cases, the answer is somewhere in the middle. Organizations typically have a significant amount of resources for work and collaboration available to employees through cloud environments, with a handful of legacy applications that still live on-prem or in co-lo data centers. So divesting from Active Directory becomes a bit more difficult.

Maybe the breakup with Active Directory is not necessary – at least at first, and like a problematic relationship, boundaries are set. Active Directory needs to have space from the end users. In this case, then we focus on the end users’ environment for security. Do we need the end users’ environment so entwined with Active Directory? Given how most organizations have a mixture of cloud and on-prem services, the answer would be surprisingly – no. Also, given how many of Active Directory’s problems come from end-user access, and the answer should be clearly – no.

But like a bad relationship, we are attached to Active Directory and its functionality, or maybe we are attached because it is all we know.

End users do not need direct access to on-prem resources and certainly do not need domain-joined machines to access cloud and internal resources. Gartner has provided a wealth of information on the Security Service Edge (SSE). This, in short, is a collection of cloud-based security products or services that facilitate access to both cloud-based and on-prem resources. Assuming the SSE is already constructed, then there is actually no need for users to have domain-joined computers to access resources that are both protected with and in the cloud or to on-prem applications and data to which access is controlled by Active Directory authentication and permissions. Again, it all depends on how the organization builds out its SSE.

A matured SSE provides for Zero Trust Network Access (ZTNA), and often the capabilities that are orchestrated to form the SSE are Secure Web Gateways (SWG), Cloud Access Security Brokers (CASB), and Cloud Firewall services. Cloud-based security used in this manner can strictly enforce access by geolocation, Multi-factor Authentication (MFA), and other security features that are easily deployed.

The posture of end-points can be checked before they are granted access. Finally, by distancing the end user’s computing environment from the network to the outer edge, the footprint on which an attacker can start a malicious action is reduced, and lateral movement becomes more difficult.

Removing computers from the domain does not mean the organization loses control; many end-point management solutions can be deployed as part of the cloud security environment to apply patch management, access control, and user access policies to a computer or other mobile device. These capabilities also allow an organization to realize the benefit of not being limited to just Windows machines or even Apple computers. Access can be granted for tablets and even Chromebooks with no negative impact on user productivity. This could allow organizations to expand bring-your-own-device programs, resulting in significant cost savings in hardware maintenance. Again, this is all just food for thought.

Maybe your relationship with domain-joined computers is good, or the organization’s security measures, Active Directory, and end-user computing environment is a happy story without any problems. I would suspect this is not the case and that, like a problematic relationship, there is a fair amount of denial over the security problems presented between the combination of Active Directory and the end user computing environment. But that is a decision only the organization can make if the pain points caused by the security risks are less problematic that changing how employees access corporate resources. At least now, an alternative to a more traditional end-user computing environment can be contemplated.

The articles from these contributors are based on their personal expertise and viewpoints, and do not necessarily reflect the opinions of their employers or affiliated organizations.