I had been looking forward to this vacation for months. Bags packed, plans made. Then the phone rang.<\/p>\n
A service provider in northern Europe had been hit by ransomware, and not in a small way. More than 50 Active Directory forests, belonging to the provider and its customers, were lost. Encrypted or destroyed, all at once.<\/p>\n
So the vacation was cancelled and I spent the following weeks helping to rebuild. I won\u00b4t go into details about the customer, but I can share some of what I learned.<\/p>\n
The attackers had come in through the provider\u00b4s own environment and from there they had access to every customer, because the provider\u00b4s admin accounts and management tools reached everywhere. One identity, one set of tools, fifty victims.<\/p>\n
Rebuilding one Active Directory after ransomware is a big job. Rebuilding fifty in parallel means you need a very clear order: which customers and which services come first, which domain controllers can be trusted, which backups are clean. And you need to make sure the attacker isn\u00b4t still there when you bring it back.<\/p>\n
The technical lesson is the one I have repeated for years. A service provider\u00b4s admin environment is Tier 0 for every customer it serves. It needs to be protected like that, separated per customer and monitored closely.<\/p>\n
I\u00b4ll take my vacation later. The attackers don\u00b4t check calendars.<\/p>\n","protected":false},"excerpt":{"rendered":"
I had been looking forward to this vacation for months. Bags packed, plans made. Then the phone rang. A service provider in northern Europe had been hit by ransomware, and not in a small way. More than 50 Active Directory forests, belonging to the provider and its customers, were lost. Encrypted or destroyed, all at […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4,13],"tags":[55,33,41],"class_list":["post-1267","post","type-post","status-publish","format-standard","hentry","category-security-architecture","category-technology","tag-active-directory","tag-incident-response","tag-service-providers"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1267","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1267"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1267\/revisions"}],"predecessor-version":[{"id":1290,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1267\/revisions\/1290"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1267"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1267"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1267"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}