My previous post was about resetting the krbtgt password, a simple maintenance task that few organisations do. It is just one example of many.<\/p>\n
Active Directory and other core systems need regular maintenance just like a car does. Resetting krbtgt. Cleaning out old accounts and computers. Reviewing privileged groups. Removing old trusts and old domain controllers. Updating the functional level. Testing the restore of a domain controller. None of it is difficult. All of it takes time, and in a small IT team that time is always needed for something else.<\/p>\n
So it is skipped, year after year. Nothing happens, so it seems fine. Until the day of an incident, when the skipped maintenance becomes very expensive. Unknown accounts the attacker can hide behind. A krbtgt password that hasn\u00b4t been changed in ten years and that nobody dares to reset during the crisis. A restore procedure that has never been tested.<\/p>\n
In incidents I have worked on, the lack of basic maintenance has added days, sometimes weeks, to the recovery. At the price of a full business standstill, that is enormous compared to the few hours a month the maintenance would have taken.<\/p>\n
So for management: ask for a maintenance plan for your core systems, and protect the time to do it.<\/p>\n
Maintenance is cheap. Emergency repairs are not.<\/p>\n","protected":false},"excerpt":{"rendered":"
My previous post was about resetting the krbtgt password, a simple maintenance task that few organisations do. It is just one example of many. Active Directory and other core systems need regular maintenance just like a car does. Resetting krbtgt. Cleaning out old accounts and computers. Reviewing privileged groups. Removing old trusts and old domain […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,4],"tags":[55,38,133],"class_list":["post-1382","post","type-post","status-publish","format-standard","hentry","category-business","category-security-architecture","tag-active-directory","tag-business","tag-maintenance"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1382","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1382"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1382\/revisions"}],"predecessor-version":[{"id":1407,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1382\/revisions\/1407"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1382"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1382"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1382"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}