How should I protect domain joined hosts in the same AD domain from the Related Domain Cookie Attack?
Suppose there is an AD forest called
example.com. This company has a variety of internal and external web applications:
- store.example.com (customer facing)
- partnerPortal.example.com (internal/partner facing)
- payroll.example.com (internally facing)
The forest also has workstations on the same domain
workstation001.example.com ... etc.
Would it be a security risk to have end users and servers under the same shared domain? Keep in mind that most AD deployments fall into one of these configurations:
Forest/Domain Name External DNS Name Vulnerable to Related Domain Attack Contoso.com Contoso.com Yes AD.Contoso.com Contoso.com Yes Contoso.Local Contoso.com No
What is the best way to mitigate this?