Efficient way to demonstrate the value in Active Directory security improvements?

Question

Working hard on Active Directory security in a corporate environment: getting rid of excess permissions, monitoring, patching, etc. Nothing comes free, and to keep the budget going, I need to somehow explain these improvements to the C-level. They like charts and quantifiable data, which makes this task easy for Sales, but difficult for us in IT Security.

The executives understand the phrase "decrease exposure to security risks", but this is obviously not enough. And I can't realistically take them to a room and show what's a pass-the-hash attack.

So, how do I demonstrate to the value in Active Directory security improvements?

Answer 1

You have two basic things you need to address:

1) Do you meet the current best practices for Information Security in your organization?

There are several good resources including the Microsoft Security Baseline Analyzer, and using resources such as NIST and SANS.

• If your organization is large enough for an AD environment, they likely need and should have insurance in case of data loss. Most insurance agencies require a certain baseline otherwise your SOL at claims time and good luck with litigation.

• Back to litigation, piss poor standards also set your organization up for negligence lawsuits from multiple sources. E.G Employee, Customers, Venders, etc. If the C-Level was made aware, did nothing, and tried to blame you or your team, you'd also have wrongful termination suit, etc.

2) What are your risks?

Information Security is very much like financial risks, you need to understand your goals, what's acceptable to your organization, and what you need to reduce. We tend to look at this through quantitative and qualitative risk.

To be frank, C-Levels don't really care about a specific attack being averted, they care about specific risk being reduced to manageable levels. For instance, you don't tell the CEO that you improved security by requiring and only using Third Party SSL certificates from verisign or wherever. You tell them you have reduced the risk of MITM attack and implemented policies to manage the risk. The third party certificates are quantitative representation of that risk and your servers which use it are its exposure.

BTW, this not trying to skirt around an issue or that your C-Level is to dense to understand SSL/TLS. It's communicating to them in the language they are familiar with and any good business person deals in risk.

For your particular example, making permissions easier is a technical function to reducing what risk:

• reducing provision issues which expose additional risk?
• exposing privileged information to unauthorized users?
• all of it?

These are the items they want to hear about, what changes you make are your data for reducing that risk, also this is an extremely simplified way of looking at this.

Answer 2

The best way to explain the value of a security enhancement to an IT person is to describe the attack(s) that the enhancement prevents.

The best way to explain the value of a security enhancement to an executive is to mention the attack(s) you are preventing and an estimate of the cost to your organization if the attack(s) were to occur, compared to the estimate of the costs to perform the enhancements.

Note that someone (perhaps the CFO) will inevitably want to know the likelihood of the attack(s) occurring if the enhancements are not done, in order to weigh the cost-benefit ratio of the enhancements. (Good luck figuring out that calculation...)