NSA Top Ten Cybersecurity Misconfigurations: An Active Directory Perspective

Final part of the CISA/NSA top-ten misconfigurations series from an AD perspective: misconfigured ACLs on shares, poor credential hygiene, and unrestricted code execution, with IOEs and IOCs.

Part 2 of the CISA/NSA top ten misconfigurations series for hybrid AD: flat networks, poor patch management, bypassed access controls, and weak MFA—explained with identity risks, IOEs, and IOCs.

Twelve AD security best practices: minimize privileged users, secure admin accounts, modern password policies, disable SMBv1, restrict NTLM, plan recovery, use SID filtering, and monitor activity.

AD security primer: AD holds the keys to most on-prem apps; top risks include unconstrained Kerberos delegation and over-permissioned users. Includes hardening best practices.

Why unconstrained delegation is among AD's worst security gaps: it lets a computer store users' Kerberos tickets and impersonate them, making it a prime target; removing the setting eliminates a weak link in trusted authentication chains.

Key takeaways from the NSA's ten cloud security mitigation strategies, spanning shared responsibility, identity and key management, network segmentation, data protection and CI/CD security.