Tiered administration model
Splitting Active Directory admin accounts and machines into sealed levels, so that a domain admin credential never lands on a workstation where an attacker could read it.
The tiered administration model organizes Active Directory admin accounts and machines into levels that never mix. Microsoft formalized it in three tiers. Tier 0 holds whatever controls identity for the whole company: domain controllers, federation servers, account management consoles, and these days the cloud identity provider. Tier 1 covers servers and applications, Tier 2 workstations and the help desk. The rule fits in one sentence: an account from one tier never signs in to a machine in a lower tier. The reason is mechanical. When a domain admin logs on to a laptop to fix someone's problem, the credentials stay in memory on that laptop. If the laptop is already compromised, the attacker picks them up and goes from workstation to domain in a single step. Incident response reports describe that shortcut in a large share of the ransomware cases that encrypt an entire domain. September 2023, MGM Resorts: according to the account the attackers published themselves, one call to the help desk was enough to get a reset, then super administrator rights on the Okta identity console. The help desk, Tier 2 by design, could reach Tier 0. Detailed questionnaires and ransomware supplements ask for admin accounts kept apart from email accounts, dedicated admin machines (PAW, Privileged Access Workstation) and a technical block on sign-ins across tiers. The evidence requested is often a screenshot of the group policies that deny those sign-ins. One caveat: plenty of companies report separate accounts and stop there. A separate admin account used from an everyday office laptop isolates nothing.
Textbook case, made-up figures: a distributor reports 12 domain admins. The questionnaire asks how many of them sign in to workstations. Answer: 9, because the same people also run Tier 2 support. The underwriter thinks in attack paths: across a fleet of 1,800 machines, one compromised laptop is enough if one of the 9 logged on to it that week. The underwriter sends a follow-up question on dedicated admin workstations and files the risk among those to which the market applies ransomware coinsurance.
tiered admin model, AD tier model, Active Directory tiering, Tier 0 isolation
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.