CyberGaud
Menu

Practical identity security guides

Short, field-tested checklists you can use this week. No email required.

Six signs your privileged access has sprawledChecklist, 4 minute read
  • More people are in Domain Admins than you can name from memory.
  • Service accounts have passwords that haven't changed in over a year.
  • Admins use the same account for email and for server work.
  • Local admin is granted by default on laptops.
  • Your PAM vault exists, but admins still log in directly.
  • No one reviews who has privileged access on a schedule.

If three or more sound familiar, start with an account inventory and a separate admin account for each administrator.

What counts as Tier 0?Reference, 3 minute read

Tier 0 is anything that can control your identity system. If it's compromised, everything is. It usually includes:

  • Domain controllers and the accounts that administer them
  • Directory sync servers, such as Entra Connect
  • Certificate authorities (AD CS)
  • Your PAM vault and its administrators
  • Backup systems that can restore domain controllers
  • Federation servers and identity provider admins

Anything that can manage a Tier 0 system is also Tier 0, including the management agents installed on it.

Choosing phishing-resistant MFAGuide, 5 minute read

Push notifications and one-time codes can be phished or fatigued. Phishing-resistant methods bind sign-in to the real site, so a fake login page gets nothing useful.

  • FIDO2 security keys: strongest option, ideal for admins.
  • Passkeys on managed devices: strong and easy for most users.
  • Windows Hello for Business and platform authenticators: good for company laptops.
  • Certificate-based authentication: works well where smart cards already exist.

Start with privileged users and anyone with access to finance or customer data, then expand.

Five questions to ask before an AD recoveryChecklist, 3 minute read
  1. Do you have offline or immutable backups of at least two domain controllers per domain?
  2. Have you restored a forest in an isolated lab in the last year?
  3. Who has authority to declare an identity incident?
  4. How will admins sign in if AD and SSO are both down?
  5. How will you confirm the restored directory is free of attacker persistence?