Active Directory 安全：有時候真實比小說更加荒誕
Windows AD 一直都是讓大家又愛又恨的東西，一方面由於高市占率的關係，各家廠商、各式軟體都搶著與它相容，另一方面許多新舊服務都依賴與它的整合，在複雜場域下雖相得益彰，但維運人員過於依賴的狀況下解耦困難，導致維運上面有些安全性設置不敢動手。而由於這些問題及歷史性因素，過往我們也發現這些場域時常躲藏了許多地下網管 (Shadow Admins)，伴隨著近年來 AD 安全性問題層出不窮，企業安全往往牽一髮而動全身。
這次的演講中，我們會帶來與往年不同的 AD 安全議題分享，選出實際分析過的企業案例中誇張的錯誤範例，並進行技術細節分享，例如：沒有做設定檢查、缺乏帳號與資源間的權限盤點、被忽略的核心資產、因實作權限分隔卻導致更多的安全問題。最後，我們將依據這些 AD 場域的資安程度做分類，以提供會眾了解自己企業 AD 的相對安全程度，透過實際案例反思自己還能做哪些事情來加強 AD 場域的安全。
John Jiang
John Jiang is a cybersecurity researcher at CyCraft Technology and is currently focused on incident response (IR), endpoint security, and Active Directory (AD) security. He has investigated multiple domestic and foreign APT-level security incidents and continues to perform in-depth analyses of attacker techniques and detection methods. He is an active member of the international cybersecurity community and has spoken at multiple conferences, including Black Hat USA, HITCON, and HITB. He is also the co-founder of the Taiwan cybersecurity organization UCCU Hacker.
Boik Su
Boik Su is a cybersecurity researcher at CyCraft Technology and is currently focused on cloud security, AD security, web security, and threat hunting. He takes an active role in the cybersecurity community and has delivered speeches in multiple seminars across the globe including HITCON, ROOTCON, and HackerOne. He still participates in CTF competitions including SECCON CTF in Japan and HITCON CTF in Taiwan and has submitted multiple reports to bug bounty programs and open-source projects.