The Practical ROI of a quick Active Directory recovery

data protection day, ROI
While every IT manager or administrator knows that a solid Active Directory recovery plan is an essential component of any business continuity strategy, calculating an optimised AD recovery plan’s practical return on investment (ROI) is notoriously tricky. Too many variables are at play to generate a defensible, exact calculation. And to set expectations upfront: I won’t offer any interactive ROI calculator here in this article. 
Instead, Sean Deuby, Director of Services, Semperis, looks at a few practical ways to see a return on your investment in ensuring a proper AD recovery, allowing you to do your own calculations and come to your own conclusions. Of course, losing one domain controller is a problem in itself, but let’s look at another increasingly common scenario that has catastrophic consequences: a ransomware attack that takes out every domain controller across all company sites. In that situation, recovering AD can be a white-knuckle, under-the-gun challenge. 

In the last year, we’ve discussed scores of ransomware attacks where cybercriminals modified AD in one way or another — far beyond the basic changes to user accounts or passwords — to gain entry into information systems and move laterally to propagate malware. Ransomware architects now have engineers on staff dissecting AD and its security updates, looking for opportunities to elevate permissions and quickly distribute malware across the entire organisation. Post-attack forensics from previous ransomware attacks involving AD have revealed that threat actors primarily focus on changes to group accounts, user accounts, Group Policy objects, the SYSVOL, and domain controllers. With these cybercriminal tactics in mind, consider the following factors in calculating your own AD recovery ROI: Cost of operational losses. 

A material part of your operations likely relies on AD being up and running to authenticate users as the basis for providing access to applications, systems, and data. For every hour that AD cannot operate, how much revenue or productivity would your business lose? How many hours, days, or weeks would it take before the business passes a point of no return and cannot financially recover? Remember the ransomware attack on the City of Baltimore? Their recovery of operations took months and cost over US$18mn.

Lack of a business continuity plan that includes AD 

If your organisation is mature enough, you have a BC/ DR plan in place defining the work needed to restore business operations after an outage. Most plans account for loss of infrastructure or loss of a location after a natural disaster. But few companies have a plan specifically for restoring business after a cyberattack, especially one as unpredictable as a ransomware attack. The way you recover AD in a scenario like this depends on what changes cybercriminals made within AD. You might plan to recover AD back to a previous version, but how do you determine how far back you need to go to find a known secure version? What AD-dependent systems, services, and applications will be affected or won’t function at all because of a broad-stroke recovery to an earlier AD state? Are you confident that you can even locate a recent, malware-free backup from which to restore? Without a plan or an ability to understand what was changed in AD before recovering, your organisation will spend incalculable time fixing all the problems the recovery caused. 

Recovery might not be the answer 

If all the changes being made by the bad guys during an attack boil down to, let’s say, adding an account to the Domain Admins group, then recovering AD to a few days ago or last month might not be the right answer. Instead, perhaps the less costly method is to monitor changes in AD and have the ability to either disallow changes to “protected” accounts (like the Domain Admins group) or to revert a change to a sanctioned configuration automatically. 

The considerations above summarise to three risks: 

1.The risk of a slow recovery

2. The risk of a recovery that creates more remediation work

3. The risk of a recovery that might be considered overkill for the nature of the changes made to AD.

Instead of looking at the ROI of AD recovery using some calculator you found online, the better choice is to work through several real-world scenarios and evaluate how your current means of AD recovery would fare. This can be done by answering the following questions based on the factors outlined above: 

• What critical parts of the operation depend on AD to function? What is the estimated cost of their downtime? 

• How long will it take to recover AD based on the changes made during an attack

• Do you have visibility into what malicious changes were made in AD and, if not, how far back will you need to investigate and how long will that take you? 

• Will the recovery impact any other parts of operations that you will need to fix and, if so, how long will that take? (Remember that some number of both user and computer account passwords will not match, impeding the ability to log on to the domain. Plus, earlier versions might be missing accounts, group memberships, DNS records, etc.) 

• Are you confident that recovery will put you into a known-secure state? Beware of the difference between resuming business operations and recovering business operations: If you don’t have a clean, malware-free backup from which to recover, you run the risk of reintroducing the same vulnerabilities that left you open to attack in the first place. 

In short, the ROI of AD recovery has much more to do with your current ability to recover to a known-productive and known-secure state post-attack than it does with an online ROI calculator that doesn’t account for the myriad variables involved in a ransomware attack. By walking through some scenarios and thinking specifically about your current recovery abilities, you will expose costs that can be eliminated by having a proper AD recovery solution in place—one that is designed to protect against, prevent and recover from malicious changes AD.


About Semperis

For security teams charged with defending hybrid and multi-cloud environments, Semperis ensures integrity and availability of critical enterprise directory services at every step in the cyber kill chain and cuts recovery time by 90%. Purpose-built for securing Active Directory, Semperis’ patented technology protects over 40 million identities from cyberattacks, data breaches, and operational errors. As a result, the world’s leading organisations trust Semperis to spot directory vulnerabilities, intercept cyberattacks in progress and quickly recover from ransomware and other data integrity emergencies. Semperis is headquartered in New Jersey and operates internationally, with its research and development team distributed between San Francisco and Tel Aviv. Semperis has released its Active Directory Security Halftime Report. The report will be updated on a periodic basis to serve as a timely, concise index of resources for organisations that have prioritised hardening their Active Directory and Azure Active Directory defences against escalating cyberattacks.

For more news from Top Business Tech, don’t forget to subscribe to our daily bulletin!

Follow us on LinkedIn and Twitter

An image of ROI, Security & Data, The Practical ROI of a quick Active Directory recovery

Amber Donovan-Stevens

Amber is a Content Editor at Top Business Tech

What will gaming look like when it goes into the...

James Ponter • 08th July 2022

One of the biggest hurdles in cloud gaming is the reluctance of ‘gamers’ to adopt the system, but developers and tech giants aren’t slowing down their move to the cloud. So, what is cloud gaming? How can we expect the landscape to look in a few years? And most importantly, what are the limitations? By...

The cost of living crisis.

TBT Newsroom • 29th June 2022

What Communication Service Providers can do to help their customers cope with the cost-of-living crisis. We’re all familiar with the rip roaring marketing slogans of our U.K. Communication Service Providers – ‘together we can’, ‘The future is bright’, ‘It’s all about you’…but sadly, these no longer appear to ring true for the millions of consumers...

Thriving In The 5G Era.

TBT Newsroom • 26th June 2022

As consumer demand rises, and network availability expands, 5G is becoming more viable for widespread use — by 2027 it’s expected to cover 75 per cent of the world’s population. However, it’s still no secret that 5G uptake is dawdling and many enterprises still aren’t enjoying its benefits.

Why Low-Latency Is So Important.

TBT Newsroom • 23rd June 2022

Consumer interest in 5G technology has been fueled by the arrival of glamorous, speedy handsets such as Apple’s iPhone 12, with 5G networks now rolled out to many towns and cities across the country.