Privilege Zones

Beyond Tier Zero

Tier Zero is the top of the pyramid, but it isn't the only thing that matters. The servers that run the business, the finance and HR applications, the hypervisors and backup systems: an attacker who reaches them can do serious damage without ever becoming a Domain Admin.

The classic tier model already says so: workstations shouldn't be able to take over servers, and servers shouldn't be able to take over the domain. A Privilege Zone turns that rule into something you can measure.

Tier Zero        domain controllers, Domain Admins, CA servers, ...   (automatic)
  └ controls everything below
Zone: Tier 1     member servers and their administrators               (you define)
Zone: Finance    finance servers, databases, service accounts          (you define)
Everything else  workstations, standard users

Two rules follow:

• Tier Zero is never part of a zone. It already sits above every zone.
• Reaching Tier Zero counts as reaching every zone. Whoever can take over Tier Zero can take over the zone, so zone exposure includes Tier Zero exposure.

What each zone gets

• Exposure: how many users and computers outside the zone have an attack path into it.
• Protected objects: how many of the zone's objects no attack path finding leads to, out of all of them.
• PW-022 findings: every account or group outside the zone that directly controls a zone object.
• On the command line, a plan for the zone: pathwarden plan --zone NAME gives the fewest changes that cut every path into it. The report and the app work out the remediation path for Tier Zero only.

Defining a zone

Zones live in pathwarden.toml, built from objects, groups (with nested members) and OUs (with everything below them):

[[zone]]
name = "Tier 1 servers"
groups = ["TIER1 SERVERS@SCALE.LOCAL", "TIER1 ADMINS@SCALE.LOCAL"]
ous = ["OU=SERVERS,DC=SCALE,DC=LOCAL"]

Prefer not to edit files? The app's Zones page has a wizard: search your latest analysis for users, groups, OUs and GPOs, add each one on its own, as a group with its members, or as an OU with everything below it, and watch a live preview of what the zone resolves to. Its Explore page also suggests Tier 1 and Tier 2 candidates from the shape of your directory.

Good first zones

• Tier 1 servers: member servers and the team that runs them. Paths from workstations into servers stand out at once.
• One crown-jewel application: its servers, service accounts and application admins.
• Hypervisors and backup: if they host or back up domain controllers, they belong in Tier Zero instead.

The full guide covers membership rules, checking the result and common mistakes: Configuring Privilege Zones.

References

• SpecterOps BloodHound docs: Privilege Zones
• Microsoft: Enterprise access model