Name: Rubrik Workshop: Identity Resilience
Uploaded: 2025-08-14T20:02:26.455Z
Duration: 56 min 17 s
Description: Rubrik Workshop: Identity Resilience

Transcript for "Rubrik Workshop: Identity Resilience": Welcome to this Rubik workshop, the first Rubik workshop, in fact, on, on identity resilience. So, as Chase says, hopefully, you've managed to catch some of our other identity resilience week, events. I think they're available on demand, so they're, again, in the docs. If you follow if if you click that link, it should take you to the page. You should be able to, catch up on some of those. So as as Jade said yesterday, we had a bit of a a bit of a session, with with, a couple of our subject matter experts. They kinda went through a little bit of an explanation. I'm gonna run through a similar kind of explanation as to what identity resilience is and why we believe, it's needed in the current threat landscape. And then they kind of ran through a little bit of a demo. And the good thing is, once we get to that point in this session, we basically just let you loose, and you can go you can go and click around and and play in the product yourself. So, hopefully, this is all gonna be super, super fun. I should now, I'm not planning to stop as we go for the q and a, but, you know, if you do have any questions, please do drop them in the q and a. Once we get to the point where we can let you loose in the labs, I'll I'll just kind of address the questions live. That seems to be how how it works best for these, for these events. So, yeah, all good. So with all that said, I make that five pass that hopefully most of the people who are joining have joined. Now let's get moving. So just a quick introduction. As Chase said, my name is Kev Johnson. I'm a, staff technical marketing manager here at Rubrik. I've been focusing on our security products for probably the last two or three years, but now I'm really, really focused on identity, both recovery and resilience. And, you know, I'm here to kinda talk to you about why these things are important and why I'm super excited to be, leading the tech marketing drive there. So if you've not been to one of these sessions before, we kind of try and keep the slide well on the on the on the download a little bit. We try to keep it a little bit fun. We want to make it interactive wherever possible. So, yeah, again, please do drop your your questions in there. So I'll cover why, why identity is important in the, in the current threat landscape. We'll talk about some of the challenges for recovering identity services. So one of the really important things that I need to be clear about right now is identity resilience includes our already existing identity recovery products. So it's kind of like a superset. So you get identity recovery as well as all of the goodness with identity resilience. So we need to be able to recover if the absolute worst thing happens, but identity resilience is really all about, you know, what can we do to prevent that or at the very least, reduce the risk that you're gonna need to go through that recovery process. We'll then kinda go through a little bit of the the anatomy of an identity attack and see, you know, see if we can kind of identify where in the kill chain we might be able to stop these things before they get to something that's service impacting, for example. I'll then walk through a brief introduction to identity resilience from from Rubrik, and then we'll we'll kind of let you in off in the labs. And I'll kind of cover off the q and a as we go through the labs. So just checking in. I will be keeping an eye on the q and a just to give people a nudge because the worst thing that can happen is we get to that that section, and nobody's asked any questions. And then I have to start telling jokes or juggling. I can't juggle, and I don't really have any good jokes either. So, we'll try and avoid that situation. Okay. So the threat landscape, everyone knows how things are happening. We're seeing attacks like Scattered Spider, those guys, they keep they get mentioned on the news all of the time, whether they've all been arrested or not. Who knows? But we can't just expect that they've ceased operations. So over on the right hand side of the screen here, what we're seeing is a pattern that has been going for as long as I've been in the industry. I've been working in tech for, I'm gonna say north of twenty five years. I don't really wanna go too much further than that because that might let people know just how old I am. But as long as I've been in the industry, we've seen this kind of space race between cybersecurity organizations and the, you know, the threat actors. So we see cybersecurity spend goes up. Okay. Attacks go up. And they keep going up and up and up. And the worst thing is they're getting they're they're being successful as well. So it's not just that attacks are happening and they're being rebuffed. Attacks are being super successful. So, again, just just kind of, like, pulling pulling back onto the the other stats we've got here. So according to an IDSA report recently, ninety percent of organizations that they surveyed had experienced an attack that was identity related. So it involved identity in some way, shape, or form within the previous twelve months. So, basically, that's that's pretty much everybody. 90%, even nine ten nine tenths of people out there or organizations out there. Fifty percent of organizations surveyed by Security Boulevard say they had had an attack that specifically impacted on active directory. Now, obviously, Active Directory isn't the only identity provider out there, so we're gonna talk a little bit about some of the other capabilities out there as well. But, yeah, in the last two years, fifty percent experienced an AD attack in the last two years. Another another stat that I don't have on here, but we it's, it's called out in our recent Zero Labs report, that we we some some of the some of the stats that we've got there are done through research in conjunction with Microsoft. And Microsoft were, at the point that we we, we launched that report, they were rebuffing 600,000,000 identity based attacks on Entra ID every single day, which is honestly, is it's an insane number of attacks. Those are the ones that they're rebuffing. You know, I'm not saying that they're getting all of them, but, again, we're still seeing attack as being successful. So if we if we kinda think about identity providers, so identity services, you know, traditionally, we think, you know, in in in the on premises world, we think about the directory. In the cloud, we might think of, on for ID, for example. And there's obviously that hybrid story there as well. So a lot of organizations have both. So they're then they might be typically or primarily on premises, but they're also using Microsoft three sixty five. Now you can't entitle your on premises AD users to m three sixty five. They have to be existing in Entre. So we do things like Entre Connect, EntreSync to to provision those users into Entre, or, you know, and and things like Okta as well. So once all of those users once once these services are there, they're kind of the keys to the kingdom. So if we if we think, you know, something bad so let's say, for example, you've got you've got one of your users, maybe even a privileged user that has a weak password. It gets discovered in a password stuffing attack. That's that's that's one easy way that an attack can get into your organization. If that's a privileged user, you know, they they could they could potentially be domain admin very, very quickly with basic privilege escalation things. If we think about nonhuman identities, so things like service accounts, things like secrets, API keys, things like that, those things get leaked all the time. You know, I I I must see stories maybe once every couple of weeks, where there's been hard coded API tokens, in GitHub repositories or, you know, or any any of these kinds of things. All of these things can lead to an attacker being able to compromise your identity provider. And if they do that, well, it doesn't matter that all of your applications, your SQL Servers, all of your e c two instances, all your virtual machines, all of your m three sixty five, it doesn't matter that that stuff is all up and running because you cannot authenticate to gain access to it. So those those services are effectively down. It's something that's really worth bearing, man. That that is the real kind of single point of failure that can take everything down. And we don't wanna see that thing happening, do we? So we just kinda take a step back and, you know, assume that the worst has happened. An attacker has got in, they've been able to compromise active directory, and now, you know, you you you need to be able to recover that to a clean point in time. So here's the fun thing. This is not simple. If you have, even if you have a fairly simple organizational structure, you know, maybe maybe two or three demands, within your forest, putting all of that stuff back together is it's it's a mess. I've done it twice in my life. Once with a bunch of guys with, guns stood around me who were not very happy about the situation. It was a legitimate, customer. They were a a a military customer that I was I was doing some consulting for. But, yeah, their active directory had been taken down, not by ransomware or anything like that. It was good old human error, but we needed to recover the entire forest. And, yeah, all of this stuff, you better hope you memorized it as well because chances are you won't have Internet connectivity because all of your systems are down. So do not recommend doing this, especially for the first time. So if you're gonna do it for for funsies, carve yourself out a couple of weeks. Just make sure you turn your phone off and then, you know, work through all of the documentation. The documentation is amazing, but the processes involved are incredibly complicated, and you need to get them right in the right order. You skip a step, it's not gonna be a nice day. So let's assume we've got some backups. We're taking backups of, in this case, Active Directory. So if we look at a life a a day in the life or a life in the day of of of an IAM admin or an Active Directory domain admin, you are responsible typically for, you know, you're you're responsible for making sure that active directory is up and running and everyone's in the right groups and that the right proxies are applied and all of this good stuff. Maybe if you're really good at your job, you'll be thinking, hey. What happens if, what happens if someone takes down Active Directory? What what what do I do to, to bring things back up so my business can function and I continue to have a job? So what you do is you say, hey. I need to take I need to at least take a backup. So you might be using, the Windows Server backup admin tool. So that's that's a free tool that's included, with Windows Server. You can use that to take a backup, a system state backup, and you can use that to recover, in the event of, the worst happening. One of the challenges on that front is it's it's great for, you know, being able to stand everything back up. But if you need to do something like granular recovery, once it's gone out of the recycle bin, once the tombstone lifetime's gone, it's kind of a mess. So maybe you invest in a point solution. They can do things like granular recovery. So that takes a backup. It generates this this backup file, and, typically, it writes it to a volume on the server that the point solution is installed to. Now that's no good to you because if that point if that server is compromised, if it's a virtual machine, it gets encrypted, if, if an attacker is able to delete those backups, you don't have backups. So you go, hey. Okay. What we'll do is we'll write it to a network share. That that'll solve the problem. We can put it on a network share, and then if the point solution is is taken down or if the domain controller is taken down, we've still got the backup. It's on that it's on that network share. We can recover from it. And as as I'm kind of building out this story, what you're probably noticing is that there's a bunch of different people involved in this process. So you need to get all these people to be on really friendly terms with each other because if something bad happens, they all still need to work well together. So you have it on that Samba share, but the Samba share, the problem there is if an attacker gains access to your network, there are well known tools out there which the attacker can use to go and enumerate all the network shares that run your network. And if you're using Samba, if they've already compromised Active Directory, there's a very real chance that they can just get rid of they can make those backups disappear. So you take that backup and you put you then back that backup up. So you need another backup tool to back up your backup, And, you know, maybe you're gonna be able to store that offline. Maybe you're gonna drop it on the tape somewhere or in an s three bucket or something like that. It needs to go to some kind of storage somewhere. So, again, you're interacting with another person. So we have this whole story. We've managed to take a backup of Active Directory. We may even have some capabilities of doing things like granular recovery. But here comes the problem. An attacker gets in, they compromise Active Directory. And all of these things very likely rely on Active Directory being available in order to be able to authenticate so you can grant access to the resources that are there. If an attack has taken down Active Directory, the recovery process can be no fun. So this is this is a thing we've been doing for a long time at Rubrik. We've we've been doing active directory backups for longer than I've been with the company. We've got, I think it's around about 4,000 customers using using us to protect identity solutions. So we have this thing called Rubrik Security Cloud. We have capabilities on premises. We've got capabilities in the cloud. And, really, what we have there is true identity resilience and identity recovery. So we can recover that. We can give you that that resilience to your identity platforms. We can help you get stood back up when bad things happen. So we kinda went, okay. Well, why why do we need identity recovery? And I've kind of just gone through why we need it through there. But first of all, we wanna be able to, assure business continuity. So in the event that an attacker gets in, what do I need to do to sound everything back up? If I'm in a hybrid organization where we have some stuff in Entre, we've got some stuff in Active Directory, How do I stitch all of that back together? How do I recover, things like identities that live in active directory but are then provisioned into into Entre ID? How do we when we recover that, how do we make sure that the relationships in Entre still exist to all of the other things, the the enterprise apps, the, you know, the licensing, all of the other good stuff that those users need in order to do their job? So we need to be able to have confidence that we can recover these things. We want to also make sure that we're able to minimize or eliminate the reinfection risk. So if an attacker compromises a domain controller, one of the fun things there is Active Directory is highly distributed by design. That very architectural decision can be easily used by an attacker against it. So if they dump some in or, you know, just some hacking tools into, into SysPho, then that's gonna get replicated across all of your different DCs. They can then use that to compromise all of those. Now if those if those, if that malware or whatever that is, if that is on your domain controller and what you're relying on is, hey. It's okay. I've got a system state back I've got a backup of that virtual machine. I can just recover that backup. You've got a problem because when you recover that backup, you're also recovering the malware. So you need to be able to separate Active Directory as, like, an application state out from the operating system that it's running on. You need to be able to automate the complex recovery. So as a few slides ago, we have that thing with, all the different steps that you need to do based on the Microsoft documentation in order to properly recover active directory forests. So, again, that works. Make sure you understand it. There are hundreds of pages of documentation, but wouldn't it be great if you just have a tool that could kind of abstract all that complexity away? You tell you tell it, you know, how you want to recover, and then you go away and get a coffee while everything else is orchestrated for you. I've already mentioned about the kind of hybrid recovery. So, you know, when we have objects that exist in AD and in Entre, we need to be able to stitch all of that stuff back together with with the recovery. And really importantly, particularly in Entre, but also in Active Directory, you need to be able to make sure that you're recovering all of those relationships that exist within those identity providers. Because if you don't, you're basically recovering when you do the recovery, you're basically creating brand new users. They'll have the same user in it username. They might even have some of the same attributes, but they will have a new object ID in ENTRE or they will have a new, SID and you GUID in active directory. So that those are what those IDPs use under the hood to make sure that, you know, that's that's how everything works, really. So so we built it. We built we built identity recovery. We launched identity recovery, mid December last year. So we're we're kind of we're we're pushing up against kind of three quarters of, since since we launched it. It's been the fastest growing product that Rubrik has ever brought to market by a long stretch. So it's it's obviously hit on a need. So the first thing that's really important as we can see here, we have this five step forest recovery wizard. So if you need to recover an entire Active Directory forest, you basically run through this wizard, and you'll be able to go through that wizard, in in the labs. So, you know, all all of this stuff is available. It's really, really easy to do the recovery. You walk away, you come back, and Active Directory recovers itself effectively. Gives you that ability to do clean room recovery. So if you wanna do recovery into a clean environment, so if you don't trust the even the network that you have for production, you can stand up a brand new isolated network. You can do the recovery of active directory into there. It's really important that you do this because when you're doing that recovery, when you're building what will become your new production, you need authentication services. So without Active Directory, you're kind of not having a good day. We do all of the Microsoft recommended security best practices, so things like, resetting the Kerberos ticket granting ticket service password twice. So we, again, we do all of these things automatically. Microsoft have gone through the way that we do all of this stuff. They've given us lots lots of big ticks. We paid a lot of money to them to to do that. But, yeah, basically, we're doing all of that stuff that's in all of those hundreds of pages of documentation that I mentioned a few minutes ago. We're doing all of that. We're just doing it for you so you don't have to think about it. We then have that ability to do comparison and recovery. So if you want to look at specific attributes and see how a specific object has changed over time, you can just roll back individual attributes if that's what you wanna do. We do a similar kind of thing in Entre. So if you're doing Entre if you if you have native Entre, if you don't have any active directory, we identity recovery, it still works for you. So we can do all of that recovery into Entre. We recover all of those different object types there. So it's not just users, groups, roles, enterprise apps, it's app registrations, conditional access policies, including authentication context, terms of use, name, locations, all of that good stuff. Also, administrative use units as well. More object types coming. Everything is relationship aware, so when we do that recovery, even though that recovered object may have a brand new object ID, we recreate all of those relationships in that. And, again, it's a simple it's a super simple guided workflow to do the recovery. It's basically like a shopping cart. You just go through, check the things that you want, and away you go. And then hybrid, we kinda talked about this a couple of times as well. So I'm just gonna very quickly brush through here. We have that single workflow, so you just go to Rubik Security Cloud. Doesn't matter if your if if some of your objects are on active directory, some of your objects are in Entre. We orchestrate all of that recovery for you. So that's active direct oh, sorry. That's that's identity recovery. If you've ever been on one of these workshops with me in the past, you've probably heard a lot of that stuff before. And that's fine. As I said, that's all included in identity resilience, which is this new product that we shipped two weeks ago. Two weeks ago. Brilliant. And the important thing is, you know, we didn't we didn't rest on our laurels. We didn't go, okay. Recovery is great. That's all we need, because it didn't start there. If we think about let's just let's just put our honest hats on now. What what I'm gonna what I'm gonna do is in the chat, I think you should be able to see the chat, we've got some you can drop, you can drop, like, emojis in there. So I want people to be really, really honest. If you are an identity provider administrator, so whether that's active directory, well, in in this case, it's specifically active directory, but, you know, just bear bear with us as we play this little game. So have you ever have you ever created an SPN just for a test object and then forgotten about that SPN and that SPN just kind of sticks around forever? I I'll be I'll be the only honest person in the room. I've I've definitely done that. So, yeah, you can you can go in, you create the SPN, you can then go in go in and delete it. But, typically, what happens, you create that SPN, the testing completes. By the time that happens, you've got another fire that you need to put out. So cleaning up those kinds of things is really important for the hygiene of Active Directory, also for your security posture. Moving on to the next one. So if you've ever dealt with, constraint delegation, you know, Kerberos constrained delegation, we definitely wanna be using this. So we should really be checking this box here, trust the computer for delegation to specified services only. We should be doing least privilege there. But in many cases, you either can't get things working or, again, it's just a it's a workaround or a test. So you go, hey. Okay. We'll we'll check that box trust for delegation to any service, and then we'll come back later and we'll tighten those rules up. And and and that that never happens. We've got one person who's honest there. Thank you, Steve. And then if you've ever done this, I think you should go and stand in the corner, hang your head in shame. So, if anyone's not familiar with with with the, this this specific the d s heuristics, component in, you you can do this in ad c edit as well. So if you change the d s heuristics value to this, what it actually does is it enables anonymous access to Active Directory. So I'm sure that there will be people out there who've, you know, worked with someone who said, oh, yeah. I have to do this in order to get this weird application to work. And if you ever come across those people, you should find a new job immediately because that that is really, really bad due to you. But if you've ever done you know, what what I'm kinda trying to get across is we've all kind of been in a position where, you know, the you haven't been able to do things quite by the book, and it's often been a workaround or, you know, something that you had every intention of tightening up after the event. But the reality is we all lead incredibly busy lives. So these kinds of problems, lead to risk of exposure. So if we look at the anatomy of a of a of an identity attack, we have things like stale accounts. So you create, you create a a test account, you create an SPN associated with that test account. You might then delete that test account. The SPN is still there, so you should probably delete that as well. But in many cases, those test accounts just stick around forever because, again, everybody kinda moves on with their lives. There's another fire to put out. There's there's misconfigurations. So out of the box, Active Directory is fairly secure, same same kind of deal with, with Entrez. It's fairly secure. There are things that you can do to improve, the security posture, but what they definitely are are over per over permissioned identity. So there's there's people who, you know, we've we've again, I'm I'm putting I'm putting myself out there back in back in the Windows XP days. It was not it was not unusual, within within enterprises, within businesses that a lot of people would have local administrator rights on their machine, because they had a weird scanner that needed that. It just didn't work without local admin rights. And we see that in in active directory and also in open for as well. So we know that we should, operate with least privilege, but often things and, you know, and and and and again, often what is least privilege changes over time. So somebody may join a company in one department, they have some privileges, they move to another department, they should really lose the privileges in the original department, but they tend to stick around. So over permissioned identities are a problem as well. So what this leads to, really, is a way for attackers to get in. We know that over 80% of cyberattacks these days involve identity in some way, shape, or form. So if an attacker is able to compromise an account, it gives them the ability to just literally log into your network. They they're just basically walking through the front door. You can't really tell them apart from the legitimate owner of that identity if that legitimate owner still exists. So if we think about something like a vulnerable service account, a service account that has over it has too many privileges or maybe, maybe it's got a password that hasn't been rotated in, in a hundred and eighty days or, you know, whatever your policy is. These risks of exposure really lead to the next stage of the attack, which is the the kind of expand and persist. So we see, we see an attacker will get in, they will move laterally, they will do, reconnaissance, they'll they'll go looking for high value targets. They'll continue to do, you know, to do what they can to compromise your organization. They will establish persistence, and this is a really important one. We've been we've been doing, a lot of thinking about how how we handle this this kind of thing internally. So if let's say, for example, if an attacker compromises a regular user and they are then able to escalate privileges, so they become a privileged user. That privileged user could potentially, create a create a number of other privileged user accounts. Now if your if your if your SOC are hot, they'll see that this this account has been compromised. They'll probably lock that account. The problem at this point is, honestly, it doesn't really matter because the the the the attacker has already created a bunch of extra accounts that they can log in with. So how do you kind of unpick all of that kind of stuff? These are these are problems that we're really thinking hard about at the moment. And then we have these hack and disrupts phase. So, you know, they take systems down. They take identity services down. And once identity is down, your business is disrupted because nobody can do anything, honestly. I I see I see your comment about the Windows XP default wallpaper, and, we can we can have a chat about that later, Chase. But yeah. Yeah. Okay. Let's let crack on. So if we think about those kind of, those kind of the the life cycle of an attack or what we can do to, you know, to defend against those kind of things, to to really disrupt, the activities of of of of bad actors. So if we look at those risks of exposure, we we need to be able to detect in inactive or risky identities. And when we think about risky identities, we need to start thinking about what data do they have access to, what privileges do they have in your identity services, and and more broadly. We need to be able to do things like, like detect unchanged secrets. So if you have a service account and and, again, this is this is me going back to, back to when I was a SysAdmin a long time ago. Back then, when you created a service account, it was just a regular user account, and typically what happened is you set a password for that user account. You might even generate a complex password, if so well done. But then the next thing you do is you check the check the box that says this password never expires. So now once an attacker has got you know, if they're able to use tools like Mimikatz, for example, they can dump dump the, dump your credentials. They can then go away, crack those credentials. They can come back and, hey. Okay. We know what the password is for that account. We know that it's never been changed. It's a really easy target for them. Surface misconfigurations and configuration drift. So that's kind of back to the beginning. So, if we if we see that we have vulnerabilities because Active Directory can always be more secure than it is out of the box, same deal with Entra ID, but also we have humans that are the administrators and humans are fallible. Whether intentionally or otherwise, it's usually otherwise. It's usually just mistakes or there's too much work to do. You don't get to go back and fix the, fix the snags that you left. But we need to be able to keep an eye on those things, detect them when they happen so you can close those close those gaps. You can lock those windows and doors as we like to look at it. And if we look at the kind of the expand and persist, once an attacker is within your identity services, we need to start looking at real time indicators of exposure. So we're looking at the things that identities are doing. If and if you if you notice that an identity, let's say, for example, we we see escalation of privilege for a specific identity, you should probably take a look at that. That might be legitimate. It might be somebody who's just given an administrator job within a specific application team or something like that. That's fine. But what you shouldn't do is just ignore those things. You should always investigate those things. Changes to group policies. So GPOs, honestly, GPOs are what active directory runs on. If you if you're able to gain access to be able to edit GPOs, you can make you can do an incredible amount of damage. And in many cases, organizations just don't have the visibility into when changes happen and also what those changes are. So, again, that's another thing that you'll be looking into once you get into the labs. Monitoring identity behavior and access. So, again, just kind of going, well, what's what what are these identities doing? Is it is it expected behavior? Is it suspectivity? Do we need to start thinking about how we tie our, our security tooling, our SOC tooling into, more something that's more kind of designed around detection and and also recovery? You know, maybe there's some things to think about there. And then when once it comes to attacking and disrupting, if they're at the point where they're able to compromise Active Directory to the to the point where you need to, to do the recovery, that's fine. You need to be able to do that forest automation forest recovery in an automated fashion. You need to be able to recover these things into a clean room so you know that you there's nothing suspect on the network that might just, you know, get get back in again. And we need to be able to recover Entra ID as well as active directory and also those hybrid, hybrid IDs as well in an orchestrated fashion. I've just actually published a, a white paper about exactly that that the kind of the challenges of hybrid recovery. So, if you're interested in that and you're a Rubrik customer, please reach out to your your account team. They'll be able to get that over to you. It will be going on the website in the not too distant future as well. So, yeah, we have identity resilience. We give you that visibility into we we have that unified inventory. So, whether your identities exist in Active Directory or Entre or in the not too distant future, who knows what other identity providers. We need to be able to do this across human users and nonhuman identities and also the configuration of all of those identity providers as well. So we need that visibility, so the inventory, we need to know what exposures we've got, we need to know where there's misconfigurations, or areas where we could potentially tighten up security. That gets us the first step. The second step is all about monitoring and remediation. So we're looking really at identifying where you have those expo exposures so that you can minimize the potential attack surface, and and also identify when bad things happen so that you can block them, then you can track them out as well. And then from a recovery perspective, that that really is kind of like ideally, we want to see you never have to use the identity recovery product. If you need to recover Active Directory, you're having a really bad day already, but that tooling is there. It's all part of identity resilience. So we bring all of this together across all of those across the various different hybrid IDPs. As I say, right now, that's Active Directory and Entra. Watch this space for other IDPs coming online in the not too distant future. And it's all done through a single platform, so you don't have multiple tools for managing all of these things. You just go to Rubrik Security Cloud. And I kinda like this. And, normally, when when I show this, this screenshot to people and, again, you can take a look at this in the lab. We call this ID three sixty. So the idea here is, we can cut we can drill into a one any specific identity, whether it's human or nonhuman, and we can see where it comes from. So in this case, we can see, for example, where are we? It comes from the acme.com forest. We have the design.acme.com domain, and it's a user in fact, it's a group called analysts. We can see that we've got identity insights. So it's a highly sensitive identity, so it has a bunch of privileges, above and beyond just a regular group. It's itself is a member of privileged groups, and it's got 24 privileged members there. Down here, we can see the policy violations. So these are things like, you know, maybe maybe we need to tighten up the security on these things. So we'll give you we'll give you ways to to to remediate those. And then we have the alerts, which is, hey. This is a real time problem, things like GPO changes, things like privilege escalations that you might need to look at. Down at the bottom, we've got this snapshot based vulnerability summary, so we can kinda track over time changes to the risk profile. Then we've got, you know, the sensitive data that those this specific group has got access to. So, this comes from Rubik DSPM. So if you've got DSPM, you get that visibility too. And then all of the different policy violations, so you can drill into them and really kind of figure out, okay. What do I need to do to fix this? Can I just click a button within, identity resilience and have that fixed, or do I need to do a deeper investigation? So, again, all of that stuff coming up in the lab. I'm just gonna do a quick refresh, and we don't we still don't seem to have any questions yet. That is, that is giving me the stats. So, again, don't forget, if you've got any questions about any of this stuff, I will be answering those questions once we get to the labs, which we're not very far away from at this point. So let me check back in here. So we have that comprehensive identity visibility. So we have that capability to really identify what an identity has done and rewind that so we can do the investigation. And we if if there's if there's been something, you know, there's been some unwanted changes because an identity has been compromised, we can help you, roll those back. We can help you map those data that they've got access to. So as as I showed on the last screen, with Rubik DSPN, we can show you the different types of data, the different different sensitivity levels. So if you've got a highly privileged user that also has a locks start again, that has access to a lot of highly sensitive data, Those those those that combination is is something that you wanna really pay attention to. Again, we can help you track identity behavior and changes over time, and also the same. So we we show you human and nonhuman identities. So you'll see, again, you'll see this in the lab. We have that unified interface. You can see all of the service accounts. You can see everything, whether it's in Active Directory or Entre, users, groups, roles, all of that good stuff. From a risk management perspective, so, again, we're gonna kinda give you a list of, violations there that are sorted by severity so that you know where to where to start, basically. Normally, what happens when when customers have turned this feature on, they get a big list of things. It's like, oh, heck. Where do I where do I even begin? And that's what the severity rating there is for. So in this case, we can see, for example, there's a there's a couple at the top that have got severity ratings of critical. The top one has got 97 violations. We should be focusing on that specific finding, get that stuff remediated before we move further down to the, you know, the findings that are gonna have that they still need dealing with, but they have less of an impact. We have real time alerting, indicators of exposure so we can see, all of these things. They're mapped to, to security frameworks, so things like the NIST cybersecurity framework, MITRE attack and defend, ANSI, and the OWASP NHI framework as well. So we can kinda help if you if you have a regulatory or you're, you know, you're you're doing your risk mapping based on any of those frameworks. We can help you map the findings against those and help you reduce that risk. And, again, we have those remediation workflows. So some of these findings, you're gonna wanna just go, yeah. Okay. Click a button. Get that thing fixed right now. In some cases, it's a little bit more complicated, and you might need to do some investigation. So we'll give you you know, we'll tell you what you need to do once you've made a decision on as to whether that is legitimate use or not, and you can then go in, and remediate those things. And it does it all, again, from that single point that single single pane of glass. I hate that term. We're doing this across Active Directory and Entre. So when it comes to recovery, we make it really, really easy to recover. We can do this we can separate Active Directory as an application out from the operating system that it's running on, so you can do clean room recovery, all of that good stuff. And, really, that's kind of where we get to. So one of one of the challenges we've had, one of the pieces of thought that we've we've seen some, some competitors in this space say is, listen. Rubrik has has just started doing identity, and we we absolutely have not. We've been doing identity for years. We've just kind of really switched to focus on different different sides of it. It's really in it's it's in our DNA. So if we look at what we're doing here, we've got user and data context. We've been doing that for a long time. We've got indicators of exposure, privileged risk, so we can identify where your privileged users are. We can detect where there's been a compromise, and we can do that recovery whether it's on premises, whether it's, in the cloud, or whether it's a hybrid. So we've got all of this stuff baked into, identity resilience. And, yeah, we have that capability. So, I I really like how this slide kinda simplifies, yeah, simplifies how, how how we how we think about this. So, we we kinda we kinda broken this down into remediate, rollback, recover. So in the worst case scenario, your identity services are toast and you need to be able to recover. Ideally, the whole idea here is we can help you get to a position where that becomes much much less likely. I would never say it could never possibly happen, but it's all about management of risk. So worst case scenario, everything's on fire. You're able to stand things back up. You have business resilience because you can recover your identity services and all of the rest of the good stuff that Rubrik does. We give you that ability to roll back. So when we when we detect things like, like like a maybe a compromised identity that might have made changes to things like group policies, we give you that ability to roll back those changes, so it's almost like they never happened. And then kind of right at the very beginning of the attack life cycle, we we detect all of those risks for you upfront. We help you to close those gaps. We help you to lock those windows and doors. So it's much more difficult for an adversary to just walk straight into the front door and set your house on fire. So that's Rubrik Identity Resilience. There we go. All delivered through Rubrik Security Cloud. And on that note, to the labs, I think, if you look in the tabs tab let's see. Yeah. So there should be a link to a guided lab. If you click that link, you should see something a little bit like this. So this is, this is the this is the guided lab environment. This is this is all being captured. It's it's just a website. So you can click around. You can go through the entire process here. So, you know, we talk about what identity resilience is. We show you the identity inventory, show you how it gives you everything together. If you need to look into specific identities, you can go through and go you know, run run through an investigation in that that chapter. We talk a little bit about the policy engine. That's the thing that looks for all of those, risks upfront so that you can you can remediate them. We've got the violations, so where where there is a violation of a policy. We show you how you can use, identity resilience to remediate those violations. And then when we see threats, so real time, we see things like group policy changes. We'll help we'll show you, how we detect them, what you can do about them. And then we've got a couple of couple of extra chapters at the end to, just to kinda help you understand how this fits in with your wider risk management, your your information security tooling. So, getting information out of Rubrik Security Cloud and into your SIEM and your SOAR tooling. If you wanna send email alerts to help desks, you know, that that's all covered in the notifications chapter. And then at the very end, it's a super quick wrap up chapter. Just kinda shows you, yeah, we we do all of this stuff. There's a lot of information here, but reporting is also really important. I don't know I I I don't think I've ever had a boss in my career who didn't didn't love when I gave them a good report that said everything everything is green, or there are some things that are in red and amber, but here's what we're doing about them. So reporting is really important. It's really important when you start thinking about compliance and audits and things like that as well. So all of that is in the lab. You should just be able to kind of click through. The lab is available until, until this time next week, basically. So you've got a week to play play with it as many times as you like. If you want to share it with your colleagues, please do feel free to do so. But, yeah, once once that week is up, it will eat itself. If you need access to you know, if you've got something going on and you wanna show it to someone and the the lot has expired, if you reach out to your account team at Rubrik, we'll be able to get another one provisioned up for you pretty pretty quickly. But, yeah, it's there. Please do have a play with that. And at that point, I see more comments in the chat. Yeah. Okay. So, so, I'm I'm not seeing any questions. I don't think. Let me just oh, no. I've got we have some questions. There we go. I'm just gonna address a quick question, from Robert in the in the chat. Thanks for this, Robert. So how remediation works is important, and you're absolutely right. It is it is really important. And the honest answer is remediation works differently depending on what the finding is. So what you'll find in the lab is that specific I'm trying to think what we what we gave as an example. There was a what was it? It was it was a privileged account that had delegation enabled. So what you can do is you can manually remediate that. In fact, let's let's quickly let's click through that now. I would recommend you, you know, go go through this in in your own time. But, yeah. So what it looks like is I'm just gonna quickly click through all of this stuff. We should have yep. So top here, we've got three and a half thousand violations for this critical severity finding for delegation enabled for AD privileged identity. So we come here. We've got a list of the different identities, and, where are we? So if I select one of them, we'll look at Barbara, for example. Here's what the finding is. Now if you want to manually remediate it, we we kinda give you it basically says ensure delegation rights to privileged identities are approved. If you want to remediate it, here's here's what you need to do to remediate it manually. But if you wanna remediate it automatically alright. Yeah. So we we also have an option to plug into ServiceNow so we can create a ticket. This is all prepopulated. You can add in your own clients if that's what you want to do. Click create. That'll create a ticket in ServiceNow. But, really, if you want to kind of remediate this yourself, we can come in and we can click disable delegation. Because this is something that we perform live on Active Directory, we just need to select a domain controller that we we've got RBS installed on so we can perform that, that based on an API. Click remediate. That will make an API call to RBS that runs on the domain controller. That will then use LDAP to, basically, to to perform the remediation action relevant to that specific finding. So, yeah, it's it's a really good point. We can we can we can talk about, you know, how how to do the remediation all all day. And I'll I'll put my hands up and say, there is an automatic remediation for every single finding because not every single finding has something that's as simple as that. So in many cases, there are multiple steps that you need to go through. And it's one of those things where, actually, you need to involve multiple teams. We didn't really wanna give you a single button to click that could get you you know, could could could land you in trouble. But, yeah, thanks for that question, Robert. I really appreciate that. Oh, right. We've got you. We've got lots of questions in the chat. Okay. So, I need to drop for labs for meetings. Okay. That's great stuff. Thanks, Will. Another great Robert, backup admins are not AD admins. Do backup admins have access to make changes based on these tools. Depends on what role based access control you set up. So you can set up role based access control so your AD admin logs in, and they've got access to identity resilience, and only your AD admins are able to perform recoveries of Active Directory and make these changes. In some organizations, you have more of a generalist team, and the the team that's responsible for your virtualization is also responsible for your identity services, your SQL administration. All basically, what I'm saying is we give you role based access controls so you can create any and in fact, we have let's, let's let's play this game as well. Let's just I'm just gonna quickly look, one of my environments. This is just gonna take a moment. I I apologize. This is not an amazing hopefully, people are into the labs anyway, so, this is more just for fun. So what we have cool, role based access controls. So we create a you can see here that there's a bunch of pre pre created roles, but there are also roles that you can create yourself. So we can come in here and we can say, hey. Actually, we've got a backup administrator, so we wanna just have someone who takes backups, maybe give them recovery permissions. But, also, we have an identity security administer administrator. So they they only really need access to the identity side of things. We can do that, and then we can say, hey. Okay. Well, we're gonna give these people access to, let's say we wanna give them access to where are we? There's so many of these things. The so to active directory, and let me see if I can find the entra in this list. There we go. Entra ID. So we would just give these these these users access to that specific that those specific area, you can say, hey. Okay. Well, you can recover, but you can only recover into isolation or things like that. We can limit the privileges that they have within those areas as well. So if you don't want to give them the permissions to take to to to set up new backup jobs, you can absolutely do that. Basically, what I'm saying is role based access control is the correct answer to, to that point, but it is a very good point. So thank you that. Right. Okay. Let's, let's have a look. We've got two questions in. If anyone has any other questions, please do drop them in. I appreciate people are probably super keen to get into the labs. And how are we doing on time? Yeah. We still got lots of time. So one of the questions, there from Steve, is if the recycle bin is enabled in the active directory environment, objects can be recovered. Does re recover objects with their original SID? That's a great question. So the answer to that is if the object still exists in the recycle bin, and this applies to contra as well, we will recover it from the recycle bin, and then we will effectively restore it to the state at the point in time that the snapshot was taken. So the object ID in ENTRE or the SID and GUID in active directory. Obviously, those things are there. If an attacker if we're in a, you know, cyber attack kind of scenario, what we have typically seen is those recycle bins are are toast. So it will it it helps you get out of a bind when those things exist, but also, you know, you have to kind of plan for those things not being there anymore as well. So, thank you very much for that one, Steve. And the other one is Andreas. Okay. Cool. So all these security features are not based on backups but on live analyses and investigation. How does Rubrik get all the insights? So the answer to that is, actually, it's it's a little from part a, a little from So in order to be able to do everything that we do, we back up your identity services. That's why identity recovery is included with identity resilience. So we back up your identity services. Once we've taken a backup, we can then extract those identities from that backup. We use that to build out the the unified I the unit unified identity inventory. So that happens based on the backup. We're looking at some of the things for the violations where we can take all of that stuff from the backup as well. Now the time sensitive bits things, things like the so things that generate alerts, so things like privilege escalations, things like group policy changes. We're doing that live against Active Directory. So we're monitoring Active Directory itself. We're not just looking at the event logs because, whether I'm I'm not sure if folks are familiar with Windows event logs, but it's basically a text file. If you've compromised the host, you can basically write anything you like to those event logs. You can even delete what's in those event logs. So they are useful as a troubleshooting tool, but I wouldn't rely on them 100% for forensic investigations. Now in many cases, organizations will use Windows Event Log Forwarding to send things onto a SIM tool, things like that. That's great. You've got all of that stuff out of your host. What we do is we actually monitor the changes against Active Directory itself. So if an attacker is able to make a change to Active Directory, it doesn't matter if they're able to cover their tracks from a logs perspective because we're reading that data from Active Directory itself. So this gives us the the kind of we call we call it tight tamper proof logging. That data gets sent to your cluster, which then gets sent to Rubik Security Cloud. There's a bunch of processing goes on in each place. So it's it's really is effectively metadata that's going from one place to the next. And so that's how we can we can identify these things very, very quickly. So, yeah, there's a little from part a, a little from part b. Some of it is done based on backups. Some of it is based on live analysis. And for that's, obviously, that's how it works for active directory. For Entre, obviously, it's it's it's all API based. So there's there is no, there's no LDAP call to to your directory service there. Thank you for that question, Andreas. really appreciate the, the time that you've given us. Hopefully, you've been able to attend some of the other identity resilience week, events that we put on this week. If not, again, I believe they're available on demand after the event. Watch this space. There is lots more coming from Rubrik in the identity resilience space in the coming months. Account based, we'll be able to share it all with you. But, yeah, thanks very much, everyone.