Meeting the InCommon Assurance profile criteria using Active Directory

[Brian Arkills <>]

There was a question raised in a past call about this, but I believe it went unanswered and not captured by an action item.

 

Here's the answer:

 

Yes. Basically, as long as the volume the VHD is stored on has Bitlocker encryption, then the VM has the Bitlocker at-rest protection.

 

http://download.microsoft.com/download/4/1/d/41d3cbff-6a2d-457e-a6ab-0e1607629c16/Windows_Server_2008_Hyper-V_and_BitLocker_Drive_Encryption_(2008-05-27).docx covers using Bitlocker with HyperV, and this is directly applicable to a VM that is a DC.

 

This, of course, doesn't preclude the other risks around a VM. Which brings in two other marginally related resources:

 

Running Domain Controllers in Hyper-V

http://technet.microsoft.com/en-us/library/dd363553(v=ws.10).aspx

 

and

 

Best Practices for Securing Active Directory (just released, and yes this is a Microsoft paper despite the odd URL)

http://aka.ms/bpsad

 

This latter paper is interesting for our purposes, although quite large (314 pages). I'm still trying to digest it, and uncovering other new things from it, like:

 

Mitigating Pass-the-Hass Attacks and Other Credential Theft Techniques

http://download.microsoft.com/download/7/7/A/77ABC5BD-8320-41AF-863C-6ECFB10CB4B9/Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft Techniques_English.pdf

 

which includes sections like "Why can't Microsoft release an update to address this issue?" and "How can your organization mitigate the risk of a PtH attack?"

 

Lots of interesting material here ...

 

-B