The quick answer is to have a quality assurance group that does security audits on any application or service added...
to the infrastructure. In reality it's a matter of defining a security strategy and the appropriate testing standards that can be applied to any service being implemented. A good start is to test the application against the Open Web Application Security Project (OWASP) Top 10 application risks. This list identifies the most common deficiencies found in application deployments.
In addition, you should work with your compliance and security organizations to include other tests based on your organization's requirements: For example you might need to do a PCI self-assessment if the application in question handles credit card information, or a HIPAA review if you deal with health care info. There isn't a one-size-fits-all Windows Active Directory security configuration assessment, but between OWASP and your security team, you should have a good list to build from.
Dig Deeper on Active Directory security
Related Q&A from Randall Gamby
Enterprise SSO products have matured over the years, so what's the state of eSSO today? Expert Randall Gamby discusses. Continue Reading
Enterprises need a full understanding of the FIDO authentication framework before switching to its technology. Expert Randall Gamby looks at the most... Continue Reading
A self-managed HSM appliance may be the safer external key management system to use with your organization's encryption keys. Here's why. Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.