Intcube CTO Explains Why Active Directory Weaknesses Persist in Small Municipal IT Teams
A security cohort for 27 municipalities revealed that lack of motivation, not awareness, drives long-term Active Directory vulnerabilities in small teams.
Key points
- municipalities hardened Windows Server and Active Directory over 12 weeks in a structured cohort led by intcube.
- David Fuhr, CTO at intcube, states that technical debt and organizational debt are solvable but require group energy to overcome.
- The initiative addressed complex settings like SMB signing, LDAP signing, and Kerberos hardening through lab testing and rollback planning.
David Fuhr, chief technology officer at intcube, recently detailed why Active Directory weaknesses remain open for years in organizations with only one or two administrators. According to an interview published by Help Net Security, Fuhr discussed a 12-week security cohort where 27 municipalities worked together to harden their Windows Server and Active Directory environments. The program utilized weekly sessions, homework assignments, and security measurements at both the start and end of the period to track progress and ensure accountability among the participating public administration IT teams.
The cohort required splitting the 27 municipal IT organizations into two separate groups, morning and afternoon, to manage the workload effectively. Participants tackled high-risk configurations that can easily break systems if implemented incorrectly, including SMB signing, LDAP signing, and Kerberos hardening. Fuhr explained that the group tested all changes in a laboratory environment before deployment and established clear rollback plans. This structured approach ensured that technical modifications were safe and that ownership of the new settings was clearly defined for each organization after the program concluded.
The Root Cause of Persistent Vulnerabilities
Fuhr stated that the primary issue is not a lack of awareness among municipal IT staff. The municipalities that signed up for the cohort already knew they needed to improve their server security and Active Directory posture. He noted that another survey would only quantify the size of the problem without helping teams take meaningful action. While the cohort structure was unfamiliar, participants quickly adapted to the collaborative working method. The technical challenges were described as hard but solvable, despite the significant baggage associated with Active Directory as an older technology.
The persistence of these weaknesses is attributed to technical debt, organizational debt, and process debt, particularly in organizations that have relied on Microsoft technologies for decades. Fuhr argued that while resources are a constraint, the limitation is not money. Even with additional funding for tools or licenses, the bottleneck remains the small number of administrators managing numerous tasks. The core deficit is motivation to solve specific, complex problems in a way that feels compelling and achievable for the staff involved.
Who Is Affected by This Approach
The findings apply specifically to public administration and municipal IT organizations where staff sizes are small. Fuhr observed that large security reports, often 150 pages long, are rarely read or acted upon by these teams. He described the traditional reporting model as a game with bad incentives. While reports could be boiled down to five to eight essential pages, the energy required to tackle the recommendations remains high. The cohort model provided the necessary structure and group energy, similar to a sports team or a roped party on a mountain, to help teams execute difficult security hardening tasks together.
What should you do?
Organizations with small IT teams should evaluate their current Active Directory hardening posture and identify specific high-risk settings that require implementation. If resources are limited, consider joining or forming a peer cohort to share knowledge and maintain momentum during complex security projects. Ensure that any changes to critical protocols like SMB or LDAP are tested in a lab environment before production deployment. Establish clear ownership for security settings post-implementation to prevent configuration drift and ensure long-term maintenance of hardened states.
What to do and how to stay safe: Active Directory
- Audit your Active Directory environment for missing SMB signing, LDAP signing, and Kerberos hardening configurations.
- Create a test lab environment to validate security changes before applying them to production systems.
- Develop rollback plans for every security configuration change to minimize downtime if issues arise.
- Join or form a peer group to share workload and maintain motivation during long-term security projects.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many municipalities participated in the intcube security cohort?
Twenty-seven municipalities participated in the 12-week security cohort to harden their Windows Server and Active Directory environments.
What technical settings did the cohort focus on hardening?
The group focused on implementing SMB signing, LDAP signing, and Kerberos hardening, which are settings that can break systems if not configured correctly.
Why do Active Directory weaknesses persist in small teams according to David Fuhr?
Fuhr attributes the persistence to a lack of motivation and energy to solve complex problems, rather than a lack of awareness or funding.
