Define a golden ticket attack as a Kerberos exploitation technique where an attacker forges a Ticket Granting Ticket (TGT) using the KRBTGT account hash, granting unrestricted access. Explain the attack flow, its prerequisites, and its impact on Active Directory environments, then discuss mitigation strategies relevant to a high-security context like NASA.
Pro tip: Emphasize that detecting golden ticket attacks is extremely difficult because forged TGTs have a default lifetime of 10 years and can be created offline; thus, prevention (protecting the KRBTGT hash) and monitoring for anomalous TGT usage are critical.
State that a golden ticket attack involves forging a Kerberos TGT using the KRBTGT account's NTLM hash, allowing the attacker to impersonate any user in the domain.
Describe how the attacker obtains the KRBTGT hash (e.g., via DCSync or compromising a domain controller), then uses it to create a TGT with arbitrary privileges and a long lifetime.
Highlight that the forged TGT grants domain admin access, persists even after password changes (unless KRBTGT is reset twice), and is hard to detect because it appears legitimate.
Mention protecting the KRBTGT account, regularly rotating its password twice, monitoring for anomalous TGT lifetimes or encryption types, and implementing tiered administration.
Connect to broader system design principles: defense in depth, least privilege, and the importance of securing identity infrastructure in large-scale environments like NASA's.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.