Security automation and group Managed Service Accounts for better protection against cyberattacks

Cyberattacks threaten companies of all sizes. According to the "Bitkom-Studie Wirtschaftsschutz 2024", cyberattacks in Germany caused damages amounting to €178.6 billion, an increase of 20% over the previous year. In 2024, 81% of German companies were affected by cyberattacks. The BSI Status Report 2024 on IT security in Germany shows that phishing emails, malware, insecure web browsing, IoT devices, and vulnerabilities in third-party providers are common gateways for attackers.

Against this backdrop, cybersecurity measures—and particularly effective, automated security measures—are becoming increasingly important. This is exactly where our solution comes in: it combines security automation with group Managed Service Accounts (gMSA) in Windows servers to effectively protect companies and initiate countermeasures.

What is security automation?

Security automation uses existing security systems such as antivirus software or network monitoring to automatically initiate countermeasures, collect forensic data, and document incidents when threats arise. In Windows Server and client environments, it offers:

• Real-time detection: As soon as antivirus software or security tools report malicious code or suspicious network traffic, the system intervenes.
• Isolation: Affected devices are disconnected from the network to stop the spread of malware.
• Forensic data collection: Data is backed up for analysis.
• Emergency processes: Tickets are created in service management systems such as ServiceNow® to alert IT teams. In environments without a service management system, alternative communication channels such as Microsoft Teams, email, or desktop messages are used to ensure a rapid incident response.

The KPMG study e-Crime 2024 highlights that overlooking the first signs of cyberattacks significantly increases their success.

A real-life scenario: The phishing attack

Imagine an employee opens an email that appears to be from a customer. An attached document turns out to be malware. Without a quick response, attackers could infiltrate your network. Our security automation:

1.     Detects the threat immediately.
2.     Isolates the affected device in seconds.
3.     Collects forensic data for analysis.
4.     Creates a ticket in your ITSM system.

This approach not only protects against emails containing malicious code, but also against threats such as malicious links when browsing the web.

The vulnerability of traditional service accounts

Traditional service accounts with static passwords are a security risk. According to the Bitkom study, compromised access data is one of the main causes of data leaks. Manual password management is time-consuming and error-prone, especially in large environments.

Group Managed Service Accounts (gMSA): A secure alternative

Our protected Windows servers do not use service accounts at all. Instead, we use central task servers with group Managed Service Accounts (gMSA) that control supporting processes. gMSA offer:

• Automatic password management: Passwords are automatically changed every 30 days, making brute force attacks more difficult.
• Multi-server use: gMSA can be used on multiple servers, ideal for clusters or load balancing.
• Simplified administration: Administration can be delegated to service administrators, reducing the effort involved.
• Kerberos support: These accounts use the strongest security features.

Using gMSA on central task servers increases security without increasing complexity.

Protection against multiple entry points

Cyberattacks use various entry points:

• Phishing emails: According to a KPMG study, 53% of companies have been affected.
• Web browsing: Compromised websites or malicious links.
• IoT devices: Weakly secured devices as backdoors.
• Physical access: Unauthorized access to devices.
• Third-party providers: Vulnerabilities in the supply chain.

Our Security Automation solution responds to a variety of triggers that indicate potential threats. When malicious code is detected on a file server by antivirus software, Security Automation identifies the affected user by analyzing the file server's access logs to see which user accessed the malicious file. The user's affected devices are isolated to prevent the spread of the malware, and comprehensive countermeasures such as malware removal and system restoration are initiated. The user is logged out of all devices and receives an accessible system message, compatible with screen readers such as JAWS, informing them of the incident and the next steps to be taken.

Integration of security automation and gMSA

The combination of security automation and gMSA creates a robust defense:

1. Threat detection: Antivirus software reports malicious code or suspicious traffic.
2. Automated response: Affected systems are isolated and data is backed up.
3. No service accounts on compromised systems.
4. ITSM integration: Tickets are triggered in systems such as ServiceNow.

The central task servers with gMSA ensure that measures with elevated privileges are possible at any time without granting these privileges to third parties.

Advantages for your company

The solution offers:

•     Fast response times: Threats are neutralized in seconds.
•     High security: gMSA minimizes password risks and is only located on specially protected servers.
•     Seamless integration: Compatible with any service management product.
•     Cost efficiency: Less downtime and damage.
•     Scalability: Ideal for large environments.

Your digital investigator

A cyberattack is a crime scene: every second counts. Our security automation acts like an investigator who secures the scene, collects evidence, and prevents damage, while gMSA ensures secure authentication. This investigator navigates effortlessly through any Windows server and client environment and integrates seamlessly into existing systems, regardless of the product used.