Notifications
Clear all
Topic starter
08/07/2026 7:07 pm
TL;DR: Government and public sector organisations are being targeted by ransomware with the same playbook as private-sector victims, and once attackers gain a weak credential they often move into Active Directory, where visibility is limited and compromise can spread quickly, according to IS Decisions. The real issue is not just initial access but the assumption that AD can be protected by perimeter controls alone.
NHIMG editorial — based on content published by IS Decisions: Active Directory ransomware defence for government and public sector organisations
Questions worth separating out
Q: How should security teams reduce ransomware risk in Active Directory environments?
A: Start by reducing the number of paths a valid account can use after authentication.
Q: Why do weak AD controls increase ransomware impact in public sector networks?
A: Because AD often governs internal trust relationships, a single compromised account can become a launch point for broader access.
Q: What do teams get wrong about MFA in legacy identity environments?
A: They often treat MFA as a complete defence when it is really one layer in a broader access control model.
Practitioner guidance
- Map AD attack paths before hardening the perimeter. Inventory which accounts, admin groups, and connection types can reach domain controllers or privileged resources, then identify where one stolen credential could still move laterally without additional challenge.
- Enforce MFA at the point of privilege use. Require step-up authentication for administrative actions, UAC prompts, and high-risk connection types so a compromised session cannot freely reuse trust after the initial login.
- Constrain sessions by device and context. Limit access by workstation, IP range, department, country, and connection type so compromised credentials have less room to move across legacy networks.
What's in the full article
IS Decisions' full article covers the operational detail this post intentionally leaves for the source:
- Practical configuration guidance for applying MFA to AD sessions and connection types without forcing an identity provider migration.
- Examples of session and contextual controls that can restrict workstation, IP range, country, department, and connection-type access.
- Monitoring and alert criteria for unusual access attempts, blocked connections, and MFA failures across Active Directory activity.
- Deployment considerations for on-premises environments running existing AD policies on a single server.
👉 Read IS Decisions' analysis of Active Directory ransomware defence for public sector teams →
Active Directory ransomware defense: are your controls keeping up?
Explore further
08/07/2026 7:32 pm
Active Directory ransomware is an identity governance problem, not just a malware problem. The article is right to emphasise MFA and internal controls, but the deeper issue is that many public sector programmes still treat AD as a directory service rather than the control plane that decides how far a stolen credential can travel. Ransomware succeeds when identity is trusted too broadly inside the environment. Practitioners need to govern AD as an enforcement layer, not merely an authentication layer.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: Who is accountable when ransomware spreads through Active Directory?
A: Accountability usually sits with the identity, infrastructure, and security teams that own AD governance, monitoring, and privileged access policy. If the environment allows broad internal trust, the issue is not only attack sophistication. It is also a governance decision about how much access remains available after initial compromise.
👉 Read our full editorial: Active Directory ransomware controls for public sector identity defense
