After a city Active Directory compromise, responders find reused NTLM hashes, forged Kerberos tickets, and ransomware staging. Which engineering focus best addresses the crypto and authentication-material risks highlighted by those attack methods?

After Active Directory compromise, reused NTLM hashes, forged Kerberos tickets, and ransomware staging point to authentication-material risk. Engineering focus belongs on protecting and rotating secrets that enable pass-the-hash and ticket abuse: limit credential caching and reuse, harden Kerberos (including constrained delegation and ticket lifetime/renewal policies), protect domain controller and KRBTGT material, enforce least privilege on service accounts, and monitor anomalous ticket use. Containing lateral movement and ransomware staging depends on treating hashes and tickets as high-value secrets, not ordinary files.

Publishing domain admin passwords in an intranet FAQ multiplies compromise. Disabling logging blinds responders to ticket anomalies exactly when investigation is required. Antivirus signatures alone do not protect reusable authentication material once adversaries authenticate as legitimate principals.

Exam caveat: CISSP Domain 3/identity-related engineering expects recognition that pass-the-hash and Kerberos forgery abuse authentication artifacts; recovery must include secret rotation and protocol hardening, not only malware cleanup.

Operational check: rotate KRBTGT and privileged credentials on a planned schedule and after suspected compromise; enable advanced auditing for unusual TGT/TGS patterns; prefer modern auth (Kerberos AES, Credential Guard where applicable, gMSA); segment admin tiers; validate that ransomware staging paths no longer reuse harvested hashes across tiers.