After a city Active Directory compromise, responders find reused NTLM hashes, forged Kerberos tickets, and ransomware staging. Which engineering focus best addresses the crypto and authentication-material risks highlighted by those attack methods?
Select an answer to reveal the explanation.
Short Explanation
Once attackers hold hashes and tickets, they walk around like they belong there—and ransomware often rides that access. Guard the auth secrets, rotate them, and stop treating password hashes like ordinary files.
Full Explanation
Pass-the-hash, Kerberos ticket abuse (for example golden/silver ticket patterns), and ransomware frequently follow domain compromise when authentication material is reusable and poorly protected. Security engineering must harden credential storage, enforce rotation and least privilege for service accounts, monitor anomalous ticket use, and reduce lateral movement paths. Treating hashes and tickets as high-value secrets is central to containing these outlined attack methods.