Hacking the Hybrid Cloud
Active Directory expert Sean Metcalf reveals attack paths bridging on-premises Windows networks and Azure Active Directory in hybrid enterprise clouds.
Summary
The Insecurity of Hybrid Enterprise Deployments
Most global enterprises operate in hybrid environments, connecting legacy on-premises Active Directory forests to Azure AD and Microsoft 365 cloud services.
Attacking Synchronization and Trust Bridges
Sean Metcalf analyzes synchronization components like Azure AD Connect and Active Directory Federation Services (AD FS), uncovering critical trust subversion points.
Pivoting from On-Premises to Cloud Domination
Compromising an on-premises domain controller or synchronization server allows attackers to forge SAML tokens and assume Global Administrator rights in the cloud.
Hardening Hybrid Identity Architectures
Metcalf provides comprehensive architectural blueprints for securing tier-0 identity assets, isolating synchronization servers, and implementing robust conditional access policies.
Related talks
Adversary Village·34 min
Sergey Chubarov
Sergey Chubarov demonstrates live attack scenarios bridging on-premises Active Directory and Azure AD, exploiting synchronization flaws to compromise hybrid clouds.
Main Stage·34 min
Sean Metcalf
Sean Metcalf answers audience questions regarding Active Directory Federation Services, Azure AD Connect security, and hybrid identity hardening.
BSides Edmonton 2025·48 min
Ian Lin · Chance Pearson
Analysts investigate attack surfaces and defenses concerning Trust Boundary Theater: Lateral Movement in the Age of Hybrid Cloud by Ian Lin, Chance Pearson.