Hacking the Hybrid Cloud (Q&A)

Active Directory and cloud identity security expert Sean Metcalf (founder of Trimarc Security) joins DEF CON moderators Jurus and Patrick to answer audience questions on hybrid cloud security and Azure Active Directory (now Entra ID) attack paths [00:11]. Metcalf addresses the security frictions that arise when enterprises synchronize legacy on-premises Active Directory environments with Microsoft 365 and Azure cloud workloads [11:39]. He explains that the rapid pace of cloud feature deployment often outpaces organizational governance, leaving critical gaps between legacy infrastructure teams and cloud architects [17:20].

The discussion focuses heavily on identity federation, credential synchronization, and single sign-on (SSO) architectures [22:44]. Metcalf analyzes the security trade-offs of password hash synchronization (PHS) versus Active Directory Federation Services (AD FS) and pass-through authentication (PTA). He warns that attackers who compromise on-premises domain controllers or identity federation servers can forge SAML tokens (the Golden SAML technique) or abuse Azure AD Connect synchronization accounts (`MSOL_`) to escalate into global administrative privileges across the entire cloud tenant [28:18].

Metcalf shares practical guidance for red teams and defenders on auditing hybrid identity trust boundaries. He outlines essential defensive hardening strategies, including restricting Global Administrator accounts to pure cloud-only identities, enforcing phishing-resistant multifactor authentication (MFA), monitoring privileged role activations via Privileged Identity Management (PIM), and isolating tier-0 identity assets from hybrid sync pipelines [33:50].

(AI summary — Gemini Flash)