What is the best way to lock-down Windows 2008 R2 Active Directory domains with two-way transitive trusts?

Here's the scenario I am working with and would welcome thoughts from the experts here on best way to address it:

Secure environment from external and internal threats by reducing attack surface.

Single forest with two domains: production and DMZ. Production and DMZ both have a two-way trust established with selective authentication (read and authenticate). An application layer next-gen firewall (Palo Alto) is sitting between the two environments.

DMZ domain has one-way trust enabled with selective authentication and is the trusting domain for the external third-party domain. this is being used to allow access to external parties to view relevant information available in the dmz domain.

Operational requirements:
AD LDS is utilized to synchronize an in-house developed application data across Production and DMZ domain and as a result a number of ports are open between the two domains. Separate LDS instances cannot be maintained for the two environments.

Additional info:
 - The environment is well patched but occasionally the patch cycle is missed leaving the environment exposed.

- Link between dmz and external domain is via a private leased line (HSDL). Internet connectivity is available within the dmz domain but not in the production domain.

 Question: How do we lockdown the environment without impacting operations?
Who is Participating?
DeleteConnect With a Mentor Commented:
The overhead would be placed on the terminating ends.  So if you are going from server to server then the over head would be on those nodes.  This is simply because they are doing the encryption/decryption.  It will not impact your LDS traffic, when you setup IPsec you choose the source and destination (can be single machine or full subnet) along with what ports and protocols are allowed between those hosts.  You would need to setup an IPsec rule on every machine that needs to talk to the DMZ and vice versa, but this can be done through GPO.

A few things to keep in mind with IPsec.
1. Depending on your environment it can become very complex so extensive planning needs to occur.

2. The most secure way to implement IPsec is to have the tunnel terminate at your boundary device so that you don't have an encrypted tunnel going through your firewall (you can only do this if your firewall is capable of this, but this will increase the overhead considerably).  If you do an encrypted tunnel through your firewall then you can't inspect the traffic and you would need at the very least HIPS installed on each endpoint.  

3.  If you setup your IPsec rules incorrectly, you can accidentally isolate your machines so again plan thoroughly and carefully.

Refer to these two articles for more information:
MaheshConnect With a Mentor ArchitectCommented:
From management point you have to manage two AD domains

From security stand point what you have done is perfect according to my opinion if below is true.
I hope there is no trust exists between production domain and DMZ domain, or else it will like partially defeat purpose of having separate DMZ domain, because in that case it will not remain totally isolated environment
AD LDS is different from active directory and you can have AD LDS ports opened between production instance and DMZ instance, anyhow you cannot skip that requirement since same application \ database is used in production and DMZ I guess.

Now for 3rd party external domain, instead of building one way trust with selective authentication, you might consider implementing ADFS server (Federated trust) which will provide required resource access without need of domain trust
You can search ADFS infrastructure on internet
Note that both source and destination domain needs to deploy ADFS server infrastructure and you have to have certificate based protocol (SAML 2.0) supported by application for authentication (Application must be ADFS aware - can work with SAML 2.0 protocol)

Because according to me domain trust is hole in security and best suited within corporate network \ LAN only.

Identify and Prevent Potential Cyber-threats

Become the white hat who helps safeguard our interconnected world. Transform your career future by earning your MS in Cybersecurity. WGU’s MSCSIA degree program was designed in collaboration with national intelligence organizations and IT industry leaders.

Mohammed KhawajaManager - Infrastructure:  Information TechnologyCommented:
aDFS is the best solution and note that this is how cloud apps are deployed on hosted services.  This would be no different.
artsandtechAuthor Commented:
thanks all but considering I am opening ports for LDS traffic between the two domains,  is there something else that can be done to further reduce this exposure apart from the obvious firewall filters ?
According to my knowledge firewall filters are sufficient and you can't do more than this

You may follow MS best practices to harden ADLDS servers but same time you need to ensure that your application will work correctly

Hardening involves
disabling non essential services
Renaming local administrator account
Disabling guest account
Installing appropriate MS security updates and service packs
Installing appropriate Anti virus softwares with proper exceptions
You will get standard server lockdown documentation \ links on internet

You can implement IPsec and encrypt the traffic between your domains.  That way the only traffic going through the firewall is encrypted traffic and you only need to allow the IPsec ports.
artsandtechAuthor Commented:
Ipsec is an interesting idea,  but what about overheads? Will it impact my AC-LDS traffic? How do Ipsec connections get setup for LDS replication? All to all across domains?
artsandtechAuthor Commented:
thanks both Mahesh and Justin. I have to do some more research and testing before taking any actions.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.