Commvault enhances identity resilience with new Active Directory tools

Commvault has announced a series of enhancements to its Identity Resilience portfolio, introducing new capabilities to help organisations detect, audit, and rapidly reverse malicious changes within Microsoft Active Directory (AD) environments. The updates are part of the company's focus on providing greater security for enterprise identity systems, which frequently face targeted attacks.

The new tools employ integrated vulnerability assessment, identity change monitoring, and anomaly detection to identify risks among users, groups, and policies in AD. These measures aim to tackle the ongoing challenge of attackers exploiting AD to gain unauthorised access to business-critical systems.

Industry research points to AD as a key target in cyberattacks, with attackers often seeking opportunities to steal credentials or manipulate access permissions.

The new auditing features provide IT and security teams with detailed visibility into changes within the AD infrastructure. Each significant change is automatically logged, capturing who initiated the change, when it occurred, and the originating location. This level of auditing is designed to support ongoing compliance and investigation processes in the event of a security incident.

If a suspicious modification is detected, teams can use the recorded log to swiftly reverse unauthorised changes. Recovery can be triggered directly from the change log, eliminating the need for users to manually for recovery points or objects.

Forest recovery integration

Commvault is integrating its AD forest recovery tools with its Cleanroom Recovery offering. This integration enables customers to recover AD forests in an isolated cleanroom environment, allowing recovery plans to be tested proactively without affecting active identity systems. The approach is intended to help organisations prepare for and mitigate disruption should an attack on identity systems occur.

Commvault representatives said that these centrally-managed identity resilience functions are unified with the company's data protection and security capabilities to support customers in lowering operational complexity and total cost of ownership.

External analysts noted the seriousness of identity-targeted compromises for enterprises, with consequences including potential data breaches and financial loss. The expanded tools could help organisations respond effectively to attacks focused on identity data and permissions within AD.