RSoP-Based Indicators of Exposure

Tenable One Identity Exposure uses a set of RSoP (Resultant Set of Policy) based Indicators of Exposure (IoEs) to assess and ensure the security and compliance of various aspects of your Active Directory environment. This section provides insights into the current behavior of specific RSoP IoEs and how Tenable One Identity Exposure addresses performance concerns associated with their computations.

The following RSoP-dependent IoEs play a role in Tenable One Identity Exposure's security framework:

  • Logon Restrictions for Privileged Users

  • Dangerous Sensitive Privileges

  • Application of Weak Password Policies on Users

  • Insufficient Hardening Against Ransomware

  • Unsecured Configuration of Netlogon Protocol

These IoEs depend on an RSoP computation cache that initializes on demand, computing new values as needed rather than relying on precomputed ones. Previously, changes to AdObjects triggered cache invalidation, leading to frequent re-computation during the IoE’s RSoP executions.

Tenable One Identity Exposure addresses the performance impact associated with RSoP computations as follows:

  1. Live IoE analysis with potentially obsolete data — The computation (input/output event) of IoEs that rely on RSoP takes place in real time as they occur, even if the data used for processing may not be the most current. Buffered events that have the potential to invalidate the RSoP cache remain stored until they meet a specific condition, prompting the anticipated computation.

  2. Scheduled RSoP invalidation — Upon meeting the condition for re-computation, the system invalidates the RSoP cache, taking into account buffered events during the invalidation process.

  3. Re-execution of IoEs with up-to-date cache — Following the cache invalidation, IoEs undergo re-execution with the most recent version of the AdObject from the cache, incorporating buffered events. Tenable One Identity Exposure computes each IoE individually for every buffered event.