Overview

Discover how Privilege Zones help you organize and segment your environment based on sensitivity and access level.

Privilege Zones help you organize objects in your environment into logical groups based on their privilege and risk levels. Using Privilege Zones, you can monitor and maintain the security posture of tiered isolation models.

The Privilege Zones feature is available under early access.

Key concepts

Review these key concepts before exploring Privilege Zones. You can find detailed explanations for each concept in the articles throughout this section.

Concept	Description	Used in Risk Analysis
Zone	A group of objects representing the hierarchy of control across all domains in an environment (based on access level)
Label	A flexible way to categorize objects for easier searching and filtering
Certification	Enterprise Edition An optional process to interrupt automatic inclusion of additional objects in a zone by requiring manual certification of the additional objects

Zones organize objects into a strict hierarchy. BloodHound analyzes how object privileges are assigned and where they can be escalated across your environment.

By default, BloodHound includes a Tier Zero zone that represents a set of objects with full control over an environment and any objects with control over those objects. See Tier Zero: Members and Modification to learn more.

BloodHound Enterprise customers can create additional zones to match their organization’s security model. However, analyzing them requires the Privilege Zone Analysis feature (available for purchase). For more information, contact your sales representative.

If BloodHound Enterprise detects an object in a lower-privileged zone controlling an object in a higher-privileged zone, it identifies it as a finding in the Attack Paths and Posture pages. For example, if a Tier One user can control a Tier Zero server, BloodHound flags it as a violation of the privilege model.

This analysis helps you identify and remediate privilege escalation paths and misconfigurations that violate your security model.

Features

The Zone Builder page provides tools for configuring and managing your privilege zones.

Once configured, BloodHound Enterprise analyzes your zones and displays findings in the Attack Paths and Posture pages.

The Zone Builder page provides the following tabs:

• Zones: A group of objects that represent the hierarchy of control across all domains in an environment based on access level
• Labels: A flexible way to categorize a group of objects in a single zone (or across multiple zones) for easier searching and filtering
• Certifications Enterprise Edition: An optional process to interrupt automatic inclusion of additional objects in a zone by requiring manual certification of the additional objects
• History: An audit log of changes made to your zones and labels over time

These tools enable further risk mitigation in your environments by highlighting the violations and misconfigurations in your tiered network model.