Identity attacks: Step 1 of the hacker handbook
If a hacker handbook exists, the first few tips and tricks are definitely to compromise credentials, to take advantage of excessive privileges and to abuse policy. After all, these are the easiest ways to access and abuse your organization’s critical data.
These days, it’s especially easy for a well-versed hacker these days, with the traditional identity security processes of the past remaining largely manual and retrospective. Identity threats move at machine speed while governance moves at human speed, meaning threat actors can infiltrate with AI and then exploit the time it takes to detect their presence.
But credential abuse doesn’t even have to originate from the shadowy unknown. In fact, most breaches come from inside an organization – from internal actors using their company-granted access to steal data.
How can any company expect to detect so many fast-moving attacks that could be coming from any side?
That’s where identity threat detection and response (ITDR) comes in.
Identity threat detection and response (ITDR)
What is ITDR?
Just like the practice of Zero Trust, ITDR is an identity governance and administration (IGA) mindset and discipline toward security practices. It combines not just tools but also processes and policies to enforce identity defense protocols.
ITDR recognizes that prevention alone is no longer enough, and it assumes that security failures will happen and focuses on detecting those failures and automating strong policies in response.
How is this happening? Especially if you already have threat detection solutions in play?
The mindset of ITDR works in tandem with any legacy IGA threat detection tools to pool their data from across systems for full-picture clarity. This makes a solution implementing ITDR more effective than any single tool, or even multiple tools, that might be culling information, as it empowers administrators with a consolidated view of how identity is being used across an entire enterprise.
What ITDR is not
It may sound too good to be true! But remember: ITDR is not meant to be a replacement for SIEM tools.
But it’s also not simply an Active Directory (AD) monitoring protocol or a series of alerts without action. The beauty of ITDR is the in the R – “response.”
Threat detection isn’t the only offer on the table when employing ITDR within a security solution. Enforcing strong security policies, such as step-up authorization using risk scoring, against detected threats is the powerhouse function of the tools implementing ITDR.
These enforcements can be completely automated or monitored with human oversight as needed, ensuring an impermeable but flexible level of security that can work with any organizational structure.
ITDR with One Identity Manager
One such solution that enables and even enhances ITDR capabilities is One Identity Manager: An IGA tool predesigned to understand identity relationships, access intent, policy context and more.
And with the release of its newest update, One Identity Manager 10.0, user can now use built-in playbooks that support and strengthen an organization’s ITDR. It is no longer just a system of record, but a decision and response engine for identity risk, with new features like:
-
The ability to ingest user risk scores from third-party external sources
-
Native ITDR playbooks that automate response actions
By pulling data from multiple systems, the playbooks provided by One Identity Manager 10.0 allow an organization to detect threats, recalculate the risk scores from those systems, and then automatically enforce security policy with full auditability and ultimate identity governance.
With these ITDR playbooks at your fingertips, you can turn that governance into policy-driven response action with full automation and no manual scrambling. It will allow you not just to close, but to shred the hacker handbook that can and will be used against you.
