Identity Protection: The New Cyber Frontier
Key Points
- Identity protection has surged to the top of cyber‑security priorities because, according to the 2024 IBM X‑Force Threat Intelligence Index, 30 % of attacks were phishing and another 30 % exploited compromised valid accounts, making identity management the leading attack vector.
- It is a core pillar of the “identity fabric,” a framework that unifies seven elements—Orchestrated Workflows, Risk‑Based Authentication with AI behavioral analysis, Legacy Application Gateways, Identity Protection itself, Directory Synchronization for a single view of access, Identity Governance for onboarding/off‑boarding, and Privileged Account Management to satisfy cyber‑insurance requirements.
- Identity protection now encompasses “Identity Threat Detection and Response,” shifting from passive monitoring in SIEMs to proactive detection of compromised credentials through real‑time analytics and automated remediation.
- The approach also integrates “Identity Threat Hunting,” which uses threat‑intel feeds and attack‑path modeling to actively seek out signs of credential abuse before attackers can leverage them.
- By combining these detection, response, and hunting capabilities within the identity fabric, organizations can reduce the risk of credential‑based breaches and meet the stringent demands of regulators and insurers.
Full Transcript
# Identity Protection: The New Cyber Frontier **Source:** [https://www.youtube.com/watch?v=RvCq3_nJv6A](https://www.youtube.com/watch?v=RvCq3_nJv6A) **Duration:** 00:08:46 ## Summary - Identity protection has surged to the top of cyber‑security priorities because, according to the 2024 IBM X‑Force Threat Intelligence Index, 30 % of attacks were phishing and another 30 % exploited compromised valid accounts, making identity management the leading attack vector. - It is a core pillar of the “identity fabric,” a framework that unifies seven elements—Orchestrated Workflows, Risk‑Based Authentication with AI behavioral analysis, Legacy Application Gateways, Identity Protection itself, Directory Synchronization for a single view of access, Identity Governance for onboarding/off‑boarding, and Privileged Account Management to satisfy cyber‑insurance requirements. - Identity protection now encompasses “Identity Threat Detection and Response,” shifting from passive monitoring in SIEMs to proactive detection of compromised credentials through real‑time analytics and automated remediation. - The approach also integrates “Identity Threat Hunting,” which uses threat‑intel feeds and attack‑path modeling to actively seek out signs of credential abuse before attackers can leverage them. - By combining these detection, response, and hunting capabilities within the identity fabric, organizations can reduce the risk of credential‑based breaches and meet the stringent demands of regulators and insurers. ## Sections - [00:00:00](https://www.youtube.com/watch?v=RvCq3_nJv6A&t=0s) **Identity Protection and the Identity Fabric** - The speaker explains how identity protection—comprising orchestrated workflows, AI‑driven risk‑based authentication, and broader identity‑fabric management—addresses the surge in attacks exploiting compromised credentials. ## Full Transcript
hi I'm here today to talk about one of
the most exciting new Innovations in
cyber security and that is the concept
of identity protection what we're going
to talk about today is
what is identity protection identity
management has become one of the hottest
issues in cyber security today because
if you look at the attack vectors of the
last 12 months um literally identity
management is the top two attack vectors
that hackers are using our 2024 ibmx
Force threat intelligence index shows
that 30% of all attacks in the last 12
months were fishing and another 30% were
actually leveraging a compromised valid
account so identity management has
become the predominant attack vector and
identity protection has evolved in the
last couple years to be focused on
addressing exactly that so we're going
to answer that question today I identity
protection is actually three different
things the first thing that it is is
identity protection is one of the
critical elements of properly addressing
What's called the identity fabric the
identity fabric is how do we manage
identities across the hybrid reality
that almost everybody has today so that
includes Seven Elements first we have
the ability to do orchestrated workflows
to do things like add frictionless
support support to Legacy applications
second is the ability to do risk-based
authentication to add AI based
behavioral analysis to authentication so
when someone leverages a compromised
valid account one of the primary attack
forms is that you can tell it's not them
using that account third is Legacy
application gateways that allow you to
pull in the Legacy apps into the latest
identity management controls such as
frictionless access fourth is this topic
of identity protection which we're going
to dive into next fifth is directories
and directory synchronization so you can
answer the question that nobody seems to
be able to answer today which is show me
a single view of who has access to any
of your systems six is identity
governance so you have proper onboarding
and offboarding and management of
identities and then seventh is
privileged account management so you
make make sure you're addressing
something that cyber insurance providers
have been focused on which is have you
really rolled out privileged account
protection across the board and in fact
they're threatening not to renew policy
so it's become a big issue so that's the
first thing that identity protection is
a critical element of addressing the
hybrid nature of identities today
through the identity fabric the second
thing that identity protection is is the
combination of two brand new Innovative
space inside spaces in cyber security
first is identity threat detection and
response identity threat detection
response is pointing out the fact that
traditionally the way people identify
identity Focus threats is by sitting in
their Sim tool in their security
operations center and waiting for like a
user Behavior Analytics tool to deduce
that there's an identity problem that is
far too passive for the fact that
identities had become the predominant
attack VOR
so itdr is focused on how do I find and
manage those threats close to the
identity Source It's a combination of
that with another brand new space which
is called identity security posture
management you know it's kind of funny
because right now the whole concept of
fabrics and posture are really hot in
cyber security across all the spaces and
what that is applied against identity
management is really profound it's doing
things like how can I find poor posture
in my configuration that could lead to
an attack being more successful down the
road things like multiactor
authentication bypass finding shadowed
directories and stuff like that right so
you have to have good posture and then
be able to find the threats as they're
happening that's the second thing IID
think protection is it's a combination
of itdr and ispn the third thing that
identity protection is and this is the
most profound impact is that it
links the security Operation Center with
the identity and access management stack
intimately for the first time in most
organizations the sock is operating the
identity Technologies are operating and
there's not a really close linkage
between those tools especially around
threat detection response identity
protection because of the combination of
these two spaces does exactly that so
let's look for a moment about what this
stuff actually does the value in
identity protection by combining itdr
and ispn is it provides three different
things the first thing that it does is
it shows us
identity blind
spots now what are identity blind spots
identity blind spots are finding things
like
Shadow assets that people are accessing
that we weren't aware they're accessing
it's finding things like Shadow
directories where you have people
authenticating against a directory that
you didn't even realize was out there we
finding everybody's got them and they
just didn't know they were there right
so that concept of finding blind spots
that we weren't aware of it's also
finding things like
unauthorized application
access like unauthorized SAS apps that
we didn't know about that's the first
thing is identifying identity blind
spots the second thing that identity
protection does is if finds
identity infrastructure
gaps so what does that mean that's
finding things like
misconfigurations that would enable an
attack to be more effective than uh we
would want it to be of course and then
also hazardous
deviations in
policy so you might have a security uh
policy put in that says access to this
application has to be controlled by
multiactor authentication and you have
mfi MFA bypass taking place you weren't
aware of it but when you see it you can
lock that up right and then finally the
third thing that identity protection
does is it gives us the ability to look
at
identity
risky
behaviors this is especially the threat
management side of it right it's looking
at can I detect in real time at the
source at the identity management stack
and by the way this clearly leverages AI
because to be able to do this
effectively you have to have a force
multiplier in your capability and it's
the ability to identify and handle
threats that are happening against my
identity stack and against my identities
so it's looking for things like Brute
Force attack on a particular IDP it's
looking for things like credential
stuffing so it's detecting the threats
as they're happening and then
immediately sending them over to your
Security operation Center to be handled
for your sim tool to process it and for
your sore capability to actually go do
something with it it's especially the
biggest thing that we're finding here is
when you have workflows that are
bypassing critical systems such as your
ztna your VPN and your p
controls right can you detect when you
have those things in place and someone's
found a way around them and that that's
being used that's the huge thing here so
this is what identity protection is a
critical element of the identity fabric
the combination of two new Innovations
around identity threat detection
response and identity security posture
management and it links the sock with
the identity stack intimately For the
First Time by addressing identity blind
spots identity infrastructure gaps as as
well as identifying risky behaviors like
the bypasses thanks for your time if you
enjoyed this video and want to see more
like it please like And subscribe if you
have any questions or want to share your
thoughts about this topic please leave a
comment below