Identity Threat Detection and Response
Key Points
- IBM’s 2024 data‑breach report shows compromised credentials are the leading cause of breaches, highlighting identity and access management (IAM) as a critical security focus.
- Security fundamentals are expressed as “prevention + detection + response,” with IAM prevention encompassing governance, provisioning/deprovisioning, least‑privilege enforcement, MFA, adaptive access, and role‑based controls.
- Detection and response for identity‑related threats have traditionally been handled by generic SIEMs, creating a gap that calls for a dedicated “IAM SIEM” or identity‑focused threat detection and response capability.
- An effective identity threat detection and response system follows three phases—collect, detect, and respond—mirroring the structure of traditional SIEM platforms.
- The collection phase pulls data from identity sources such as identity providers (IDPs), single sign‑on services, and other authentication touch‑points to provide context for subsequent threat analysis.
Sections
- Credential Threats and IAM Fundamentals - The speaker highlights that compromised credentials are the leading cause of data breaches and outlines IAM prevention tactics—governance, provisioning/deprovisioning, recertification, least‑privilege, MFA, adaptive access, and RBAC—while pointing out that detection and response are typically handled by SIEM solutions.
- Combining Directory and Flow Data for Security - The speaker explains how identity directories (e.g., LDAP/Active Directory) and network flow data can be integrated to enhance logging, tamper‑resistance, and SIEM visibility.
- Detecting ‘Did Not Happen’ Scenarios - The speaker explains that SIEMs capture events that occur but often miss absent actions such as skipped MFA, and proposes using finite state machines to model proper state transitions and flag when required steps fail to happen.
- Detecting Access Bypass Scenarios - The speaker explains how state‑diagram tracking can reveal internal or external users circumventing controls such as the IDP, VPN, or PAM—highlighting bypasses that SIEM alone may miss.
- Identity as New Perimeter - The speaker warns that legacy authentication protocols expose organizations to risk and stresses that without an identity threat detection and response capability to monitor, detect, and remediate these threats, the identity layer becomes an unguarded front door.
Full Transcript
# Identity Threat Detection and Response **Source:** [https://www.youtube.com/watch?v=nXal8XnGmJo](https://www.youtube.com/watch?v=nXal8XnGmJo) **Duration:** 00:13:15 ## Summary - IBM’s 2024 data‑breach report shows compromised credentials are the leading cause of breaches, highlighting identity and access management (IAM) as a critical security focus. - Security fundamentals are expressed as “prevention + detection + response,” with IAM prevention encompassing governance, provisioning/deprovisioning, least‑privilege enforcement, MFA, adaptive access, and role‑based controls. - Detection and response for identity‑related threats have traditionally been handled by generic SIEMs, creating a gap that calls for a dedicated “IAM SIEM” or identity‑focused threat detection and response capability. - An effective identity threat detection and response system follows three phases—collect, detect, and respond—mirroring the structure of traditional SIEM platforms. - The collection phase pulls data from identity sources such as identity providers (IDPs), single sign‑on services, and other authentication touch‑points to provide context for subsequent threat analysis. ## Sections - [00:00:00](https://www.youtube.com/watch?v=nXal8XnGmJo&t=0s) **Credential Threats and IAM Fundamentals** - The speaker highlights that compromised credentials are the leading cause of data breaches and outlines IAM prevention tactics—governance, provisioning/deprovisioning, recertification, least‑privilege, MFA, adaptive access, and RBAC—while pointing out that detection and response are typically handled by SIEM solutions. - [00:03:05](https://www.youtube.com/watch?v=nXal8XnGmJo&t=185s) **Combining Directory and Flow Data for Security** - The speaker explains how identity directories (e.g., LDAP/Active Directory) and network flow data can be integrated to enhance logging, tamper‑resistance, and SIEM visibility. - [00:06:14](https://www.youtube.com/watch?v=nXal8XnGmJo&t=374s) **Detecting ‘Did Not Happen’ Scenarios** - The speaker explains that SIEMs capture events that occur but often miss absent actions such as skipped MFA, and proposes using finite state machines to model proper state transitions and flag when required steps fail to happen. - [00:09:20](https://www.youtube.com/watch?v=nXal8XnGmJo&t=560s) **Detecting Access Bypass Scenarios** - The speaker explains how state‑diagram tracking can reveal internal or external users circumventing controls such as the IDP, VPN, or PAM—highlighting bypasses that SIEM alone may miss. - [00:12:26](https://www.youtube.com/watch?v=nXal8XnGmJo&t=746s) **Identity as New Perimeter** - The speaker warns that legacy authentication protocols expose organizations to risk and stresses that without an identity threat detection and response capability to monitor, detect, and remediate these threats, the identity layer becomes an unguarded front door. ## Full Transcript
The bad guys know that it's easier to log in than it is to break in.
In fact, in 2024, IBM did the cost of a data breach report where we found
that the number one way that bad guys get into systems and cause these data breaches relates to
credentials, lost or stolen compromised credentials, think passwords.
So this is really in the space of identity and access management.
So what can we do about it?
Let's go back to fundamentals.
So let's start with a simple equation.
Security equals prevention plus detection plus response.
Everything we do in security involves one of those three things and hopefully all of those three things.
Well, what do we do in IAM for the prevention stuff?
Well, let's take a look in the identity management portion of this.
That's where we do governance and things like that.
We're basically looking at provisioning accounts and access rights, deprovisioning those things.
In other words, taking away those access rights, in the right, at the right moment,
and then doing recertification campaigns
where we go back and make sure that everything an individual has is what they in fact still need,
so that we preserve the principle of least privilege.
On the access management side.
It's things like multifactor authentication.
It's adaptive access.
It's role based access control.
And these technologies basically are what we've done in order to do prevention,
but what about the detection and response part of this?
Well, that's largely been left as an area for the SIEM, the security information and event management systems.
They're the ones that do the detection.
That's I find there's a problem and response.
Now I'm going to do something about it.
But we need really a capability to do an IAM SIEM,
basically an identity, a threat detection and response capability so that we have an answer for detection and response in IAM.
That's what this video is going to deal with.
So hang on and I'll take you through how we can do that.
What goes into an identity threat detection and response system?
Well the three phases are collect which we're going to cover first, detect and respond.
So how do you do the collection?
Well, let's think of it this way.
If I have my system here and again, we need to think about this
as being if you're familiar with a SIEM, a security information event management system.
This is an identity SIEM sort of.
So Well, think of it that way.
Where is it going to do its collections?
Well, it's going to draw from identity sources and things that have information related to that.
An example would be something we call an IDP, an identity provider.
That's the thing that, for instance, you go to a portal and it authenticates you.
That's what you're logging into,
and then maybe a does single sign on and refers you to other sites and vouches for you.
So that's going to be one source of information into here.
That's going to provide context because it's going to know who the user is to begin with.
Another source of information be pretty important here is a directory.
In an identity and access management system
a directory is anywhere we store identities that be user IDs, passwords, other kinds of information about the user as well.
And these two can be used in combination.
So we might have multiple directory sources.
So these things you may hear the protocol LDAP lightweight directory access protocol.
That's what you access information in a directory or active directory, which is a very common directory that's in use these days.
Other information that would be useful is flow data.
So that is there are things that happen on the network that we'd like to collect that information as well.
So examples might be information from firewalls.
It could be information from a SASE product.
If you have one of those and familiar with what those are about, out of scope for what this discussion is.
It could also be flow collectors that you put into your network.
Why are those useful?
Well, we're going to pull logs from these sources, but someone might come in and hack the log here,
make changes, delete the log, maybe well flow data if I have a collector.
Information flowed across the network and it made a copy.
I can't now.
The bad guy would have a hard time deleting that copy because that information's already on a different system.
So the network never lies, as people like to say.
If I can capture the information going across the network, that adds yet additional information and additional visibility into this,
and then why not also add the SIEM in here as well?
So our security information event management system, it's got lots of different sources of information that are feeding into it,
and it would be really useful to take some of that and feed it in to our identity threat detection and response system.
Once I've gathered all of that information, well, then
I'd like to put that out into a dashboard and do some visualization show where the risky users.
Show where the suspicious accounts might be.
Show where.
And I'll take you through more examples of what kinds of things we might look for in in just in just a few minutes.
One other thing to take a look at here is you say, well, why would the SIEM be here?
Why wouldn't you have this report into the SIEM?
Well, in fact, you could this could be a two way flow.
So this is what the security operations center cares about.
That's their view into the world is the SIEM because it's going to have this network systems a very comprehensive view,
whereas this is going to have the IAM identity specific view.
So if you have a team that just focuses on identity and those kinds of issues, well then this might be basically their SIEM.
So there could be a symbiotic relationship where each one of these systems
feeds the other and they all benefit from that sharing.
So now we've done the collection.
Let's do the detection, let's talk about what we're going to detect,
what are we going to use as indicators to tell us that we've got a problem we need to do something about?
Well, I'll tell you again, I'm going to go back to our old friend, the SIEM, the Security information and event management system.
So SIEMs are really good at certain things, but not everything.
And that's true of most tools.
So a SIEM is really good at telling you what did happen.
What they're not so good at is telling you what did not happen.
So it's good at seeing this is what happens.
So for instance, someone actually logged in and they were successful.
A user went and did get logged in or maybe they didn't get logged in so it could log unsuccessful attempts as well.
But what it wouldn't have necessarily noticed is that someone did log in.
But what we didn't see happen was multifactor authentication.
In other words, they had a sort of weak authentication to get in.
The SIEM would just see that this was a log in and that's probably all you'd have to do.
A lot of customization to give it the smarts would recognize that this is a condition we need to know something about.
Okay, so bear that in mind.
And what we're going to take a look at is a technology that allows us to find some of these did not happen scenarios.
I'll take you through some of those here.
I'm going to start off with a thing going back to my days as an undergrad, we call a finite state machine.
So these are different states and this is a diagram that indicates what are the proper flows from one state to another.
The should occur conditions and then we'll go through a couple of should not occur conditions.
So, for instance, let's say we have an internal user, internal user wants to hit just a general purpose app within the organization.
So the internal user hits the IDP, the identity provider, they log in and from there they are able to hit the general purpose app.
No big deal.
Let's say they want to hit something that's sensitive.
So now this user comes in, hits the IDP logs in,
but part of the login process makes them go off and do multi-factor authentication,
prove that you're with a greater degree of certainty you are who you claim to be.
And then once they pass that, then they're allowed into the sensitive app.
Okay, so far so good.
How about a scenario where we have an external user?
Well, an external user, we want them to come in through the VPN and the virtual private network.
Then they hit the IDP, then they log in to multifactor authentication and then they're able to hit the sensitive app.
So those are all should occur conditions.
And then let's say an external user, which might be an employee working from home or off site,
needs to get to a privileged account that's one that controls.
Say it's the root account or it's a sysadmin account or database administrator account, network administrator account.
Well, it's really super sensitive accounts.
Okay.
They're going to come in through the VPN.
They're going to hit the IDP to log in.
They're going to come down and authenticate strongly.
Then they're going to hit our privileged account management system or privilege access management system.
Then from there, they get the credentials to actually log into this.
So there we go.
That's a hypothetical situation that's basically talking about these are the situations that should occur.
These are the states that should be allowed to happen.
Now, that's what did happen or could or should have happened.
What if something like this occurs?
What if an internal user just comes in and directly hits the the general access app?
Okay, that might be a problem.
That's a bypass of the IDP.
So we would want to know about that.
And if you had a state diagram tracking all of that, it would tell you that,
let's say they came in and they hit the IDP,
but then from there they went straight to the sensitive app and somehow or other were able to get in.
How could that happen?
Well, if this thing was misconfigured, maybe someone left a backdoor intentionally or unintentionally
and this person didn't follow the process correctly.
Then we would have a multifactor authentication bypass.
So that's another condition or something that did not occur that a state diagram would be able to highlight.
Let's take another example.
Let's say we've got this external user who just skips by the VPN and comes right straight in and hits this.
Okay, that's a VPN access bypass.
So a different type of bypass.
And then maybe we have someone who comes in through a VPN,
they hit the IDP and then from there they go straight down to this privilege account.
Now we have PAM bypass, so you can see each one of these controls that we've put in place.
Are designed to provide additional security.
But if we're not checking all of the conditions, we might in fact find that somebody found a backdoor.
They were able to find a bypass and get around that and the SIEM wouldn't be a great tool necessarily
for highlighting that for you, but an identity threat detection and response tool that has
this kind of intelligence built into it would be able to see that.
Some other examples it might look for.
There's a thing called a password spraying attack in this case,
you know, if you try to log in to an account with a bad password, usually you get three strikes.
You first time if you don't get the password right.
It notes that second time.
It notes that the third time, if you get it wrong now, you're locked out so bad guys only get three tries at trying to break in.
So instead, with a password spraying attempt, they take a password and they try it one time on one account.
Then they try it on another account.
They try it on another, and another, and another,
and that way they fly slow and low below radar, at least in most radars.
The SIEM probably would not see that because it only looks like one failed attempt.
This system, though, would be able to see that there's a frequency that's occurring here, this same type of thing.
A guy is just going through and hitting all of these different accounts.
So we wouldn't highlight that.
That would be another detection scenario.
How about shadow IAM?
meaning the IT organization didn't bless it,
didn't look at it, didn't configure it.
It's not following the policies of the organization.
So I'd be able to go and discover that there are other directories or other sources of identity that are out in my environment,
and I'd want to be able to make sure that they're configured and locked down.
There might be risky authentication protocols as well.
Maybe some of these protocols that have been around for ages
that have had vulnerabilities in them that haven't been fixed, and somebody just brought up a tool and now they're starting to use it
and now they've exposed our organization because this is a risky authentication protocol, lots of different possibilities.
I've only listed a few of them here,
but you get the idea that an identity threat detection and response tool
would be able to do a better job of finding these kinds of threats.
We used to think of firewalls as the edge of the environment,
but now people realize that identity is the new perimeter all the way out to the end user.
And if you don't have an identity threat detection and response capability
that allows you to collect, detect and respond to those threats, you've effectively left the front door wide open.
And it's chilly in here.