Identity Security

What is Identity Security? 

Identity security, also called identity protection, refers to the frameworks and technologies used to secure and manage digital identities within an enterprise. The overarching goal of identity security is to protect against unauthorized access, data breaches, and identity theft. Strong identity security should ensure only authenticated and authorized users can access the resources they are permitted to, in line with the principles of least privilege and segregation of duties. This access should be continuously monitored and audited, ensuring oversight and accountability.

In recent years, transformative shifts in technology, and how and where we work, vastly expanded the identity attack surface. At the same time, many of these trends, such as the dissolving perimeter, made a focus on securing identities more important than ever.

When it comes to identities, none are more critical to protect than privileged identities, which are those identities and their accounts possessing elevated access above that of a standard user. The dynamism of the cloud and proliferation of SaaS accounts across the enterprise, with hundreds of thousands of permission types, blurs the definition of what a privileged user is, within a modern environment. This is why today, arguably, the most important piece of identity security is managing and protecting the paths to privilege.

What is a Digital Identity? 

A digital identity refers to the online persona or set of attributes that uniquely identify an individual, organization, or machine (application, device, etc.) across digital systems. A human identity typically exists as a one-to-one relationship between the human user and their digital presence. A digital presence can consist of multiple accounts, credentials, and entitlements associated with an individual. All non-human / machine identities should have a human owner.

Identities are comprised of various pieces of information, known as identity attributes, which can include usernames, passwords, biometric data, digital certificates, and personal identification numbers (PINs), among others. All of this information requires protection and management.

Identity versus account

It's important to understand the difference between 'identity' and 'account'. An 'identity' is the overall representation of an individual or entity, encompassing all attributes and credentials associated with them. An 'account' is a specific instance within a system where the identity is used. Thus, a single identity can have multiple accounts across different systems, each requiring proper management and security.

Digital identities are used to facilitate interactions on the internet, enabling access to services, transactions, and communications. They play a critical role in cybersecurity by serving as the basis for authentication (authn) and authorization (authz) processes, ensuring access to resources and services is securely managed and controlled in accordance with the identity's permissions and rights.

From the diagram above, you can see how each ‘Account Type’ of the identity, whether human or machine, can contain a multitude of different credential types.

Why is Identity Security Important? 

Digital transformation initiatives, such as cloud migration and expansion, have vastly increased the number of digital identities across organizations and expanded the attack surface cybercriminals can exploit.

Modern identity protection practices are imperative for preventing identity theft, data breaches, system outages, and other security incidents that could lead to significant financial losses, damage to reputation, non-compliance, and even legal repercussions. Compromise of the identity infrastructure itself, such as identity providers (IdPs) like Active Directory and Okta, and IAM solutions, could give an attacker the ability to compromise identities wholesale across the enterprise. This could give the attacker myriad footholds and attack paths to enterprise resources.

Some recent statistics that highlight the importance of identity security:

• 90% of organizations incurred an identity-related security incident over the past year.
• Over 40,000 permissions across key cloud infrastructure platforms can be granted to identities, of which more than 50% are high risk.
• 50% of cloud identities are Super Admins, which are users or workloads that have access to all permissions and resources.
• Adversaries are ramping up their use of valid accounts, which were used to gain initial access in 43% of cloud intrusions over the last year.

Today, remote work and cloud-based services are increasingly the norm. Identity security should enable secure access management across diverse environments, ensuring users, both internal and external (vendors, etc.) can safely access the data and applications they need, regardless of their location. These approaches should not only improve security, but also enhance user experience and operational efficiency.

Identity security also supports compliance with regulatory requirements that mandate the protection of personal and sensitive data, such as GDPR, HIPAA, and numerous others.

In summary, identity security is vital for protecting the integrity, confidentiality, and availability of enterprise information assets.

Common Threat Techniques to Compromise Identities 

Cybercriminals leverage myriad tactics, frequently chained together, to compromise identities and their accounts. An abridged list of common tactics waged to compromise identities include:

1. Social Engineering involves manipulating human users through various means of communication (e.g., phishing emails, vishing phone calls, social media, and even deepfakes, to access confidential information or systems.

2. MFA Fatigue Attacks aim to subvert multifactor authentication defenses by persistently “bombing” a user’s device with MFA requests. These attacks aim to overwhelm or annoy the user to the point where they approve one of the requests—either inadvertently or due to frustration—thus granting the attacker access to secured resources. To succeed, the attacker must first have access to a user’s compromised credentials.

3. Credential Stuffing occurs when attackers use stolen account credentials from one breach and attempt to login to other services, exploiting the common practice of reusing passwords across multiple accounts. Attackers typically use a tool that can automatically scan for services and try to auto-inject the credentials at scale, in hopes they will provide authentication somewhere.

4. Keyloggers are malware that record keystrokes on a victim's device, capturing everything typed, including passwords and other sensitive information.

5. Brute Force Attacks involves attempting to guess a user's credentials by systematically trying numerous possibilities, typically aided by automated software.

6. Password Sprays are a type of brute-force attack where an attacker tries a few common passwords against many accounts to avoid triggering account lockout mechanisms.

7. Hash-based Attacks are cyberattacks that exploit weaknesses in hash functions, allowing attackers to reverse or duplicate hashed data, often used to crack password hashes. Pass-the-hash (PtH) is one common example of such an attack.

8. Kerberoasting is an identity-based threat technique where attackers extract service tickets (Kerberos tickets) from a network and attempt to crack the tickets offline to obtain service account passwords.

9. Account Takeover (ATO) refers to attackers gaining unauthorized access to accounts, leveraging various methods. The attackers often change the account details to lock out the legitimate user and exploit the account for malicious purposes.

10. Lateral Movement occurs after an account has already been compromised and give the attacker a foothold. The attacker can then use a combination of methods, such as any privileges or access rights, to compromise additional accounts, assets, etc. to widen their sphere of control and access.

11. Privilege Escalation encompasses multiple techniques, such as exploiting vulnerabilities or misconfigurations, to escalate privileges and gain higher-level permissions. Privilege escalation attacks ultimately expand a threat actor's access and control over more identities, accounts, and systems.

Threat actors increasingly leverage artificial intelligence (AI) and machine learning (ML) technologies to enhance the sophistication and effectiveness of their attacks. By employing AI/ML, attackers can better automate the discovery and exploitation of software and identity vulnerabilities, making it more efficient to target potential victims at scale.

AI and ML-powered technologies are also enabling the development of more advanced phishing campaigns that can mimic human behavior and writing styles, deceiving even the most vigilant users. AI-driven malware can adapt to its environment, evading detection by changing its behavior or appearance based on the security tools it encounters.

In an audacious 2024 identity-based attack in Hong Kong, threat actors leveraged deepfake technology to perpetrate a $25.6 million heist. The attack simulated an entire video conferencing environment and used a deepfake impersonation of a prominent Hong Kong CFO and other meeting participants to convince a finance employee to transfer $25.6 million into five different Hong Kong bank accounts.

Identity Security vs Zero Trust 

Identity security and zero trust are complementary concepts, with significant areas of overlap.

Identity security centers around the management and security of digital identities. It involves ensuring that individuals or entities are who they claim to be before granting access to sensitive information and systems, while also ensuring that access is appropriately used. Identity security aims to protect against unauthorized access and potential security breaches by closely managing and monitoring who has access to the what, when, and where of resources, based on verified identities.

Zero trust encompasses a broader security framework that operates on the principle of "never trust, always verify." Unlike traditional security models that might automatically trust users and devices within an organization's network, zero trust assumes threats can exist both outside and inside the network. Therefore, zero trust requires verifying the security status and authorization of users and devices, regardless of their location, before granting access to resources. This approach involves enforcing continuous authentication, least privilege access, and micro-segmentation to minimize the attack surface and limit the potential impact of breaches.

While identity security is a critical component of the zero-trust model, focusing on the verification of users and their access rights, zero trust extends beyond identity to include the validation of device security postures and the enforcement of policies that govern how resources are accessed and used.

The 5 Fundamental Identity Security Principles

As cyber threats grow more sophisticated and IT environments become more complex, organizations must evolve their strategies to safeguard user identities and access to critical resources. With that said, 5 areas of focus (known as the 5 As) - Authentication, Authorization, Administration, Analysis/Assessment, and Audit – provide the fundamental framework for holistic identity protection. These strategies not only help in verifying user identities but also ensure that access rights are appropriately managed and continuously monitored for potential security threats.

Let’s delve deeper into each of the 5 A’s and understand how they contribute to a strong identity security posture.

1. Authentication (Authn)

Goal: To ensure a user is who they claim to be.

Strategies: This is typically achieved through mechanisms like passwords, biometrics, multi-factor authentication (MFA), and single sign-on (SSO). MFA is increasingly important, especially for protecting privileged accounts, as it requires an extra security factor to prove the identity, thus helping to protect against a number of account hijacking attacks, such as password reuse threats. SSO allows users to access multiple services with a single set of securely managed credentials, thus reducing password fatigue, while improving user experience.

2. Authorization (Authz)

Goal: Define and enforce what authenticated users or entities are permitted to do within the system, specifying the resources they can access, the conditions under which they can access them, and the actions they are authorized to perform.

Strategies: The authorization process is often controlled by policies, role-based access controls (RBAC), attribute-based access control (ABAC), and other contextual rules established according to organizational needs and security protocols. Privileged Access Management (PAM) is a key technology here for controlling authorization. PAM solutions manage privileged accounts and sessions and implement granular least privilege controls. Application control, often combined with Endpoint Privilege Management, is also important for tightly managing which applications specific users can install or run.

3. Administration:

Goal: Manage the entire lifecycle of digital identities within an organization. This includes provisioning and deprovisioning users and their access rights (referred to as the Joiner, Mover, Leaver (JML) process), as well as the continuous management of identity attributes, roles, and policies.

Strategies: Identity and access management (IAM) solutions can provide processes and automation to help ensure proper security hygiene across the lifecycle of an identity. Within IAM are two important subdisciplines:

• Privileged Access Management (PAM): Responsible for security, management, and oversight of privileged identities, accounts, and sessions across the enterprise.

• Identity Governance and Administration (IGA): Responsible for the provisioning and deprovisioning of identities and accounts. IGA automates processes for granting and revoking access (joiner, mover, and leaver) to assets and resources based on policies.

4. Analysis / Assessment

Goal: Understand your identity estate inside and out. Analysis and assessment help optimize the security and operation of identities and identity infrastructure through ongoing monitoring and evaluation.

Strategies: Continuously assess your entire identity estate, including accounts, privileges, entitlements, permissions, and their relationships for all identities – human, machine, employee, vendor, etc.

5. Audit

Goal: Ensure compliance with regulatory standards and internal policies by recording and reviewing logs and transactions related to access and authentication.

Strategies:
Auditing helps in identifying any anomalies or unauthorized changes, providing traceability, and facilitating post-incident analysis to improve security measures. Organizations should analyze and audit privileged session activity and privileged user behavior to ensure access rights are not abused, and/or run afoul of compliance.

In addition, organizations should perform regular user access reviews and apply the findings to make necessary adjustments to access policies, to ensure only what is needed is provisioned.

Identity and Access Management

The Identity and Access Management (IAM) umbrella is a broad identity security framework, encompassing policies and technologies to ensure the right individuals have the right access to technology resources, and they are appropriately using that access. For decades, IAM has played an essential role in managing enterprise user identities and regulating access privileges.

However, modern identity management and security practitioners are growing more cognizant of the fact that they must address the gaps and silos that sophisticated attackers exploit across IAM infrastructure and tools. One notable evolution in the identity security space over the last several years is Identity Threat Detection and Response (ITDR). ITDR solutions, comprised of multiple products and integrations, seek to bridge gaps across traditional IAM silos and beyond to both proactively eliminate risks, and to also detect threats and orchestrate a response.

Identity Security Solutions

Identity and Access Management (IAM) is a comprehensive framework of policies and technologies to ensure the right individuals have appropriate access to resources within an organization. IAM solutions encompass the entire identity lifecycle, from creation and maintenance to deactivation, and include capabilities such as authentication, authorization, and user provisioning. Some capabilities may be offered via the cloud and referred to as identity as a service (IDaaS).

By implementing robust IAM practices, organizations can enhance security, improve operational efficiency, and ensure compliance with regulatory requirements. Within IAM, as represented in the diagram above, there are numerous sub-disciplines and distinct product sets.

Privileged Access Management (PAM) is arguably the most essential identity security practice and technology set. PAM focuses on managing and auditing privileged identities and access. PAM solutions enforce the principle of least privilege, ensuring identities have the minimum level of access necessary to perform their roles. By auditing and managing privileged access, PAM helps organizations mitigate the risks associated with privileged accounts, such as insider threats and external cyberattacks, while maintaining compliance with regulatory requirements.

PAM solutions provide robust mechanisms to secure, control, and audit access to high-value systems and data, particularly for accounts with elevated privileges. This reduces the risk of breaches from compromised privileged accounts and ensures that sensitive resources remain protected. While integrated PAM platforms may be comprehensive, the space is made up of discrete practices areas that may be offered as different products. Traditional PAM is comprised of:

• Privileged Account and Session management (PASM), also referred to as Privileged Password Management or Enterprise Password Management, products. Privileged Password Management products discover, onboard (within a safe or vault), and manage privileged identities, accounts, credentials (passwords, DevOps secrets, SSH keys, certificates, etc.), and sessions for humans, machines, employees, vendors, and other third parties.
• Privilege Delegation and Elevation Management (PEDM), also known as Endpoint Privilege Management, products enforce least privilege across identities and endpoints (desktops, servers, network devices, IoT, OT, and non-traditional endpoint types). Endpoint Privilege Managers also typically incorporate application control capabilities, such as allow listing, block listing, and even advanced fileless malware protection.

PAM platforms may also provide directory bridging, MFA, CIEM, and other capabilities, which are each separately described below. Modern PAM should work equally well across cloud and on-premises environments.

Learn more about PAM solutions.

Multi-Factor Authentication (MFA) is a security measure that requires users to provide two or more verification factors to gain access to a resource, such as an application or online account. MFA enhances security by combining something the user knows (like a password), something the user has (like a smartphone), and something the user is (like a fingerprint). FIDO2 is an increasingly necessary MFA method often referred to as “phishing-resistant”. FIDO2 requires an additional, passwordless factor for verification, such as biometrics. This layered defense significantly reduces the likelihood of unauthorized access, even if one factor is compromised, thereby strengthening the organization's overall security framework.

Identity Governance and Administration (IGA) encompasses the policies and technologies to manage and govern user identities and their access rights within an organization. IGA solutions provide a framework for automating user provisioning, role management, and access certification processes. By ensuring that access rights are granted appropriately and reviewed regularly, IGA helps organizations maintain security, comply with regulatory standards, and reduce the risk of unauthorized access to sensitive data and systems.

Enterprise Password Management is a broad solution designed to securely manage and store passwords and secrets across an organization's infrastructure. Enterprise Password Managers ensure all credentials are stored in an encrypted vault, reducing the risk of unauthorized access and data breaches. By centralizing password management, these solutions simplify the enforcement of strong password policies, facilitate compliance, and streamline access control processes, thereby enhancing the overall security posture of the enterprise. These solutions may have different names and very different capabilities, from vendor to vendor. The most robust of these solutions are PASM solutions (covered above) that also provide security and management capability for workforce passwords. While employee application passwords, or workforce passwords, are not traditional privileged credentials, they can increasingly provide indirect paths to privilege. Thus, protection of workforce passwords is increasingly covered within PAM / PASM products.

AD Bridging refers to the integration of non-Windows systems, such as Linux, with Microsoft Active Directory (AD). This process allows organizations to centralize authentication and identity management, leveraging AD's robust security features. By bridging these systems, organizations can unify their user directories, streamline access management, and enforce consistent security policies across heterogeneous environments, ultimately reducing administrative overhead and improving security compliance. These products are offered by some PAM providers.

Cloud Infrastructure Entitlement Management (CIEM) solutions emerged to manage and control user permissions and access rights in cloud / multicloud environments. These cloud-native solutions help organization get control over entitlement and permissions sprawl by providing visibility into entitlements across multi-cloud infrastructures. By leveraging CIEM products, organizations can continuously monitor and right-size access across their diverse cloud environment. These products are offered by some PAM providers as well as by vendors outside IAM and identity protection altogether.

Customer Identity and Access Management (CIAM) is a subset of IAM focused on managing and securing customer identities. CIAM solutions enable organizations to provide seamless, secure access to customer-facing applications, while ensuring compliance with privacy regulations. These solutions typically offer features such as single sign-on (SSO), MFA, and user profile management, all designed to enhance user experience and protect sensitive customer data from breaches and unauthorized access.

Identity Threat Detection & Response (ITDR), while a newer discipline, has rapid momentum behind it due to the critical security gap and need it addresses. ITDR solutions span multi-products (PAM, CIEM, etc.) within and outside of identity security. These solutions strive to integrate identity data across the organization for a complete picture of the identity estate and the relationships between identities and accounts.

Leveraging AI and M/L, ITDR puts risk in context, enabling organizations to proactively surface identity vulnerabilities (misconfigurations, orphaned accounts, excess privilege, stale or weak passwords, etc.) and attacks in progress. Integrations with PAM and other solution sets enable organizations to proactively harden their identity security posture and also react fast to stop attacks and orchestrate incident response. ITDR is positioned to close the gaps in visibility and understanding of the identity fabric that attackers are exploiting.

Learn more about ITDR solutions.

Learn more about Identity Security 

KuppingerCole Leadership Compass: Identity Threat Detection & Response (ITDR) (Analyst Research)

2023 Gartner® Magic Quadrant™ for Privileged Access Management (Analyst Research)

Complete Buyer’s Guide for Privileged Access Management (PAM) (Guide)

What Midnight Blizzard’s Attack on Microsoft Tells Us about Modern Identity-Based Attacks (Blog)

2024 Microsoft Vulnerabilities Report: Are Organizations Having an Identity Crisis? (Research Report)