1 The Challenge

Identity-driven attacks are escalating, driven by the dissolution of traditional network perimeters due to cloud adoption, remote work, and the increasingly sophisticated tactics of adversaries. Over 80% of breaches involve compromised identities, as attackers leverage methods like Kerberoasting, password spraying, and the exploitation of misconfigurations in identity systems such as Active Directory. Traditional security measures are proving inadequate in differentiating between legitimate and malicious use of identities, leaving significant vulnerabilities.

The insidious nature of identity-based attacks is that the attacker can parade around your infrastructure using legitimate, highly trusted levels of authentication and encryption to commit crimes without any fear of being noticed. They’re not the proverbial wolf in sheep’s clothing—they manipulate the sheep, instead.

This dynamic is completely uprooting our current models for threat detection and response. To deal with this type of threat, a new runbook must be written. As an industry, we’re still very early on in that process; but for the moment, we’re cautiously referring to this new practice as Identity Threat Detection and Response (ITDR). But its arrival has posed some questions, such as who is responsible for this new tool.

The growing tension between identity and access management (IAM) and security operations center (SOC) teams further complicates the landscape. SOC teams handle threat detection and response, while IAM teams focus on managing digital identities, resulting in silos that inhibit effective identity threat response. This disconnect must be bridged to effectively defend against identity-driven threats, requiring a convergent approach.

The five pillars in the image below illustrate how neither IT administration nor SOC teams have control over the entire process, but that visibility is broadly available.

These pillars support activities that range from administration of identity systems (on the left) to shared responsibilities in the center, then SOC-related responsibilities to the right. Given that administration and SOC teams need to collaborate on this process, tools that provide integrated views will improve the success of ITDR projects.

The five pillars of ITDR (image source: KuppingerCole)