Applying Past Lessons for Intel-Driven Identity Threat Detection
summary
Review of incident data shows phishing and account takeover dominate identity attacks, with MFA exhaustion incidents tripling year over year and account takeovers up ~43%; where initial access could be identified, 60% initial access comes from identity vectors. Okta’s credential-and-HAR-file compromise exemplifies session hijacking risk. Responders see ransomware tied to identity rising ~95% in 2023. Practical steps: feed IDP and entitlement telemetry into SOC, hunt for dormant accounts (including vendor/service accounts), adopt 30/60/90-day joiner/mover/leaver controls, and use CTI beyond IOCs guided by the Pyramid of Pain.
AI-written summary · about
chapters (8)
- 0:00Identity-driven threat detection intro
- 1:03Why identity attacks escalate now
- 8:51Identity basics and complexity
- 16:17Top identity attacks in IR
- 23:30Intel-driven identity threat models
- 31:21Threat intelligence cycle for identity
- 39:24Future threats and recommendations
- 42:56Summary and next steps
related talks
26mIntegrating Identity and Fraud
46mSolving the Identity Security Crisis: A Guide to Today’s Top Threats
46mThe Human Factor: Building a Culture of Identity Security in a Decentralized Workforce
37mCustomer Identity for Modern Apps and APIs
56mEmerging threats against cloud application identities and what you should do about it
16mInnovation in Authentication and More
23mAccess is the New Breach: Observability Must Start with Identity
40mModern Identity Hacking: Have Hackers Really Adjusted to Constant Remote?