Identity threat detection and response

Last updated January 30, 2024

Identity threat detection and response (ITDR) is a cybersecurity discipline that includes tools and best practices to protect identity management infrastructure from attacks. ITDR can block and detect threats, verify administrator credentials, respond to various attacks, and restore normal operations.^[1] Common identity threats include phishing, stolen credentials, insider threats, and ransomware.^[2]

ITDR adds an extra layer of security to identity and access management (IAM) systems. It helps secure accounts, permissions, and the identity infrastructure itself from compromise. With attackers targeting identity tools directly, ITDR is becoming more important in 2023 : according to Gartner, established IAM hygiene practices like privileged access management and identity governance are no longer enough.^[1]

ITDR can be part of a zero trust security model. ITDR is especially relevant for multicloud infrastructures, which have gaps between cloud providers' distinct IAM implementations. Closing these gaps and orchestrating identity across clouds is an ITDR focus.^[3]

Functionalities

ITDR enhances identity and access management (IAM) by adding detection and response capabilities. It provides visibility into potential credential misuse and abuse of privileges. ITDR also finds gaps left by IAM and privileged access management (PAM) systems.^[4] ITDR requires monitoring identity systems for misuse and compromise. It uses lower latency detections than general security systems. ITDR involves coordination between IAM and security teams.^[1]

ITDR uses the MITRE ATT&CK framework against known attack vectors. It combines foundational IAM controls like multi-factor authentication with monitoring. ITDR prevents compromise of admin accounts and credentials. It modernizes infrastructure through standards like OAuth 2.0.

Organizations adopt ITDR to complement IAM and endpoint detection and response. ITDR specifically monitors identity systems and user activity logs for attacks. It can isolate affected systems and gather forensic data. Adoption requires budget, training, and buy-in. Organizations can start with IAM fundamentals like multi-factor authentication and role-based access control.^[4]

ITDR tools can find misconfigurations in Active Directory. Strategies can update firewalls, intrusion systems, and security apps. ITDR integrates with SIEM tools for threat monitoring and automated response. An ITDR incident response plan handles compromised credentials and privilege escalation. Awareness training teaches users to spot identity-based attacks.^[4]

History

ITDR emerged as a distinct cybersecurity segment in 2022. The term was coined by Gartner.^[4]

ITDR Vendors

According to Gartner, ITDR vendors include Authomize, CrowdStrike, Gurucul, Microsoft, Netwrix, Oort, Proofpoint, Quest Software, Semperis, SentinelOne, and Silverfort.^[1]

Difference between ITDR and EDR

While EDR detects issues on endpoints, ITDR concentrates on monitoring and analyzing user activity and access management logs to uncover malicious activity. It gathers data from multiple identity and access management (IAM) sources across on-premises and cloud environments. Together they give a more complete picture to improve detection and response to sophisticated attacks involving lateral movement and identity deception.^[5]

Related Research Articles

Computer security, cybersecurity, digital security or information technology security is the protection of computer systems and networks from attacks by malicious actors that may result in unauthorized information disclosure, theft of, or damage to hardware, software, or data, as well as from the disruption or misdirection of the services they provide.

ESET, s.r.o., is a software company specializing in cybersecurity. ESET's security products are made in Europe and provide security software in over 200 countries and territories worldwide, and its software is localized into more than 30 languages.

Network security consists of the policies, processes and practices adopted to prevent, detect and monitor unauthorized access, misuse, modification, or denial of a computer network and network-accessible resources. Network security involves the authorization of access to data in a network, which is controlled by the network administrator. Users choose or are assigned an ID and password or other authenticating information that allows them access to information and programs within their authority. Network security covers a variety of computer networks, both public and private, that are used in everyday jobs: conducting transactions and communications among businesses, government agencies and individuals. Networks can be private, such as within a company, and others which might be open to public access. Network security is involved in organizations, enterprises, and other types of institutions. It does as its title explains: it secures the network, as well as protecting and overseeing operations being done. The most common and simple way of protecting a network resource is by assigning it a unique name and a corresponding password.

Cloud computing security or, more simply, cloud security, refers to a broad set of policies, technologies, applications, and controls utilized to protect virtualized IP, data, applications, services, and the associated infrastructure of cloud computing. It is a sub-domain of computer security, network security, and, more broadly, information security.

Trusteer is a Boston-based computer security division of IBM, responsible for a suite of security software. Founded by Mickey Boodaei and Rakesh K. Loonkar, in Israel in 2006, Trusteer was acquired in September 2013 by IBM for $1 billion.

Security information and event management (SIEM) is a field within the field of computer security, where software products and services combine security information management (SIM) and security event management (SEM). They provide real-time analysis of security alerts generated by applications and network hardware. Vendors sell SIEM as software, as appliances, or as managed services; these products are also used to log security data and generate reports for compliance purposes. The term and the initialism SIEM was coined by Mark Nicolett and Amrit Williams of Gartner in 2005.

An information security operations center is a facility where enterprise information systems are monitored, assessed, and defended.

Security as a service (SECaaS) is a business model in which a service provider integrates their security services into a corporate infrastructure on a subscription basis more cost-effectively than most individuals or corporations can provide on their own when the total cost of ownership is considered. SECaaS is inspired by the "software as a service" model as applied to information security type services and does not require on-premises hardware, avoiding substantial capital outlays. These security services often include authentication, anti-virus, anti-malware/spyware, intrusion detection, Penetration testing, and security event management, among others.

Palo Alto Networks, Inc. is an American multinational cybersecurity company with headquarters in Santa Clara, California. The core product is a platform that includes advanced firewalls and cloud-based offerings that extend those firewalls to cover other aspects of security. The company serves over 70,000 organizations in over 150 countries, including 85 of the Fortune 100. It is home to the Unit 42 threat research team and hosts the Ignite cybersecurity conference. It is a partner organization of the World Economic Forum.

Netwrix is a Frisco, Texas-based private IT security software company that develops software to help companies identify and secure sensitive data and assist with compliance auditing. After eight acquisitions the company's team geographically expanded to Latin America, UK, Germany, France, Asia, USA as well as other countries. The company's flagship products are Netwrix Auditor and StealthAUDIT that help information security and governance professionals manage sensitive, regulated and business-critical data.

User behavior analytics (UBA) or user and entity behavior analytics (UEBA), is the concept of analyzing the behavior of users, subjects, visitors, etc. for a specific purpose. It allows cybersecurity tools to build a profile of each individual's normal activity, by looking at patterns of human behavior, and then highlighting deviations from that profile that may indicate a potential compromise.

Endpoint security or endpoint protection is an approach to the protection of computer networks that are remotely bridged to client devices. The connection of endpoint devices such as laptops, tablets, mobile phones, Internet-of-things devices, and other wireless devices to corporate networks creates attack paths for security threats. Endpoint security attempts to ensure that such devices follow a definite level of compliance to standards.

The Co-Managed IT security service model entails security monitoring, event correlation, incident response, system tuning, and compliance support across an organization's entire IT environment. Co-Management allows organizations to collaborate with their managed security service providers by blending security expertise of the provider with the contextual knowledge of the customer to optimise security posture.

Operational technology (OT) is hardware and software that detects or causes a change, through the direct monitoring and/or control of industrial equipment, assets, processes and events. The term has become established to demonstrate the technological and functional differences between traditional information technology (IT) systems and industrial control systems environment, the so-called "IT in the non-carpeted areas".

<span class="mw-page-title-main">MaaS 360</span>

IBM MaaS360 is a SaaS Unified Endpoint Management (UEM) solution offered by IBM that manages and protects any existing endpoint including laptops, desktops, mobile devices and apps, wearables, IoT and purpose built devices and allow protected, low risk access to company resources. IBM Security MaaS360 with Watson integrates with current security platforms owned by different companies. It’s AI powered analytics removes friction by reducing actions required from the device user.

Browser isolation is a cybersecurity model which aims to physically isolate an internet user's browsing activity away from their local networks and infrastructure. Browser isolation technologies approach this model in different ways, but they all seek to achieve the same goal, effective isolation of the web browser and a user's browsing activity as a method of securing web browsers from browser-based security exploits, as well as web-borne threats such as ransomware and other malware. When a browser isolation technology is delivered to its customers as a cloud hosted service, this is known as remote browser isolation (RBI), a model which enables organizations to deploy a browser isolation solution to their users without managing the associated server infrastructure. There are also client side approaches to browser isolation, based on client-side hypervisors, which do not depend on servers in order to isolate their users browsing activity and the associated risks, instead the activity is virtually isolated on the local host machine. Client-side solutions break the security through physical isolation model, but they do allow the user to avoid the server overhead costs associated with remote browser isolation solutions.

Customeridentity and access management (CIAM) is a subset of the larger concept of identity access management (IAM) that focuses on managing and controlling external parties' access to a business' applications, web portals and digital services.

Endpoint detection and response (EDR), also known as endpoint threat detection and response (ETDR), is a cybersecurity technology that continually monitors an "endpoint" to mitigate malicious cyber threats.

Extended detection and response (XDR) is a cybersecurity technology that monitors and mitigates cyber security threats.

Network detection and response (NDR) refers to a category of network security products that detect abnormal system behaviors by continuously analyzing network traffic. NDR solutions apply behavioral analytics to inspect raw network packets and metadata for both internal (east-west) and external (north-south) network communications.

References

1 2 3 4 Jonathan Nunez, Andrew Davies (20 July 2023). "Hype Cycle for Security Operations, 2023". www.gartner.com. Retrieved 2023-08-08.
↑ Eddy, Nathan (2023-06-21). "Who Is Responsible for Identity Threat Detection and Response?". InformationWeek. Retrieved 2023-08-17.
↑ "What identity threat detection and response (ITDR) means in a zero-trust world". VentureBeat. 2022-07-26. Retrieved 2023-08-17.
1 2 3 4 "Improve IAM with identity threat detection and response". TechTarget. July 2023. Retrieved 2023-08-14.
↑ "Identity Threat Detection and Response (ITDR) Explained". crowdstrike.com. Retrieved 2023-08-29.