Identity Threat Detection and Response (ITDR) is a security discipline consisting of cyber threat intelligence, behavior analysis, tools and structured processes to enhance identity infrastructure security and accelerate the remediation of identity-centric attacks. ITDR supports Zero Trust and, employs detection mechanisms to identify potential threats, examines any suspicious activity during and after the authentication and authorization process, and takes the appropriate countermeasures to safeguard the trustworthiness of the identity infrastructure through security orchestration and response. These tools and processes will help eradicate an attack and minimize the impacts of identity security-related breaches.
Why Implement ITDR
Businesses should understand market drivers that fuel the decision to implement ITDR as a practice within their own organization.
- Breaches. 74% of breaches involve the human element, which includes social engineering attacks, errors and misuse, according to the 2023 Verizon Data Breach Investigations Report.
- Software supply chain risk. The SolarWinds attack proved that threats to IT monitoring systems that have privileged access to IT systems and system performance data can be devastating.
- Identity infrastructure attacks. Threats that target identity infrastructures can compromise an entire environment.
- Circumvention of security controls. Bypassing multi-factor authentication (MFA) and entitlement controls requires continuous post-authentication monitoring.
- Evolving threats to identity. The CyberArk 2023 Identity Security Threat Landscape Report shows cyber debt, macro-economic squeeze, elevated staff turnover, consumer spending downturn and expanding attack surfaces play a role in unaddressed identity risks
Without ITDR, businesses may face challenges and financial and reputational risks that can damage their organization.
How ITDR Can Help Secure Identities
Changes in the digital environment require new approaches by placing securing identities at the core of an organization’s cybersecurity approach. ITDR’s discipline for continuously monitoring threats and response to attacks can aid businesses in keeping their infrastructure secure. Steps can include:
- Assess an organization’s digitalization process to determine the appropriate level of protection and analyze it with the business risk that is considered acceptable to remain competitive.
- Establish least privilege criteria to elevate user trust by implementing security policies and controls to restrict access to an organization’s resources and provide only what employees need to be productive.
