“Black Swan” author Nicholas Nassim Taleb once wrote that “intelligence consists in ignoring things that are irrelevant (avoiding false patterns).” Organizations must take this definition to heart as they incorporate Identity Security intelligence – an essential element of any Zero Trust cybersecurity strategy.
Many organizations have dedicated Security Operations Center (SOC) teams responsible for their threat detection, investigation and response efforts. To the layperson, SOC teams often seem like the all-seeing eye of an organization, immediately detecting any bad behavior across infrastructure, applications and endpoints. In reality, though, monitoring for threats, remediating vulnerabilities and executing incident response plans are a ton of work. SOC teams must work across the security organization to collect and analyze the right data and ignore false positives (a.k.a. irrelevant things). In the case of Identity Security, this means analyzing user behavior analytics that enable rapid responses to anomalous or risky privileged access to infrastructure and applications.
The 2022 CyberArk Identity Security Threat Landscape Report reveals that credential access is the most reported risk of all tactics in the MITRE ATT&CK framework. This isn’t exactly shocking. Most cyberattacks take the path of least resistance: compromise an identity by stealing credentials, move laterally and escalate privileges.
Yet despite this understanding, many organizations struggle to apply enhanced threat detection to their most significant source of cybersecurity risk: compromised identities and credentials. To embody Zero Trust and an assume-breach mindset, organizations must improve their ability to respond rapidly to identity-centric attacks.
Why It’s So Difficult to Detect and Remediate Identity-related Threats
To better understand the challenges of detecting and mitigating identity compromise attacks, let’s dive a bit deeper. Organizations face several challenges with identity threat detection and protection, such as:
1. A wide variety of attack methods. The bad guys have lots of effective methods to compromise identities. From phishing, social engineering and credential harvesting to ransomware attacks that aim to compromise local admin accounts on endpoints, attackers have a big arsenal of tactics used to steal credentials and passwords.
It may take time to realize passwords have been stolen. And insider threats pose another significant complication. When employees break bad, they can use their existing, valid credentials. To defend against internal bad actors, organizations need holistic data and context to identify anomalous or high-risk behavior.
2. Internal access control friction. It’s not always easy for Identity Security and SOC teams to get along. Identity Security programs manage access control policies, provisioning entitlements while adhering to audit and compliance requirements like the rule of least privilege. These teams also own authentication and authorization policies that may be designed to address usability requirements from their developer, admin and workforce stakeholders. This can cause more permissive access control policies than the SOC team might design to prioritize risk reduction.
At the same time, SOC teams may need to use administrative accounts outside of their regular responsibilities when remediating security incidents. Without clearly documented incident response plans and policies granting access for automatic remediation, SOC teams can face slower response times.
3. Siloed technologies and processes. Remember the point about ignoring false patterns? It’s important that threat analytics capabilities in privileged access management (PAM) or Identity as a Service (IDaaS) solutions integrate with the tools SOC teams already rely on. Key examples include security information event management (SIEM) and extended detection and response (XDR) solutions. Without the full data that these integrations provide, SOC teams may not be able to see the full picture and could identify false positives.
Even worse, without proper data correlation to generate alerts, Identity Security solutions might not allow SOC teams to see the signal in the noise. Without full context, SOC teams might miss valid patterns that could indicate compromise. For example, an organization with siloed IDaaS and PAM analytics may be able to detect individual low-risk actions like an administrator entering a low-risk command in a privileged session or accessing a web app from an irregular location. In combination, these “low-risk” events may be a strong case for a closer look. But with siloed analytics, SOC and Identity Security teams may not spot the valid pattern.
Threat detection capabilities are only as effective as the data they can analyze. If Identity Security and SOC technologies are not integrated for multi-directional data sharing, SOC teams may face a high number of false positives or worse – a low number of threats detected.
How Can Identity Security Intelligence Streamline Security Ops?
Security is a team game. As with any other security challenge, solving this gap in identity threat detection and prevention requires a combination of people, processes and technology. Here are some recommendations:
1. Document and automate processes for responding to identity-centric attacks. Documented plans in incident response scenarios provide a standardized playbook to help ensure alignment and accountability between SOC and Identity Security teams. And in many cases, documented incident response plans can also help satisfy cyber insurance, audit and compliance requirements.
As a best practice, building clear plans for responding to different types of security incidents (e.g., dedicated actions for remediating a phishing attack) can also streamline response processes, helping minimize the business disruption of security incidents.
2. Centralize threat detection across all user access. Multi-contextual analysis of user access can provide SOC and Identity Security teams with a complete picture of a potential security incident. This data correlation can help accelerate detection and response.
For example, Identity Security Intelligence, a shared service of the CyberArk Identity Security Platform, analyzes a user’s access to web applications and privileged accounts to detect and remediate in-progress attacks. Identity Security Intelligence centrally gathers user behavior analytics data such as login date and time, login location and actions performed by privileged accounts. The service then detects and sends alerts regarding behavior that departs from a user’s behavioral baseline access patterns to web apps and IT infrastructure. The CyberArk Identity Security Platform analyzes a user’s access to web applications and privileged accounts to detect and remediate in-progress attacks. Identity Security Intelligence centrally gathers user behavior analytics data such as login date and time, login location and actions performed of privileged accounts. The service then detects and sends alerts regarding behavior that departs from a user’s behavioral baseline access patterns to web apps and IT infrastructure.
Multi-contextual user behavior analytics in Identity Security Intelligence
Armed with sharper, multi-contextual insight, SOC and Identity Security teams can identify and respond to combinations of behavior that may signal identity compromise, such as an irregular login time, and then entry of specific commands in a remote session to a corporate server.
3. Integrate Identity Security and SOC Team tools. Identity Security teams must arm their SOC teams with the data their solutions naturally detect. Data and alerts from threat analytics services like Identity Security Intelligence can accelerate the SOC team’s ability to detect stolen credentials, insider threats and other identity-centric attacks.
Similarly, SOC teams must configure integrations between their tools and Identity Security solutions to remediate threats. For example, if a SOC team identifies potential abuse of a privileged account used to maintain Windows servers, integration with a PAM solution can automatically suspend or terminate the session. Or in another scenario, if Identity Security Intelligence sends an alert on a risky command entered on a Linux server, security teams can use CyberArk’s identity orchestration capabilities to automatically prevent the employee from using privileged accounts through PAM.
Putting It All Together: The Need for Identity Security Intelligence
Intelligent identity threat detection efforts require a holistic view of user behavior that helps teams spot only the relevant patterns. Identity Security Intelligence can help organizations reduce the risk of identity-centric attacks by eliminating siloes between teams, documenting processes and integrating technologies to rapidly detect and respond to identity-centric threats.
Protect Passwords, Don’t Just Manage Them: A Game Plan for CIOs and CISOs
When 921 password attacks occur per second, it’s time to treat everyday employees’ credentials like the true operational risk they are. Today’s attackers assign a level of value to employees’...
There are nuances to how Zero Trust security is defined — but at its core, it's a strategic cybersecurity model enabled to protect modern digital business environments.
Abstract Once threat actors gain a foothold on a system, they must implement techniques to maintain that access, even in the event of restarts, updates in credentials or any other type of change...
Secrets Management: Meeting Developers Where They Are
There’s always a balancing act when it comes to building and deploying cloud-native applications in environments like Amazon Web Services (AWS). The whole point of moving production to the cloud...
Phishing is a big problem that’s getting even bigger as cybercriminals find new ways to hook employees. With threats coming from every direction – emails on company computers, text and voice...
How Automated Identity Management Can Help Solve the Compliance Puzzle
Have you ever received a puzzle as a gift from a well-intentioned friend? They likely thought something along the lines of, “Hey, this person’s into solving problems — I bet they’d love putting...
Introduction Everyone knows what phishing is. It has been around for more than two decades. Now it seems that phishing is more accessible than before. This blog covers how malicious actors can...
Most companies now recognize the serious and insidious nature of cybersecurity threats. But many fail to grasp that the digital transformation, remote work, automation and cloud migration...
Udi Mokady to Step into Executive Chair Role and Matt Cohen to Become CEO
Today, CyberArk announced that our founder and CEO Udi Mokady will step into the role of Executive Chairman and our Chief Operating Officer, Matt Cohen, will become CyberArk’s CEO, effective April...
Post-CircleCI Breach, Focus on Identity Security Strategy
When news of the recent CircleCI breach broke, developers everywhere scrambled to rotate tokens and remove hardcoded secrets stored in the popular CI/CD platform to minimize their exposure. Now...
Introduction NTFS is a filesystem developed by Microsoft that was introduced in 1993. Since then, it has become the primary filesystem for Windows. In recent years, the need for an NTFS...
It wasn’t too long ago that using a single cloud for some business operations was cutting-edge technology. Now the cloud is essential for accelerating growth, improving efficiency and remaining...
Breaking Docker Named Pipes SYSTEMatically: Docker Desktop Privilege Escalation – Part 1
Everything started when I was researching Windows containers. It required installing Docker Desktop for Windows, and I couldn’t help but notice that there were many Docker processes. Since some of...
Three Ways to Reinforce Least Privilege with Identity Management
The definition of privilege is changing, and this changes everything. Identities of all types — not just IT team members, but any employees — are gaining access to sensitive data, infrastructure...
Identity Security: Bridging the Executive Confidence/Reality Gap
In recent years, cybersecurity has become a board-level issue resulting in several executives taking greater responsibility in cybersecurity-related decisions. As a result, the CISO is no longer a...
The idea of removing local administrator rights from Every. Single. User. across your organization is likely to spark strong reactions. Search popular online forums for the phrase “remove local...
Inglourious Drivers – A Journey of Finding Vulnerabilities in Drivers
TL;DR I discovered multiple bugs in OEM vendors for peripheral devices, which affected many users of these OEM vendors (Razer, EVGA, MSI, AMI). Many of the vulnerabilities originated in a...
How Identity Security Addresses Key DoD Zero Trust Requirements
The U.S. Department of Defense (DoD) is going all in on Zero Trust. In late 2022, the Pentagon released its long-anticipated Zero Trust strategy and roadmap for migrating “trusted” perimeter-based...
Zero-Days in RGB Keyboards, Top DID Network Exposed at INTENT Threat Research Summit
Data breach headlines are daily reminders that cyberattackers keep innovating. While constant research to uncover threats and share crucial intelligence with defenders is far less visible, the...
Chatting Our Way Into Creating a Polymorphic Malware
Abstract ChatGPT took the world by storm being released less than two months ago, it has become prominent and is used everywhere, for a wide variety of tasks – from automation tasks to the...