Full Report
Threat actors are now exploiting both endpoints and identities in the latest cyberattacks. Learn about the rise of identity-based threats and why a combined EDR and ITDR approach is crucial for your cybersecurity.
Analysis Summary
# Best Practices: Unified Endpoint & Identity Security
## Overview
These practices address the shift from siloed attacks to integrated threats where attackers pivot between physical/virtual endpoints and cloud identities. As identity-based incidents now account for over 80% of critical threats, these recommendations aim to close visibility gaps between Endpoint Detection and Response (EDR) and Identity Threat Detection and Response (ITDR).
## Key Recommendations
### Immediate Actions
1. **Enable MFA Everywhere:** Implement Multi-Factor Authentication for all cloud services (M365, Google Workspace, VPNs), but prioritize hardware keys or push-notifications over SMS to mitigate basic phishing.
2. **Audit Inbox Rules:** Scan Microsoft 365 and Google Workspace environments for suspicious "Move" or "Delete" rules that attackers use to hide evidence of business email compromise (BEC).
3. **Review RDP Exposure:** Immediately disable or secure Remote Desktop Protocol (RDP) behind a VPN or Gateway to prevent initial endpoint entry.
### Short-term Improvements (1-3 months)
1. **Implement ITDR:** Deploy Identity Threat Detection and Response tools specifically for Google Workspace and Microsoft 365 to detect session hijacking and rogue OAuth apps.
2. **Session Management Policies:** Shorten session token lifetimes to reduce the window of opportunity for attackers using stolen session cookies.
3. **Credential Dumping Defense:** Configure EDR policies to alert on tools like Mimikatz or unauthorized memory scraping activities.
### Long-term Strategy (3+ months)
1. **Unified EDR/ITDR Correlation:** Integrate endpoint and identity telemetry so a local malware detection automatically triggers an identity audit/lockdown for that user’s cloud account.
2. **Identity Security Posture Management (ISPM):** Transition from reactive detection to proactive hygiene by regularly auditing permissions and removing unused "Zombie" accounts or over-privileged apps.
3. **Zero Trust Architecture:** Move toward a "never trust, always verify" model where access is continuously validated based on both device health (EDR) and user behavior (ITDR).
## Implementation Guidance
### For Small Organizations
- **Focus:** Automation and Managed Services.
- **Action:** Utilize a Managed Service Provider (MSP) that offers a 24/7 Security Operations Center (SOC) to monitor identity alerts, as small teams often miss these "quiet" signals.
### For Medium Organizations
- **Focus:** Visibility and Silo Reduction.
- **Action:** Ensure your security team has a single pane of glass for both endpoint alerts and cloud identity logs to stop "pivoting" attacks.
### For Large Enterprises
- **Focus:** Advanced Correlation and OAuth Governance.
- **Action:** Audit third-party OAuth integrations across the enterprise. Implement automated workflows to revoke tokens if an endpoint is flagged as compromised.
## Configuration Examples
- **Conditional Access:** Configure policies to block logins from non-compliant devices (e.g., "If EDR reports infection, block M365 access").
- **OAuth Scrutiny:** Restrict the ability for users to grant high-level permissions (e.g., `Mail.Read`, `Notes.Read.All`) to third-party applications without admin approval.
- **Browser Security:** Harden browsers (Chrome/Edge) to protect against session cookie scraping by enforcing encrypted storage of profile data.
## Compliance Alignment
- **NIST CSF 2.0:** Aligns with "Protect" (Identity Management) and "Detect" (Continuous Monitoring) functions.
- **CIS Controls (v8):** Specifically Control 5 (Account Management) and Control 6 (Access Control Management).
- **ISO/IEC 27001:** Supports Annex A controls regarding access control and system interest.
## Common Pitfalls to Avoid
- **"MFA is Enough" Fallacy:** Attackers regularly bypass MFA via Adversary-in-the-Middle (AiTM) kits or session hijacking. Detection of *post-MFA* behavior is critical.
- **Ignoring Low-Level Alerts:** Infostealer malware on a single endpoint is often the precursor to a massive cloud identity breach.
- **Siloed Monitoring:** Treating an RDP alert and a suspicious M365 login as unrelated events rather than a single coordinated attack chain.
## Resources
- **Frameworks:** [MITRE ATT&CK Matrix for Cloud](https://attack.mitre.org/matrices/enterprise/cloud/)
- **Threat Intelligence:** [Huntress Blog - Identity Threats](https://www.huntress[.]com/blog/identity-threats-in-cybersecurity)
- **Tooling:** [CISA SCuBA (Secure Cloud Business Applications) Project](https://www.cisa[.]gov/resources-tools/programs/secure-cloud-business-applications-scuba-project)