Full Report
We’ve entered the era of identity security. Are you ready? Explore how to counter evolving threats and protect identities with confidence.
Analysis Summary
# Best Practices: Identity Security Operations (ITDR)
## Overview
These practices address the shift of "identity" from a sub-component of host/network security to its own distinct security discipline. As organizations migrate to the cloud, identity has become the primary attack surface, bypassable not through malware, but through the subversion of trust mechanisms, authentication tokens, and credential abuse.
## Key Recommendations
### Immediate Actions
1. **Audit Administrative Access:** Review all accounts with global or privileged access in Microsoft 365 and Google Workspace; remove unnecessary permissions.
2. **Enforce MFA (Multi-Factor Authentication):** Ensure MFA is mandatory for all users, focusing on phishing-resistant methods where possible.
3. **Monitor Inbox Rules:** Scan for unauthorized "auto-forwarding" or "delete" rules, which are primary indicators of Business Email Compromise (BEC).
4. **Review AS-Based Logs:** Look for logins originating from data centers or VPS providers rather than known residential or office ISPs.
### Short-term Improvements (1-3 months)
1. **Deploy ITDR (Identity Threat Detection and Response):** Implement specialized tools designed to monitor identity-centric telemetry that traditional EDR (Endpoint Detection and Response) misses.
2. **Establish Identity Baselines:** Map typical user login locations, times, and devices to identify anomalous "impossible travel" or session hijacking.
3. **Review Third-Party Integrations:** Audit OAuth permissions and third-party apps integrated into your cloud productivity suites (M365/Google Workspace).
### Long-term Strategy (3+ months)
1. **Adopt a Zero Trust Architecture:** Move away from network-perimeter security toward a model where identity is the primary boundary.
2. **Automated Incident Response:** Integrate identity alerts into an automated SOC workflow to instantly revoke sessions or reset credentials upon detection of compromise.
3. **Continuous Verification:** Move beyond one-time authentication to continuous risk-based assessment of user sessions.
## Implementation Guidance
### For Small Organizations
- **Outsource Monitoring:** Use Managed ITDR services to gain 24/7 SOC oversight without hiring internal experts.
- **Focus on SaaS:** Prioritize securing the "Big Two" (Microsoft 365 and Google Workspace) as these hold the most sensitive data.
### For Medium Organizations
- **Visibility Gap Analysis:** Identify where identity logs are currently stored (e.g., Azure AD logs, Google Workspace Audit logs) and ensure they are being ingested into a central security platform.
- **Policy Enforcement:** Standardize identity lifecycle management (onboarding/offboarding) to prevent "orphan accounts."
### For Large Enterprises
- **Infrastructure Security:** Protect core signing keys and identity provider (IdP) infrastructure to prevent sophisticated attacks like those by Storm-0558.
- **Advanced Telemetry:** Monitor for session token theft and "Pass-the-Cookie" attacks that bypass traditional MFA.
## Configuration Examples
*While the article discusses high-level strategy, the following technical focuses are implied:*
- **Conditional Access Policies:** Configure policies to block logins from non-compliant devices or high-risk geographic locations.
- **SIEM Integration:** Ensure cloud identity logs (e.g., Microsoft Graph API logs) are exported to a security monitoring tool.
## Compliance Alignment
- **NIST Cybersecurity Framework (CSF):** Aligns with the "Protect" (Identity Management) and "Detect" functions.
- **CIS Controls:** Aligns with Control 5 (Account Management) and Control 6 (Access Control Management).
- **ISO/IEC 27001:** Addresses Access Control (A.9).
## Common Pitfalls to Avoid
- **Assuming EDR is Enough:** Traditional host-based security cannot see what happens inside a cloud-based email account or identity provider.
- **MFA Fatigue:** Attackers can spam users with MFA prompts until they click "Approve." Implement "number matching" to counter this.
- **Ignoring Data Center Logins:** Attackers often use VPS/Data Center infrastructure to mask their location; failing to distinguish between "Residential ISP" and "Data Center" traffic is a critical visibility gap.
## Resources
- **Huntress Managed ITDR:** [https://www[.]huntress[.]com/blog/managed-itdr-google-workspace]
- **Microsoft Storm-0558 Analysis:** [https://www[.]microsoft[.]com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/]
- **FBI IC3 BEC Reports:** [https://www[.]ic3[.]gov/]