Cyber Defense eMagazine February Edition for 2022

Figure 1. Three-Phase Attack Process Model
What is Identity Detection and Response?
The identity detection and response (IDR) strategy involves focusing on obtaining evidence during the
latter two attack phases shown in Figure 1 that an adversary is traversing the targeted entity and
preparing to create unwanted consequences. IDR relies on the following strategic protection activities by
enterprise defenders:
Establishing Identity Visibility
With the dissolution of the perimeter, identities have become the new basis for access management. As
a result, visibility into identity-related attack activity information is now a key source of attack surface risk
and an indication that security anomalies might be present. This represents a major shift in how intrusion
detection can be accomplished in the enterprise.
Protecting Credentials
One weak or exposed credential can open the door for an attacker. Identity security starts with finding
and removing exposed credentials. Policy-based controls can also bind credentials to their credential
stores and prevent misuse. Used in conjunction with concealment and deception technology,
organizations can also prevent theft and misuse by hiding production credentials and using deception
lures and fake artifacts to trick attacker tools and divert the attack to decoys.
Addressing Directory Services
For many enterprise teams, their most essential identity resource is Microsoft Active Directory (AD).
Through AD, administrators create new users, groups, and domains to set up policy-based enforcement
Cyber Defense eMagazine – February 2022 Edition 86
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.