Identity & Security: Addressing the Modern Threat Landscape

Cyberattacks are becoming more sophisticated as malicious actors exploit vulnerabilities, misconfigurations, and weak security implementations. A variety of malware types are used, including ransomware, spyware, and keyloggers. Ransomware attacks have surged, targeting entities from government agencies to public utilities. Incidents like the Colonial Pipeline attack in May 2021 and the Oldsmar, FL water treatment plant hack highlight significant vulnerabilities and consequences. Attackers manipulate computing assets, often using compromised credentials, to execute multifaceted attacks. Security and Identity Access Management (IAM) have traditionally operated in silos, but the growing complexity of attacks necessitates their integration. Detection and response technologies like CrowdStrike's Identity Threat Detection and Protection (ITD and ITP) offer comprehensive monitoring and remediation of attacks involving digital identities. Integration of AI/ML models in detection enhances the efficacy of identifying and mitigating threats. The paper concludes with recommendations for continuous assessment, deployment of passwordless MFA, adoption of Zero Trust principles, and ensuring interoperability between security and identity tools.

• Ransomware perpetrators have significantly increased their demands, with recent averages reaching $1.79M.
• The Colonial Pipeline ransomware incident disrupted fuel supplies in the eastern US in 2021.
• The Oldsmar, FL water treatment plant was targeted in 2021 through weak security measures.
• The "Golden SAML" method used in the SolarWinds attack allowed threat actors to bypass MFA.
• The "noPAC" exploit, discovered in 2021, allowed attackers to rapidly gain domain admin privileges.
• Data breaches involving compromised credentials can take up to 250 days to discover.
• CrowdStrike's Falcon Platform includes modules for ITD and ITP that detect and mitigate identity-related threats.
• AI/ML enhanced detection models are critical for both endpoint/security and identity event anomaly discovery.
• EPDR solutions are evolving into XDR, encompassing a broader range of protection functions.
• Cyber insurers increasingly require the implementation of MFA, EDR, and PAM solutions.

• "In some enterprises, cybersecurity and identity teams compete for budget. This is detrimental to the overall security posture."
• "Attackers will erase logs that show evidence of their activities, leading to longer and longer detection and remediation times."
• "Successful logins and resource requests are generally signs of proper authentication and authorization."
• "Zero Trust could be considered an instantiation of the principle of Least Privilege."
• "The synergies of integrated identity and security defenses are not merely theoretical."
• "CrowdStrike ITP analysis can interoperate with enterprise authentication and IAM systems."
• "Two of the primary objectives of identity and security intelligence solutions are to reduce the Mean-Time-To-Detect (MTTD) and Mean-Time-To-Remediate (MTTR)."
• "CrowdStrike Falcon Platform, with Falcon Identity Threat Detection and Falcon Identity Threat Protection, is positioned to help customers achieve these objectives."
• "Attackers use privileged accounts to hide artifacts of their presence and activities."
• "Integration of cybersecurity tools with IAM systems can enhance overall security."