What Is Identity Threat Detection and Response (ITDR)?

With the growth of cloud computing, AI, and remote work, traditional perimeters are rapidly dissolving. Identity threat detection and response (IDTR) addresses these issues by identifying common identity-related threats, such as stolen credentials and account takeover (ATO) attacks.

While many organizations have identity security solutions in place, traditional identity and access management (IAM) and multi-factor authentication (MFA) solutions are no longer enough for security. With ATO attacks and non-human identities (NHIs) on the rise, enterprises need the ability to rapidly detect and respond to identity-related breaches.

Why Identity Threats Matter

Identity-related breaches are a top threat to enterprise security, with nearly a quarter of attacks (22%) beginning with stolen credentials, making it the top cause of breaches. Credentials can be stolen in various ways (phishing, malware, etc.) and grant an attacker access to a legitimate employee account on the enterprise network. Once inside, they can steal sensitive data, plant malware, or take other actions to harm the business.

Common Identity Attack Techniques

Identity-related attacks can use a variety of different mechanisms. Some of the top vulnerabilities that attackers exploit include:

• Weak Passwords: Credential stuffing, brute force password guessing, and password spraying attacks all take advantage of weak and reused passwords to grant account access.
• Social Engineering: Phishing and other social engineering attacks trick users into handing over passwords or installing malware that steals them.
• Insecure IAM Policies: Weak or misconfigured IAM policies may allow an unauthorized user to gain access to privileged functionality and sensitive data.
• Session Takeover: Attackers may steal session tokens or other identifiers that allow them to hijack an active, authenticated user session.
• Insider Threats: Trusted insiders within a business may be coerced, bribed, or tricked into taking actions that advance a cyberattack.

Consequences of Identity Compromise

Identity compromise allows an attacker to misuse the access and privileges granted to a legitimate user. Some of the potential repercussions for the business include:

• Data Breaches: Attackers may use a compromised account to take advantage of a user’s legitimate access to sensitive data.

• Malware Infections: Ransomware and other malware can be spread by attackers who use compromised accounts to access target systems via VPNs, RDP, and other remote access tools.
• Regulatory Penalties: Data protection regulations, such as GDPR, PCI DSS, and HIPAA, mandate controlling access to protected data, so unauthorized access could result in fines or other regulatory penalties.
• Business Disruption: Attackers may use unauthorized access to perform Denial of Service (DoS) attacks, and incident response in the wake of an incident may impact normal business operations.
• Reputational Harm: Data breaches and other incidents caused by compromised identities may hurt an organization’s reputation with customers, partners, regulators, and other stakeholders.
• Increased Costs: Incident remediation, business disruption, and fines can all carry costs for the business.

Core Capabilities of ITDR

ITDR extends traditional identity management to incorporate capabilities focused on monitoring, detection, and response. By proactively identifying and addressing pending attacks rather than responding after the fact, an organization can reduce the cost and impact associated with an incident. ITDR also enables an organization to strengthen its Zero Trust security posture by remediating incidents and enforcing least privilege access controls across identity systems, such as Windows AD, Entra ID, and Okta.

Core ITDR Functions

Monitoring Identity Systems

IDTR collects and aggregates identity data from various sources, such as directory services, IAM, and SSO providers. This information allows the system to perform continuous monitoring of user and device activity. After establishing baselines for normal activity, anomalous and abnormal access patterns can be used to identify potential attacks.

This monitoring also enables an organization to align its identity monitoring with internal and external requirements. Regulations, such as HIPAA, PCI DSS, and GDPR, mandate access monitoring for protected data.

Detecting Suspicious Identity Behaviors

Ongoing monitoring of user activity within the enterprise enables detection of suspicious or anomalous behaviors that could indicate an attack. Some behaviors that IDTR may detect include:

• Impossible travel and unusual login times.
• Common patterns of privilege escalation.
• Attempted lateral movement using stolen credentials.
• Excessive failed login attempts.

Automated Response and Remediation

ITDR is defined by the ability to quickly respond to a suspected attack, contain the attacker, and mitigate potential damage. Some of the actions that an ITDR solution may take include:

• Locking or suspending compromised accounts.
• Triggering MFA re-authentication.
• Isolating devices or sessions on the network.
• Sending alerts to SOC/SIEM teams.
• Integration with SOAR for an orchestrated response.

ITDR vs. IAM, PAM, and MFA

ITDR is one component of a comprehensive identity management and security suite, adding threat detection and response capabilities alongside preventative measures, such as IAM, PAM, and MFA. These solutions are complementary, with different areas of focus, including:

• IAM: Identity management
• PAM: Managing privileged access
• MFA: Protecting against ATO attacks
• ITDR: Identifying and remediating identity-related incidents

Comparing Identity Security Approaches

How Cato Networks Supports Identity Threat Detection

The Cato SASE Cloud Platform supports ITDR as part of its integrated Zero Trust Network Access (ZTNA) functions. ZTNA continuously monitors network traffic, enforcing corporate policies, authentication, least privilege access controls, and session validation. With ZTNA and ITDR integrated into the Cato SASE Cloud platform, these capabilities also benefit from Cato’s global private backbone and converged Security Service Edge (SSE) functions.

Zero Trust Network Access (ZTNA)

Cato implements ITDR via ZTNA, offering zero trust identity security across the corporate WAN. ZTNA integrates with identity providers, such as Okta, AD, and Ping, and enforces context-aware access policies based on user, device, and location. Enforcement is performed on a session-by-session basis, and required controls are updated dynamically based on risk level.

Continuous Session Monitoring

Continuous session monitoring provides insight into session hijacking and malicious use of an authenticated session. Key capabilities include:

• Detecting anomalous session behaviors.
• Blocking lateral movement attempts.
• Enforcing re-authentication when risk increases.
• Reducing dwell time for compromised accounts.

Unified Security Stack

The Cato SASE Cloud Platform implements a converged SSE stack, combining ITDR with FWaaS, SWG, CASB, and DLP. This combination allows the platform to manage the potential impacts of compromised identities and implement cloud-native security enforcement across a distributed workforce. Additionally, the single policy engine reduces operational complexity by offering centralized management across several security functions.

Identity Threat Detection in Practice

Attackers like compromised credentials because they grant legitimate access to corporate systems. Some common scenarios include:

• An employee’s credentials are compromised by the attacker via a phishing attack. ITDR identifies unusual access patterns and locks the account for review.
• A SaaS app experiences a high number of failed login attempts for employee accounts. ITDR identifies an attempted credential stuffing attack and blocks future requests from known malicious addresses.
• An insider is using a privileged account to collect and exfiltrate sensitive data from the business. ITDR flags the attempted privilege abuse, locks the account, and prevents the sensitive data from leaving the network.

FAQ

How does ITDR differ from IAM and PAM?

IAM and PAM are preventative solutions designed to block attacks by controlling access to corporate resources. ITDR focuses on detection and response, looking for signs of an attack in progress and remediating it. The solutions are complementary as ITDR can stop attacks that IAM and PAM fail to prevent.

Why is ITDR essential for zero trust?

Zero trust prevents unauthorized access to corporate resources, but does nothing against attacks using legitimate privileges. ITDR complements zero trust by looking for signs of identity-related attacks. For example, an attacker may use compromised credentials to legitimately access a corporate app. Zero trust might allow this, but ITDR can identify the signs of an attack and block it.

Can ITDR mitigate insider threats?

Insider threats are one of the main threats that ITDR is designed to address. Using behavioral analysis, ITDR can identify signs of anomalous or potentially malicious activity by a trusted user. By identifying these anomalous behaviors and impeding lateral movement, ITDR catches insider threats more quickly and prevents them from spreading through an organization’s network.

What role does ZTNA play in ITDR?

ITDR identifies signs of identity-related attacks, while ZTNA enforces its decisions via access controls or other restrictions. For example, if ITDR believes that an account was compromised, ZTNA might require reauthentication. When implemented as part of a SASE platform like Cato SASE Cloud, this makes identity enforcement consistent across cloud, data center, and branch access.

Does ITDR replace MFA?

ITDR is a complementary technology to MFA. MFA reduces the risk of a compromised account by strengthening authentication, while ITDR works to identify attacks using compromised accounts.

Identity Threat Detection and Response with Cato Networks

As identity becomes the “new perimeter”, ITDR is increasingly vital to enterprise security. The Cato SASE Cloud Platform implements ITDR with ZTNA as part of a converged SASE platform, offering simplified, more consistent identity security across the enterprise.

See how Cato Networks strengthens identity security with ZTNA and SASE. Request a demo to explore how we reduce identity-driven risk.