The importance of Threat Detection and Response in the identity landscape

July 16, 2024

In today's cyber security landscape, identity has become one of the most critical threat vectors. Attackers are increasingly focusing on compromising identities to gain access to sensitive systems and data.

Identity theft in the digital world can have devastating consequences. Cybercriminals can use compromised credentials to access corporate networks, conduct fraud, exfiltrate sensitive data, and deploy additional attacks. The problem is that stolen identities allow attackers to move laterally and maintain a prolonged presence undetected.

Types of identity attacks

The most common techniques used by attackers to steal or compromise identities are:

Phishing: attackers use fraudulent emails to trick users and obtain their credentials.
Credential stuffing: stolen username and password combinations are used from a data breach across multiple services.
Brute force attacks: the attacker attempts to guess passwords by trying multiple combinations. This attack is easily deployable with the proliferation of robotic tools.
Session hijacking: the attacker takes control of a user's active session to perform actions on their behalf. This is possible by intercepting the communication between the user's session and the server using sniffing techniques (traffic inspection, cookie capture or session token reuse). This could happen in web browsing through unsecured public wi-fi or vulnerable web applications.

Identity typologies

The typology of identities has been evolving in recent times with the adoption of more and more technological services offered by the cloud and the implementation of robotized processes within companies. As a result, there are other types of identities that can be subject to attacks.

Thus, paying attention exclusively to the security of User Identities (employee and contractor accounts that access systems and data) is not enough, as it has also become necessary to ensure protection of

Service: accounts used by applications and services to communicate with each other.
Machine: certificates and keys used by devices and machines to authenticate themselves.
Privileged: accounts with elevated permissions, such as system and database administrators.

These identities, which are used to facilitate communication between applications and services in the cloud or in robotic environments, also require specific security measures, as they can compromise the integrity and confidentiality of the organizations' data and processes.

Telefónica Tech MDR Service

Our Managed Detection and Response (MDR) service has been added to detect and respond to threats to identity threats, a complex and expensive task. At Telefónica Tech, we are aware of how difficult and expensive it is to keep up with sophisticated threats in identity.

We at Telefónica Tech have integrated detection and responses to identity threats into our MDR service, leveraging the insight and experience of our analysts.

Thanks to this module, the customer will benefit from the extensive experience of Telefónica Tech's security analysts, our threat intelligence, self-developed automation, and the capabilities of the most advanced xDR platforms. We use these platforms to reduce the attack surface of identities and to detect, investigate, and respond quickly and effectively to anomalous identity behavior that threatens the security of your company.

In this way, we prevent cybercriminals from gaining access to sensitive information, conducting fraudulent transactions or damaging the reputation and trust of our customers. We also provide regular reports with key metrics, findings as well as recommendations to improve the security of our customers' identities.

✅ With our Managed Detection and Response (MDR) service our customers have a complete view of their threat exposure, a rapid and coordinated response to incidents, a reduction in the costs and risks associated with security breaches, and an improvement in their level of maturity and confidence in the digital environment.

AUTHOR
Extended Detection & Response Product Team

* * *