Identity Threat Detection and Response (ITDR) explained

Endpoint Detection and Response (EDR) corresponds to the growth in computing on endpoints (workstations, laptops, tablets, mobile devices), especially outside of the network perimeter. As attacks on endpoints have increased, EDR has emerged as an approach for defending against security threats by monitoring and analyzing the activity of the organization’s endpoints. It detects when threats have been identified; provides investigation, response and alerts; and retains endpoint data for historical analysis and threat hunting.

EDR supports the limitation and control of network ports, protocols and services (CIS Control 9) and boundary defense (Control 12). In the NIST Framework, EDR covers two aspects: detect and respond.

Extended detection and response (XDR) is focused on security incident detection and automated response across the infrastructure. XDR tools integrate cyber threat intelligence and telemetry data from multiple sources. They turn the data into security analytics that help security operations center (SOC) and incident response teams see security alerts in context and connect the dots among them. The tools are also capable of automating responses to threats according to playbooks.

XDR covers controlled use of administrative privileges (CIS Control 4), malware defenses (Control 8) and application software security (Control 18). In the NIST Framework, XDR deals with two aspects: detect and respond. 

AD is the centerpiece of the identity system in many enterprises. As such, it is continually used as an attack vector both in the data center and to move to the cloud or Microsoft 365 for greater access.

AD TDR is focused on defending against threats to AD, for example by using a platform-specific tool to detect and send alerts on the misuse of the AD Group Policy infrastructure. Attackers try to exploit Group Policy because of its systems management capability inside the AD identity platform. AD TDR detects changes to Group Policy Objects and any affected identities, then responds according to an identity threat playbook or by notifying security teams.   It protects the secure operation of AD as an integral part of the enterprise identity infrastructure.

As Gartner notes, “AD TDR tools fulfill this mission by applying threat intelligence, behavioral signatures, heuristics, statistical analysis, analyses of known tactics, techniques and procedures (TTPs) and machine learning algorithms to discover indicators of exposure and indicators of compromise in Active Directory.”

The greatest threat lies in what you fail to detect and how swiftly you respond. Hence, the focus on *DR disciplines.

Like a medieval kingdom, your network has an ever-expanding perimeter, and it continually faces threats that are often disguised.

• Extended Detection and Response provides an integrated, overarching view of threats, analogous to the intelligence gathered by the kingdom’s spy network.
• Endpoint Detection and Response guards the endpoints – the gates through which digital marauders are trying to pass.
• Network Detection and Response watches over network traffic, seeking out unusual patterns that signal danger and monitoring who is coming and going within the kingdom’s borders.
• Identity Threat Detection and Response protects identities – the keys by which the kingdom knows who belongs there – which are the best way to do the most damage, as cyber adversaries have discovered.
• Active Directory Threat Detection and Response reinforces protection of the kingdom’s main repository of identity and authentication, whose existence attackers know about and which they work hard to penetrate.

The *DR disciplines underpin a comprehensive set of tools, designed to address the multifaceted attack vectors confronting your cloud-based organization. The disciplines draw upon principles from areas like risk management, business continuity planning, emergency response protocols, physical security, intelligence/counterintelligence and military tactics and strategy.

As organizations make it easier for employees, customers and business partners to access their data from anywhere with any device, identity becomes the new perimeter – the key to that access. As a result, attacks on users’ identities and on the identity systems themselves have increased in frequency and force.

Enterprises that subscribe to Identity Threat Detection and Response effectively give identity its own security discipline based on prevention, detection and response:

• Prevention – Taking stock of the IAM controls they already have in place, these organizations apply configuration hygiene and controls to lock down critical assets. They strengthen their identity security by rooting out misconfigurations and changes to IAM settings, patching vulnerabilities as they are discovered and minimizing exposure by shrinking their attack surface.
• Detection – They strengthen their detection controls around identity, emphasizing identity tactics, techniques and procedures (TTPs) in particular.
• Response – They ensure that IAM enforcement is included in their response playbooks and in automating the processes of eliminating any identity threats as they are detected. They include IAM incidents in their ongoing efforts to hunt for threats.