What is Identity Threat Detection and Response (ITDR)?

Endpoint Detection and Response (EDR) corresponds to the growth in computing on endpoints (workstations, laptops, tablets, mobile devices), especially outside of the network perimeter. As attacks on endpoints have increased, EDR has emerged as an approach for defending against security threats by monitoring and analyzing the activity of the organization’s endpoints. It detects when threats have been identified; provides investigation, response and alerts; and retains endpoint data for historical analysis and threat hunting.

EDR supports the limitation and control of network ports, protocols and services (CIS Control 9) and boundary defense (Control 12). In the NIST Framework, EDR covers two aspects: detect and respond.

Extended detection and response (XDR) is focused on security incident detection and automated response across the infrastructure. XDR tools integrate cyber threat intelligence and telemetry data from multiple sources. They turn the data into security analytics that help security operations center (SOC) and incident response teams see security alerts in context and connect the dots among them. The tools are also capable of automating responses to threats according to playbooks.

XDR covers controlled use of administrative privileges (CIS Control 4), malware defenses (Control 8) and application software security (Control 18). In the NIST Framework, XDR deals with two aspects: detect and respond. 

AD is the centerpiece of the identity system in many enterprises. As such, it is continually used as an attack vector both in the data center and to move to the cloud or Microsoft 365 for greater access.

AD TDR is focused on defending against threats to AD, for example by using a platform-specific tool to detect and send alerts on the misuse of the AD Group Policy infrastructure. Attackers try to exploit Group Policy because of its systems management capability inside the AD identity platform. AD TDR detects changes to Group Policy Objects and any affected identities, then responds according to an identity threat playbook or by notifying security teams.   It protects the secure operation of AD as an integral part of the enterprise identity infrastructure.

As Gartner notes, “AD TDR tools fulfill this mission by applying threat intelligence, behavioral signatures, heuristics, statistical analysis, analyses of known tactics, techniques and procedures (TTPs) and machine learning algorithms to discover indicators of exposure and indicators of compromise in Active Directory.”

The greatest threat lies in what you fail to detect and how swiftly you respond. Hence, the focus on *DR disciplines.

Like a medieval kingdom, your network has an ever-expanding perimeter, and it continually faces threats that are often disguised.

• Extended Detection and Response provides an integrated, overarching view of threats, analogous to the intelligence gathered by the kingdom’s spy network.
• Endpoint Detection and Response guards the endpoints – the gates through which digital marauders are trying to pass.
• Network Detection and Response watches over network traffic, seeking out unusual patterns that signal danger and monitoring who is coming and going within the kingdom’s borders.
• Identity Threat Detection and Response protects identities – the keys by which the kingdom knows who belongs there – which are the best way to do the most damage, as cyber adversaries have discovered.
• Active Directory Threat Detection and Response reinforces protection of the kingdom’s main repository of identity and authentication, whose existence attackers know about and which they work hard to penetrate.

The *DR disciplines underpin a comprehensive set of tools, designed to address the multifaceted attack vectors confronting your cloud-based organization. The disciplines draw upon principles from areas like risk management, business continuity planning, emergency response protocols, physical security, intelligence/counterintelligence and military tactics and strategy.

As organizations make it easier for employees, customers and business partners to access their data from anywhere with any device, identity becomes the new perimeter – the key to that access. As a result, attacks on users’ identities and on the identity systems themselves have increased in frequency and force.

Enterprises that subscribe to Identity Threat Detection and Response effectively give identity its own security discipline based on prevention, detection and response:

• Prevention – Taking stock of the IAM controls they already have in place, these organizations apply configuration hygiene and controls to lock down critical assets. They strengthen their identity security by rooting out misconfigurations and changes to IAM settings, patching vulnerabilities as they are discovered and minimizing exposure by shrinking their attack surface.
• Detection – They strengthen their detection controls around identity, emphasizing identity tactics, techniques and procedures (TTPs) in particular.
• Response – They ensure that IAM enforcement is included in their response playbooks and in automating the processes of eliminating any identity threats as they are detected. They include IAM incidents in their ongoing efforts to hunt for threats.

Identity Access Management (IAM) and Identity Threat Detection (ITDR) serve complementary but distinct purposes in cybersecurity. IAM focuses on prevention and access control — ensuring the right people and resources have appropriate access to systems they need. It manages user permissions, authentication, and access across various applications and systems.

While ITDR monitors for threats targeting identity systems, it also focuses on protection and prevention by maintaining robust identity infrastructure hygiene to prevent attacks before they occur. We refer to the protection and prevention aspects as “the silent P” in ITDR. Protection/prevention and detection operate in what we call a virtuous cycle, where each informs the other for constant improvement.

This preventive aspect includes continuously assessing and hardening identity systems, eliminating misconfigurations, and ensuring secure architecture. While IAM prevents unauthorized access through authentication and permissions, ITDR provides comprehensive protection of the identity infrastructure itself, actively monitors for threats that may bypass IAM controls, and responds to potential compromises. Think of IAM as the front-line defense controlling who gets in, while ITDR both strengthens the underlying identity foundation and actively monitors for threats that may have slipped through or are attempting to undermine those controls.

Identity Threat Detection and Response (ITDR) provides organizations with crucial capabilities to protect their identity infrastructure in today's evolving threat landscape. By implementing ITDR, organizations gain both preventative protection through improved identity infrastructure hygiene and continuous monitoring of identity systems, enabling them to detect and respond to potential compromises and suspicious activities quickly. This goes beyond traditional IAM prevention controls, offering a more comprehensive approach to identity security.

ITDR delivers value through several key advantages:

• Enhanced protection through both preventive measures that harden identity infrastructure and automated detection and response capabilities that can quickly identify and neutralize identity-based threats
• Seamless integration with existing security frameworks, including CIS Controls and NIST Cybersecurity Framework, while adding crucial preventive capabilities for identity system hygiene
• Comprehensive coverage of the modern identity attack surface, with special attention to critical infrastructure like Active Directory, including both monitoring and preventive hardening
• Ability to restore compromised systems to a known good state, ensuring business continuity and improved security posture