Secure your Identity Infrastructure

Account takeover in IAM provides malicious actors with access to any managed application. Prevent account takeover by identifying takeover attempts and limiting access and/or enforcing controls.  

• Detect compromised accounts by identifying credential stuffing, brute forcing, and password spraying and respond by enforcing stronger authentication as well as limited access 
• Eliminate misconfigurations that facilitate account takeovers (such as MFA, weak passwords, and legacy authentication protocols)  

• Detect active takeover attempts such as password exfiltration (like PassBleed and SWA abuse)  

IAM solutions must establish trust relationships in order to do their job. Protect your IAM from attackers who exploit these trust relationships to impersonate accounts in order to escalate their privileges and access sensitive systems and data.  

• Detect and mitigate account impersonations across applications and services via SAML  (watch example) 
• Detect and mitigate account impersonation between IdPs (read more) 
• Prevent mutable identity issues allowing end user to impersonate admins 

Attackers who successfully penetrate your IAM fabric will first and foremost make simple changes to ensure they remain undetected and maintain or even escalate access. Protect your organization from persistence in IAM by detecting and mitigating these changes and exploitations.   

• Examine changes across the chain of trust between IdPs like establishing trust with a new IdP   
• Detect SAML proxying and changes to the configuration of downstream applications 
• Detect malicious changes to trust certificates