{"id":55537,"date":"2022-08-19T09:43:33","date_gmt":"2022-08-19T01:43:33","guid":{"rendered":"https:\/\/version-2.com\/?p=55537"},"modified":"2022-09-29T17:41:19","modified_gmt":"2022-09-29T09:41:19","slug":"identity-threat-detection-response-itdr-what-you-need-to-know","status":"publish","type":"post","link":"https:\/\/version-2.com\/en\/2022\/08\/identity-threat-detection-response-itdr-what-you-need-to-know\/","title":{"rendered":"Identity Threat Detection & Response (ITDR): What You Need To Know"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>\n\n

Leading research firm Gartner has highlighted Identity Threat Detection and Response (ITDR) as one of the top cybersecurity trends of 2022, along with digital supply chain risk, attack surface expansion, and others. But what exactly is ITDR, and why is it important for organizations in 2022 and beyond? <\/p>\n\n

What is Identity Threat Detection & Response? <\/h2>\n

In simple words, identity threat detection and response is a new security category focused on detecting credential theft, privilege misuse, unapproved entitlements, and other identity-related threats and vulnerabilities. <\/p>\n\n

While other cybersecurity tools play a role in identity threat management, there\u2019s been a marked rise in cybercriminals targeting identity and access management (IAM) infrastructure in recent years. As a result, Gartner felt creating this new category would help organizations sharpen their focus and be better positioned to access the best tools and practices to defend their identity systems. Or in other words, identity-based attacks have become such a common cybersecurity threat that a dedicated and laser-focused approach to combating them is needed. <\/p>\n\n

The Case For ITDR <\/h2>\n

Today\u2019s cyber threat landscape is more severe than ever before. With organizations rapidly shifting to remote working and public cloud adoption, the traditional network edge effectively no longer exists. This means companies must shift their security posture to focus on identities over devices. <\/p>\n\n

At the same time, identity-based attacks are rising, and this trend shows no signs of slowing down in the foreseeable future. Today, cybercriminals increasingly bypass IAM by leveraging privileged access credentials. Then, they often move laterally across the networks, undetected. They also use this access to exfiltrate valuable data like employees\u2019 and customers\u2019 sensitive personal or financial information. <\/p>\n\n

The security impact of stolen credentials on identity systems is immense. For example, one study found by Verizon that stolen credentials cause 61% of all data breaches1. <\/p>\n\n

With the current state of the cyber threat landscape, cybersecurity experts are now recognizing that IAM and other related tools are not robust security. For example, Gartner argues that threat actors are \u201cactively targeting access management (IAM) infrastructure,\u201d so we need to develop new ways of protecting that infrastructure. <\/p>\n\n

As for a high-profile case of identity compromise in action, look no further than the SolarWinds attack of 2020. SolarWinds is a leading software company that provides system management tools for network infrastructure and monitoring to companies worldwide. Hackers inserted malware into signed versions of SolarWinds\u2019s software, which was then used to infiltrate an eye-watering 18,000 organizations. Essentially, SolarWinds\u2019 Orion Platform created a backdoor through which the hackers could impersonate users and accounts of the targeted organizations. The malware also accessed system files and managed to blend in with legitimate activity without detection. <\/p>\n\n

What Sets ITDR Apart? <\/h2>\n

A common question around ITDR is how it differs from other threat detection or identity management systems organizations already use today. Is it more of the same? The simple answer is no, but let\u2019s dive a little further to discover why. <\/p>\n\n

Existing identity protection tools like IAM, IGA, and PAM focus primarily on authorization and authentication, ensuring that the right people have access to the files and apps they need. In recent years, organizations have spent considerable effort improving these capabilities, adopting increasingly sophisticated software to manage identities and access with authentication. <\/p>\n\n

In certain cases, IAM can pose a significant security risk when used in isolation \u2013 they can become a single point of failure if compromised. This is where ITDR comes in. ITDR is really about segregating these duties so that we can secure our IAM infrastructure and ensure that it\u2019s working as intended. <\/p>\n\n

And how does ITDR stack up against Endpoint Detection and Response (EDR)? EDR is a layered approach to endpoint protection that unites real-time continuous monitoring and endpoint data analytics with a rule-based automated response. EDR solutions work similarly to ITDR but ultimately focus on different things. Namely, EDR looks for attacks on endpoints, while ITDR looks for attacks on identities. <\/p>\n\n

They also work differently once an attack has been identified. For example, when an EDR system detects an attack, it isolates the system to limit the hacker\u2019s movement or shuts down the system to stop the hacker in their tracks. By contrast, ITDR systems often add an additional layer of security by providing fake data that acts as a decoy. These solutions can also limit lateral movement through the network. <\/p>\n\n

However, it\u2019s also true that ITDR solutions may vary depending on the provider. With this in mind, here are the features a solution should have to qualify as ITDR: <\/p>\n\n

It should monitor and detect nefarious identity and privileges activity. <\/p>\n\n