Security teams have traditionally protected their IT environment by focusing on keeping threat actors out of the corporate network. This was a relatively straightforward goal when a company’s infrastructure was contained in a centralized location, and employees accessed it from workstations in the same building. The business stored and processed all data assets on servers and storage devices it owned exclusively. Strong security relied on firewalls to control who could access the network. Once inside, entities were trusted and could use the systems and applications as needed.
This simple model does not reflect the realities of modern IT environments. Businesses today may have applications living in multiple clouds and SaaS platforms. Employees and contractors may work from various locations, including home offices and hotel rooms. They use a variety of tools to access the distributed infrastructure, including laptops, smartphones, and personal devices. Complex infrastructures have made it impossible to secure the environment by defending a single perimeter wall. They must protect their assets by validating the identity of every entity for every access attempt.
Why Do Threat Actors Target Identity?
The organized freelance threat actor community has become increasingly sophisticated to counter modern cybersecurity solutions. While many attacks still rely on zero-day exploits and faulty network security, modern hackers increasingly use another, more disguised path into the environment. They compromise the identities of approved entities to access infrastructure, exfiltrate data, or plant malware.
Threat actors with valid credentials appear as legitimate users to the IT environment’s security solutions. Traditional network defenses can’t distinguish a normal user from someone using compromised credentials. Once an attacker or its AI agents get inside the network, those credentials let them move laterally and escalate privileges while they search for sensitive data and high-value targets without drawing attention. This approach is much more efficient than constantly trying to leverage software exploits to launch an attack.
How Do Threat Actors Compromise Valid Credentials?
Malicious threat actors use multiple strategies and tactics to compromise legitimate credentials. These techniques can exploit human and technical weaknesses in many ways.
Stealing credentials directly
The most direct strategy is to steal credentials using the following methods.
- Phishing and spear phishing: Threat actors create fake login pages or emails that appear to be legitimate to trick users into providing credentials or approving access requests. A spear phishing attack targets a specific group of users with tailored messages that may be more likely to lead an unsuspecting user to click a malicious link.
- Credential dumping: An attacker inside a network can extract authentication data such as password hashes or plaintext passwords from the operating system’s memory, caches, and configuration files.
- Infostealing malware: This malicious software secretly extracts passwords, session cookies, and other sensitive data from infected devices.
Reusing or guessing passwords
Hackers reuse or guess passwords using several tactics.
- Password spraying, which tries common passwords across multiple accounts.
- Credential stuffing, which reuses username and password pairs from previous breaches
- Brute force attacks against devices or services with weak controls.
Bypassing Multi-Factor Authentication
While MFA improves security, several techniques can thwart it.
- Session hijacking and token theft steal authenticated session cookies, eliminating the need to log in to a system or application.
- SIM swapping takes over a legitimate phone number to intercept SMS authentication codes for malicious use.
- Push bombing causes MFA fatigue by continuously spamming approval prompts until someone inadvertently accepts one.
Trust and permission abuse
These methods exploit existing permissions for threat actors to use.
- Malicious OAuth apps that allow rogue access to a mailbox or filesystem even after a password change.
- Kerberoasting, in which hackers obtain Active Directory service tickets and crack them to recover account passwords.
- Reusing stolen Kerberos tickets and hashes to authenticate without a password.
- Attacking misconfigured and overprivileged accounts or systems with weak conditional access policies.
How Can Your Business Protect User and Entity Identity?
Organizations must shift their security focus to defend the new perimeter effectively. Identity must become central to the security strategy. The following techniques and policies are instrumental in protecting a business from identity-based breaches.
- Teams can implement stronger authentication methods that resist phishing attacks. SMS codes and push notifications can be intercepted, limiting the benefits of MFA. Fraudulent login pages can’t use passkeys or FIDO2 hardware keys. Companies should prioritize these authentication techniques for admins and sensitive roles.
- Companies should implement a least-privilege policy by default for all employees. Everyone should have access only to the resources they need, and only for as long as necessary. Teams should consider just-in-time (JIT) access and conduct regular reviews to identify potentially compromised accounts.
- Zero trust principles never assume authentication or authorization purely based on network location. Teams should explicitly verify all access requests across the environment, considering device health, location, risk level, and behavior.
- Businesses must continuously monitor the entire environment with advanced tools designed to detect and respond to identity threats. Monitoring should look for unusual privilege changes and abnormal user behavior to catch threat actors already logged in.
- Organizations must take defensive measures for devices and service accounts that can be compromised and used to access the environment. Teams should create and manage an account inventory and rotate passwords regularly. Never use default vendor passwords.
- Companies must govern all aspects of identity management throughout the full lifecycle. This means managing permissions during onboarding, offboarding, and role changes. Threat actors often leverage orphaned or stale accounts to obtain usable credentials.
VAST’s Role In Securing the Identity Perimeter
We can help your company address the challenges of securing your environment’s identity perimeter in multiple ways. Our managed infrastructure service provides experts who can identify and mitigate vulnerabilities before compromised credentials can exploit them. Several of VAST’s strategic partners have advanced solutions focused on identity protection.
Semperis addresses the security risks of attacks on your Active Directory (AD) environment. It is a comprehensive, AI-powered platform that provides lifecycle defense before, during, and after identity-based attacks.
Huntress is a managed platform that protects digital identities and system access with real-time detection and response to identity-based threats.
Contact VAST today and learn how we can help your business protect its identity perimeter and secure your IT environment.
