Blind Spots and Backdoors: Practical Advice for Identity Risk Reduction

Check your expanding identity attack surface

Identity has become the new perimeter, and attackers know it. According to new research from CrowdStrike, 80% of modern cyberattacks are identity-driven, leveraging compromised credentials.

This substantial volume is driven by the widespread use of well-known directories such as Active Directory, and the vulnerabilities associated with compromised privileged accounts that are overprivileged or unmanaged, not network intrusion.

The explosion of privileged credentials and lack of adequate visibility or oversight can be attributed to growth, whether due to migration to the cloud, mergers and acquisition, the increased use of contractors, or simple organic business growth. This growth outpaces the ability to adequately govern the environment, leaving exploitable vulnerabilities.

Vulnerabilities hiding in plain sight

Your IAM environment may be loaded with vulnerabilities because of unchecked privileged accounts. The primary sources of risks include:

• Identity sprawl: Organic or inorganic growth can result in an explosion of identities or identity accounts. This sprawl includes orphaned accounts, duplicate identities, and stale objects. As the number of identities grows, visibility and governance often decrease.
• Privilege creep: Joiners, movers or leavers can often accumulate access that is never revoked, either due to resource constraints or lack of visibility or oversight. This access that accumulates over time can leave an identity or identity account privileges they shouldn't have, providing an attacker with the opportunity for breach and lateral movement to access high value resources.
• Shadow admin rights: Unconventional identity and group governance and management efforts can result in unchecked administrator rights. For example, nested groups often obscure layers of privileges that are unknown, nearly invisible, yet increase your attack surface. Likewise, delegated permissions that no one tracks is a breach waiting to happen.
• Disconnected systems: Using different consoles for each domain or tenant can seem like the only option, however this creates identity silos across Active Directory, between environments like on-prem and cloud, which results in inconsistent identity governance policies and policy enforcement. This often leads to unchecked privileges due to duplicate accounts or oversight.
• Manual, inconsistent JML (Joiner-Mover-Leaver) processes. Back to those joiners/movers/leavers – the tendency for inconsistent, manual policies to result in dormant risk is substantial.

Hidden in plain sight: How identity sprawl is quietly expanding your attack surface

Don't leave your business vulnerable to attackers. Watch this expert-led webinar to cut through the chaos.

Learn how to:

• Establish consistency across your Microsoft environment
• Build a well-governed identity foundation
• Reduce AD and Entra ID complexity
• Shrink your risk with confidence

Ignorance is bliss – but also potential risk exposure

The result of a mis-managed identity environment can stretch well beyond risk of exposure to breach. The reality is as risky as it is real: It's not whether an identity account will be compromised, it's how far can the attacker travel laterally within your organization once that account has been compromised.

Compliance exposure is a tremendous risk. Not meeting regulatory requirements involving specific data types and reporting can result in potential exposure to audit failures.

Likewise, a broad attack surface due to privilege sprawl and standing privileges leaves any organization open to breach, lateral movement, and privilege escalation.

Least privilege at the core can protect the perimeter

The principle of Least Privilege is to ensure every identity account has the right access at the right time for the right reason – nothing more and nothing less. This is easier said than done, and "you can't get there from here" is often the case with manual reviews and processes. Automation goes a long way towards ensuring policies are implemented and enforced consistently to reduce or eliminate standing privileges and dramatically reduce risk to an organization. Likewise, continuous reviews of entitlements can provide oversight and visibility that audits miss. While compliance is absolutely necessary, a framework to provide holistic identity governance can be useful for both compliance and overall risk reduction.

A framework to identify risk

Full visibility across the identity estate, whether on prem, cloud, or hybrid, can help an organization assess the amount of risk they face and identify any anomalies that need to be addressed. They can then prioritize high-risk high-privilege and high-exposure accounts to remediate first. Centralized visibility and control of the identity environment can ensure continuous oversight for a perpetually clean, well-structured environment.

Active, automated mitigation for the win

A few critical practices can help clean and protect an identity environment and keep it in good standing. These practices include:

• Automated JML workflows to eliminate manual gaps
• Dynamic groups with policy-based access to reduce human error
• A comprehensive strategy that pairs identity governance and PAM to address all privileges from the outside in.

Least privilege as a continuous practice

Achieving identity security with a least privilege framework isn't a one-time concern where you set the parameters and tactics and walk away. It is an evolving strategy with tactics that respond to the landscape and are continuously adapted to fit your needs today, whether they are security in general, compliance with specific regulations, or both.

The foundation of a resilient organization is a comprehensive least-privilege framework coupled with continuous visibility across the identity landscape. Evaluate your identity landscape now, before your vulnerabilities become a threat actor's opportunity.

About the Author: Andras Fekete is the Product Manager for Active Roles at One Identity. He is responsible for formulating and driving product strategy within identity security and governance for Microsoft environments.

At One Identity, Andras has worked across Privileged Access Management (PAM) and Identity Governance and Administration (IGA), developing and executing the strategy and evolution of the enterprise security products in his portfolio. His focus is on modernizing identity governance across Active Directory, Microsoft Entra ID, and hybrid Microsoft environments, with particular focus on cloud transformation, automation, and the application of AI to identity security.

Prior to his work in Identity security and governance, Andras held engineering, product owner and project leadership roles in the automotive industry where he led complex security-related technical projects.

Andras holds an engineering background and combines technical experience with product strategy, customer engagement, and business leadership.