Identity-based attacks: how they work and how to defend against them

▤ Summary

This article explains how identity-based attacks work across passwords, multi-factor authentication, directory services, cloud identity providers, and privileged accounts. It walks through common techniques such as credential stuffing, phishing, Kerberoasting, token theft, and SAML or OAuth abuse. It also outlines practical detection methods, including log monitoring, anomaly detection, and alerts for suspicious authentication or directory activity. The mitigation guidance focuses on phishing-resistant MFA, least privilege, just-in-time access, stronger password and session controls, and identity governance. The piece is aimed at helping security teams reduce identity compromise and limit lateral movement after an initial breach.

▦ Linked Companies