Identity Security Is Becoming a Third Pillar of Security Operations
Summary
The article argues that cloud adoption has made identity a distinct security-operations concern, citing Storm-0558, BEC and an Azure advisory, and urges organizations to improve visibility into third-party identity platforms.
Key points
- The article argues that cloud and distributed services have moved identity beyond traditional host- and network-focused security, while relevant logs and controls may reside with providers.
- It cites Storm-0558’s compromise of Microsoft cloud controls and access to information from multiple government agencies; a proposed extension involving a signing key was disputed by Microsoft.
- The article says BEC relies on impersonating or taking over trusted identities and cites more than $2 billion in company losses in 2022.
- It discusses a Tenable advisory about potential cross-tenant access to information, including authentication secrets, in Microsoft Azure; the issue was under investigation and described as a platform design concern.
- The article urges organizations to seek greater visibility into identity-provider activity and ingest available account and authentication data to look for malicious activity.
Article Details
- Topic
- Identity security as a distinct security-operations discipline, including cloud identity compromise, business email compromise, and the need for improved visibility and monitoring.
People
Threat Actors
Vendors
MicrosoftIn July 2023, Microsoft published limited information on a group tracked as Storm-0558. The entity, assessed as China-based, subverted controls in Microsoft’s cloud infrastructure to harvest information from multipleTenableAlong these lines, Tenable recently published an advisory concerning Microsoft Azure, where an attacker, through unspecified means, could access information from other tenants, including authentication secrets. While