-: Detecting identity attacks.
So, here's the big one as a cyber-security analyst.
How do you detect these attacks against identity systems?
Well, there's a lot of different ways you can do it.
Identity and access management systems should be fed
into your SIEM, and that's gonna help integrate that
across all of the other data that you're seeing collect.
This is going to help you allow it to configure it,
so you can detect privileged account usage
and determine if it's normal or not.
Privilege changes and granting of additional permissions,
account creation and modifications,
terminated user account usage,
lifecycle management events
and separation of duty violations.
As you start configuring the SIEM, you're gonna start
being able to create some automated patterns based
on what is normal and what is not normal,
and then as an analyst you'll start
looking into those abnormal activities.
This requires active monitoring.
Active monitoring by knowledgeable technicians
is what's gonna help you identify these issues
with your identity systems.
Humans must analyze the reports to identify
the specific issues and understand what normal is
so they can understand what abnormal is.
Because a lot of these things may not look abnormal
to a computer.
If you start looking in the admin and go,
"hmm, he's been logged in seven out of eight hours
of his workday in his admin account,"
that may be okay, but it may be something
you wanna look into.
Maybe he just had a lot of work to do as an admin that day,
and so he had to be logged in the whole time.
Maybe not.
These are things humans have to analyze
because the computers are not great at looking at these.
They can notify that this is an abnormal pattern,
but you have to be able to look at it with a human eye
to see if it passes the rational sense test.