Quick answer: ITDR (Identity Threat Detection and Response) is a security discipline focused on detecting and responding to identity based attacks such as stolen passwords, hijacked sessions and privilege escalation. IAM governs access, PAM protects privileged accounts, EDR monitors the endpoint. ITDR closes the gap between these layers, that is, attacks against identity itself.

Why did identity become the new attack surface?

Today many attacks start not by exploiting a vulnerability but by signing in with a valid identity. The attacker gets in with a stolen password, a hijacked session cookie or a misconfigured privilege, and appears to be a legitimate user. This is why people say attackers no longer break in, they log in.

In this picture classic defenses fall short on their own. Strong passwords and multi factor authentication matter, but they do not help once a session is stolen or an admin account is compromised. ITDR exists precisely here, to catch suspicious behavior at the identity layer.

How does ITDR differ from IAM, PAM and EDR?

Layer Focus
IAM Identity and access management, who can access what
PAM Protection and control of privileged accounts
EDR Detection of malicious behavior on the endpoint
ITDR Detection and response to attacks and abuse at the identity layer

ITDR does not replace these layers, it fills the gap between them. IAM and PAM are preventive, they govern access. ITDR is detection and response focused: it notices when an identity is compromised and reacts.

What does ITDR detect?

ITDR monitors suspicious behavior against identity infrastructure and accounts. Typical examples:

  • Sign in from an unusual location or device
  • Use of hijacked sessions via a stolen session cookie
  • Sudden privilege escalation and excessive privilege requests
  • Attack techniques against Active Directory and directory services
  • Dormant or abandoned accounts suddenly becoming active
  • Multi factor authentication fatigue attacks

Responding when an identity is compromised

ITDR includes not only detection but response. When an identity is found to be compromised, a fast and correct sequence matters:

  1. Terminate all active sessions of the account, that is, revoke the tokens.
  2. Temporarily suspend the account or enforce additional verification.
  3. Determine which systems and data the attacker accessed from the logs.
  4. Prioritize administrator and single sign on (SSO) accounts.
  5. Find the root cause (stolen password, session theft, or misconfiguration).

The priority of these steps matters. Simply resetting the password is not enough if the attacker holds a valid session.

The KAOS and DSET approach

DSET performs digital forensics and incident response (DFIR) in identity compromise incidents and audits the organization's identity attack surface. Our KAOS security engine ties attack paths against Active Directory and directory services (such as privilege escalation chains) to evidence. Our goal is not exaggerated threat narratives, but showing the real attack path at the identity layer with evidence and building the correct response.

Related reading: IAM identity and access management, PAM privileged access management, infostealer and session cookie theft, Active Directory attack techniques, leaked passwords and credential stuffing, SIEM and SOC.

Frequently asked questions

Does ITDR replace IAM or PAM? No. IAM and PAM are preventive layers, they govern access and protect privileged accounts. ITDR is detection and response focused, noticing and reacting when an identity is compromised. ITDR fills the gap between these layers, it does not replace them.

What is the difference between ITDR and EDR? EDR detects malicious behavior on the endpoint. ITDR detects attacks against the identity layer, that is, accounts, directory services and sessions. Access made with a stolen session cookie may not leave a malicious file on the endpoint, so what EDR sees and what ITDR sees are different.

If we use MFA, do we need ITDR? Multi factor authentication is an important control, but it is not enough on its own. It does not help once a session cookie is stolen or an admin account is compromised. ITDR complements MFA because it catches suspicious behavior after authentication completes.

Sources

To audit your identity attack surface and for forensics and response in an identity compromise incident, you can talk to our team at Ankara Hacettepe Technopark. Contact DSET.