EP182 ITDR: The Missing Piece in Your Security Puzzle or Yet Another Tool to Buy?
Jul 22, 2024
auto_awesome
Guest Adam Bateman, Co-founder of Push Security, discusses ITDR: its definition, benefits, and alternatives. Topics include workload vs human identity ITDR, common threats detected, and advice for implementation. The podcast explores the evolution of ITDR, its relationship with other security categories, advantages of browser telemetry, and specific threats addressed by ITDR tools.
ITDR focuses on detecting and responding to identity attacks, extending beyond on-premises to safeguard cloud identities.
Incorporating browser-based telemetry enhances ITDR's detection capabilities for identifying cloned sites and monitoring unmanaged identities.
Deep dives
Overview of ITDR
ITDR, which stands for Identity Threat Detection and Response, focuses on detecting and responding to identity attacks similar to how EDR deals with endpoint attacks. The evolution of ITDR indicates a shift towards safeguarding not just on-premises active directory attacks but also addressing incidents like phishing attacks that occur within browsers. The emphasis on cloud identities and capturing telemetry directly from browsers highlights the need to extend security measures beyond traditional methods, adapting to the evolving attack landscape.
Distinguishing ITDR from Predecessors
Aligning ITDR with earlier security measures like AV and EDR showcases its evolving nature, particularly in safeguarding identity systems against a broader range of threats. The shift towards safeguarding cloud identities signifies a pivotal focus on the changing attack surfaces as organizations migrate towards cloud-based infrastructures. By encompassing attacks like phishing that occur within browsers, ITDR expands the scope of identity protection beyond traditional on-premises security approaches.
Integration and Comprehensive Approach in ITDR
In the realm of identity security, ITDR integrates various detection methods beyond simply pulling logs from cloud systems, extending to capturing telemetry directly from browsers for a comprehensive view of the attack surface. This approach mirrors traditional security practices like EDR, network defense, and email security where diverse sources of data contribute to a robust security posture. Emphasizing a consolidated view of identity threats across on-premises and cloud environments underscores the need for a multifaceted approach to ITDR implementation.
Challenges and Novel Aspects of Identity Threat Detection
The implementation of ITDR presents nuanced challenges and opportunities for organizations seeking to enhance their security posture. By incorporating browser-based telemetry, ITDR can offer unique detection capabilities like identifying cloned sites, detecting session hijacking, and monitoring unmanaged identities that contribute to a decentralized identity attack surface. The shift towards decentralized and unmanaged identities online underscores the importance of considering all facets of the identity threat landscape for a comprehensive and adaptive security strategy.