What is ITDR

ayshakhatunasha

In this article, we will tell you about a new effective tool to combat cyberattacks, which allows you to identify vulnerable credentials and attacks on them in real time.

As many studies show, corporate information virtual phone number service security services are directing the lion's share of budgets to IAM-class systems, as the number of attacks on credentials is steadily growing.

Compromising and then using credentials to access information systems has become a central element of almost every cyberattack. This is an inevitable consequence of attackers seeking and using new ways to exploit an ever-increasing attack surface and credential exposure. Multi-factor authentication is no longer enough.


The enhanced authentication system is usually implemented in a corporate environment at the client or intermediate component level (Credential Provider, LDAP Proxy, RADIUS Server, etc.), while the authentication provider (KDC and LDAP Server of the domain controller) continues to operate in single-factor mode.

Thus, a large number of attack vectors against credentials remain relevant even if an organization uses IAM in full.

ITDR (Identity Threat Detection and Response) is a term from Gartner to describe a set of tools and best practices for protecting identity systems. Companies spend significant amounts of money to modernize their access management (IAM) systems, but the modernization mostly focuses on improving authentication technologies, which increases the attack surface of a fundamental part of the security infrastructure.

ITDR systems are designed to ensure the protection of credentials, identify and prevent attacks on them.

ITDR is a set of technical means and organizational measures aimed at identifying, containing and preventing attacks that target credentials.



The systems included in the ITDR solution continuously monitor the activity of user and service accounts, identifying atypical sequences of events and patterns that indicate the preparation or execution of an attack on credentials. To assess the processes occurring in the infrastructure, the indicators can be compared both with statically specified values ​​and with basic statistical data that are constantly calculated during the operation of ITDR systems.

Depending on how the system qualifies a particular threat, entities affected by the incident may be blocked from accessing certain services or required to provide additional authentication factors.

ITDR class solutions allow you to identify:

illegitimate use of credentials;
attempts to escalate privileges;
service and pseudo-administrative credentials;
attacks on credentials (password spraying, golden/diamond ticket, lateral movement, etc.).
And also ensure the protection of credentials, detect and counter attacks by blocking access and informing other security systems.

For more information about the ITDR class solution, visit the Indeed ITDR product page .