Chapter 7 — Identity and access foundations
Lesson map
Lesson 07 published. Map, example, EX019.
flowchart TD
N0["Learning outcomes"]
N1["7.1 Credentials as targets"]
N2["7.2 Sign-in logs"]
N3["7.3 Supporting controls"]
N4["7.4 Exposure notices"]
N5["7.5 Shared accounts"]
N6["7.6 Service accounts"]
N7["Leavers and dormant accounts"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX019"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 Credentials as targets"]
N2["7.2 Sign-in logs"]
N3["7.3 Supporting controls"]
N4["7.4 Exposure notices"]
N5["7.5 Shared accounts"]
N6["7.6 Service accounts"]
N7["Leavers and dormant accounts"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX019"]
[Learning outcomes]
|
v
[7.1 Credentials as targets]
|
v
[7.2 Sign-in logs]
|
v
[7.3 Supporting controls]
|
v
[7.4 Exposure notices]
|
v
[7.5 Shared accounts]
|
v
[7.6 Service accounts]
|
v
[Leavers and dormant accounts]
|
v
[Worked example] --> [Exercise EX019]
Learning outcomes
You will (1) explain why stolen credentials are central to many intrusions; (2) read sign-in logs for intelligence matches; (3) support identity controls with intelligence; (4) handle exposed-credential notices safely.
7.1 Credentials as targets
Phishing pages that imitate the council's single sign-on page collect staff passwords. Attackers then log in normally — Valid Accounts (T1078). Many intrusions involve no malware at all.
A login with a stolen password looks like the real user to most systems, so no malware alert fires and no unusual file appears. This is why intelligence about credential phishing, such as lookalike sign-on pages, is matched against identity logs and DNS rather than against endpoint protection, which may see nothing at all.
7.2 Sign-in logs
The identity provider logs user, time, source address, application and result. When MCX shares addresses used in credential attacks against councils, Lena searches sign-in logs for successful logins from them.
Searching for successful logins matters most, because failures alone show attempts that did not work. A success from an address MCX has linked to credential attacks shows which account may now be in an attacker's hands. Lena records the time range searched with every result, because the addresses are useful only for days before attackers move on.
7.3 Supporting controls
Intelligence that councils face password-spraying justifies lockout thresholds and multi-factor authentication for all staff, including part-time library workers who were previously exempt.
The library workers were exempt from multi-factor authentication, which made their accounts the easiest target for password-spraying, since the attacker tries a few common passwords across many accounts. Intelligence that other councils face this attack gives the security manager evidence to remove the exemption, rather than an abstract argument about good practice. Lockout thresholds also limit how many guesses an attacker can make against one account before it is temporarily locked.
7.4 Exposure notices
Sometimes a partner reports CMS addresses found in a public credential dump. Lena never tests the passwords. She passes the list to the identity team through a restricted ticket; they force resets.
Testing the passwords, even to see whether they still work, would mean using credentials CMS staff never gave her and logging into accounts that are not hers. The restricted ticket limits who can see the list, because it contains staff names and possibly passwords. Forced resets make the leaked passwords useless whether or not they were still valid.
7.5 Shared accounts
Shared logins on library staff desks make it impossible to tell who did what. Intelligence about account abuse strengthens the case for individual accounts.
When a shared library login appears in an alert, nobody can say which staff member was at the desk, so investigation stops at the account. Individual accounts make each action traceable and let one account be disabled without locking out every library desk. MCX reports of account abuse at other councils give the case concrete examples.
7.6 Service accounts
Accounts used by applications often have broad rights and passwords that never change. When intelligence describes attackers seeking such accounts, the identity team reviews their rights and rotates credentials first.
Service accounts are attractive because one stolen password may give broad access and nobody notices unusual use. Reviewing rights first reduces what a stolen password could do, and rotation makes an older stolen password useless. The identity team schedules rotation with application owners, because changing a password the application still uses would break it.
Leavers and dormant accounts
Accounts of staff who have left are attractive to attackers because nobody notices their use. A monthly report of accounts with no sign-in for 60 days, checked against human-resources leaver lists, closes many quiet entry points.
Worked example
MCX shares five addresses used in password-spraying against councils. Lena's search finds 40 failed logins and one success from one address against a parks-department account. The identity team resets the password, revokes sessions and reviews the account's recent actions. The user had reused a password from a breached shopping site.
Synthetic case. The addresses and account are invented.
Errors and limits
Attackers rotate addresses quickly; address matches are useful for days, not months.
Exercises
- EX019 — No malware. Explain how an intrusion can succeed without malware. Rubric: 3 = stolen credentials, valid-account login (T1078); 2 = partial; 1 = impossible; 0 = none.
- EX020 — Testing passwords. Why must Lena never test passwords from a dump? Rubric: 3 = unauthorised access/legal and policy breach; identity team resets instead; 2 = partial; 1 = acceptable; 0 = none.
- EX021 — Spraying response. List the identity team's three actions after the successful spray login. Rubric: 3 = reset password, revoke sessions, review actions; 2 = two; 1 = one; 0 = none.
Synthesis
Credentials are prime targets; match intelligence against sign-in logs, support identity controls and handle exposure notices without touching passwords.
Continue studying — chapter 07 of 30
← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →