DEV Community

StarkMan
StarkMan

Posted on

Identity Is Now the Perimeter: Lessons From Credential-Based Intrusions

#identity #mfa #zerotrust

Identity Is Now the Perimeter: Lessons From Credential-Based Intrusions

The most common way into a modern enterprise is not an exploit. It is a valid account. Stolen credentials, session tokens, and misconfigured federation let an attacker look like a legitimate user, which is precisely why detection has become harder and why network-centric defences deliver less than they used to.

Why credentials dominate

Three developments converged.

Remote work moved authentication to the public internet, so identity providers became directly reachable. Cloud adoption replaced the internal network with APIs authenticated by tokens. Software-as-a-service spread data across dozens of providers, each with its own session and its own token lifetime.

The result is that the useful unit of access is no longer a network segment but a token or session. An attacker with a valid session does not need to bypass a firewall; they are already inside the trust boundary.

The pattern in recent incidents

Public incident reporting repeatedly describes the same sequence: initial access through stolen credentials or session hijacking, discovery and privilege escalation, then movement toward data stores or identity infrastructure. In several high-profile cases the identity provider itself was the target, because controlling it means controlling access to everything federated to it.

Microsoft's 2023 disclosure of a nation-state intrusion into its corporate email environment, attributed to the group it tracks as Midnight Blizzard, is a documented example of an identity-centric intrusion against a major provider. The company's own account described a password spray against a legacy non-production tenant followed by access to corporate email.

Controls that actually reduce this risk

  • Enforce phishing-resistant multi-factor authentication. Push-based approval and SMS codes are repeatedly defeated by real-time relay and fatigue attacks; hardware-backed or passkey-based factors are not.
  • Shorten session and token lifetimes, and bind tokens to the device where the platform supports it.
  • Monitor for impossible travel, anomalous token issuance, and new device registrations, not just failed logins.
  • Inventory service accounts and remove interactive logon rights from them.
  • Treat identity provider configuration as production change management, including conditional access and federation trust settings.

Conclusion

If identity is the perimeter, then identity configuration is the firewall rule set. Organisations that invest in phishing-resistant authentication, short-lived credentials, and monitoring of token issuance close the gap that password-based defences leave open.

References

Top comments (0)