What Is ITDR and How Does It Protect Against Identity Threats?

Quick Overview: Identity-based attacks can be difficult to detect because attackers may use legitimate employee accounts to access business systems. ITDR adds another layer of security by monitoring identity activity for signs of compromise, helping Security Teams detect and respond to threats such as business email compromise.

What Is Identity Threat Detection and Response (ITDR)?

Identity Threat Detection and Response (ITDR) monitors user identities and account activity for signs that an account may have been compromised, then gives security teams the information they need to investigate and respond. ITDR is intended to provide visibility into identity-based threats such as account takeover, suspicious authenticated activity, and business email compromise.

ITDR generally focuses on four functions:

1. Monitor- Continuously monitor identity and account activity for indicators that something may be wrong.

2. Detect- Identify behaviors such as suspicious logins, possible account takeover, session abuse, or signs of business email compromise.

3. Investigate- Provide security professionals with context around suspicious activity so they can determine whether it represents a legitimate user or a potential security incident.

4. Respond- When a compromise is identified, take appropriate action to contain the threat and limit its potential impact.

Why do Cybercriminals Target Employee Identities?

Cybercriminals target employee identities because stealing a legitimate user’s access can be easier and less noticeable than breaking into a network.

With compromised credentials or an authenticated session, an attacker may be able to sign in as an employee and access business resources while appearing to be a trusted user. Identity-focused attacks can lead to account takeover and business email compromise.

This is especially concerning in Microsoft 365, where one employee account can provide access to email, files, collaboration tools, and other business resources.

How Is AI Changing Identity-Based Cyberattacks?

AI is making identity-based attacks faster, more personalized, and more convincing. Cybercriminals can use generative AI to create realistic phishing emails, imitate how a person or company communicates, and support voice impersonation and other social engineering tactics.

For example, AI can help create polished phishing messages or fake meeting invitations that direct employees to fraudulent login pages.

Once an attacker has access to a legitimate identity, the challenge changes. It is no longer just about stopping the initial phishing attempt. Businesses also need a way to detect when a trusted account may actually be under an attacker’s control.

What Can Identity Compromise Look Like?

A compromised account will not necessarily announce itself with a flashing warning.

Instead, there may be subtle changes in behavior that deserve investigation.

Potential warning signs can include:

• Suspicious Microsoft 365 sign-ins
• Account activity from unexpected locations
• Activity occurring outside a user's normal patterns
• An authenticated session being used in a suspicious way
• Unexpected mailbox rules
• Emails automatically forwarding to an outside address
• Unusual applications receiving access or permissions
• Other behaviors inconsistent with the legitimate user's activity

These warning signs matter because business email compromise and account takeover can involve an attacker attempting to remain hidden after gaining access.

How Can Businesses Better Protect Employee Identities?

Businesses can strengthen identity security by adding ITDR as another layer of their cybersecurity strategy alongside protections such as MFA, endpoint security, email security, and employee security training.

For organizations using Microsoft 365, ITDR can add capabilities including:

Around-the-Clock Monitoring- Microsoft 365 accounts can be monitored for suspicious sign-ins and other indications of account compromise, including activity occurring outside typical business hours.

Detection Beyond the Password- ITDR can help identify suspicious authenticated activity, including indications that an attacker may be using a stolen login session.

The goal is not simply to determine whether the correct password was entered. It is to provide greater visibility into whether the activity associated with an authenticated identity appears suspicious.

Earlier Warning of Email Compromise- Unusual mailbox rules or unexpected external email forwarding can be indicators that someone is attempting to use a compromised mailbox to remain hidden, access information, or facilitate fraud.

By identifying this activity earlier, Security Teams have another opportunity to investigate before the compromise results in greater damage.

Faster Investigation and Response- Cybersecurity alerts are more useful when security professionals also have the context necessary to understand what happened.

Greater visibility into identity activity can help Security Teams investigate suspicious behavior sooner and, when necessary, take steps to contain a compromised account and limit its potential impact.

Identity Security Is Becoming an Essential Layer of Cybersecurity

Endpoints, passwords, MFA, email security, and employee education all remain important parts of a strong cybersecurity strategy. ITDR adds another layer by helping security teams identify suspicious activity involving the identities behind those protections.

For Usherwood Managed IT clients, ITDR adds greater visibility into Microsoft 365 identity activity and gives our Security Team additional capabilities to investigate potential account compromise and respond when necessary.

Cybersecurity threats will continue to change. Our approach to protecting our clients will continue to evolve with them.

Want to strengthen your organization's approach to identity security? Talk with Usherwood about how our Managed IT and cybersecurity services can help protect your Microsoft 365 environment.