Unit 01 · 1 h 18 min
Identities are the new perimeter
Map every person, service account, token and device that can sign in, and find the ones nobody watches.
Identity and Access Security
Most breaches start with a login. Learn to find, stop and clean up identity attacks the way they really happen.
- Time
- 14 h 38 min
- Lessons
- 48
- Machine
- In your browser
What you earn
RootCertificateIdentity and Access Security, certificate of completion MicrosoftSC-300Identity and Access Administrator Associate CompTIASecurity+CompTIA Security+
Prepares you for Identity and Access Administrator Associate and CompTIA Security+. Root is not affiliated with these issuers.
You will be able to
- Inventory people, service accounts, tokens and devices that can sign in
- Detect sprays, stuffing, push fatigue and stolen sessions in identity logs
- Choose MFA by what defeats it, and roll out phishing-resistant methods
- Harden help desk resets, app consent and conditional access
- Run privileged access with just-in-time roles and break-glass accounts
Units and lessons
Unit 02 · 1 h 22 min
Passwords, spraying and stuffing
Tell a spray from a brute force from credential stuffing in real sign-in logs, and set a password policy that helps.
Unit 03 · 1 h 36 min
MFA done right
Rank MFA methods by what defeats them, catch push fatigue and SIM swaps in the logs, and see why security keys stop phishing.
Unit 04 · 1 h 30 min
The help desk as an attack surface
Audit password and MFA resets, verify callers properly and watch the people who can see customer data.
- 1Case file: one phone call to the service desk18 min · virtual lab
- 2Verify the caller, not the story18 min · virtual lab
- 3Case file: audit the reset tickets20 min · virtual lab
- 4Case file: support agents and customer data18 min · virtual lab
- 5Case file: the third parties who can reset you16 min · virtual lab
Unit 05 · 1 h 30 min
Sessions and tokens
Stolen cookies skip passwords and MFA entirely. Learn to spot them, keep them out of files and end them properly.
Unit 06 · 1 h 30 min
OAuth apps, integrations and consent
Apps and integrations hold tokens that skip MFA. Review grants, catch stolen integration tokens and block device code tricks.
Unit 07 · 1 h 28 min
Conditional access and legacy holes
Policies say MFA everywhere. Find the exclusions, legacy protocols, forgotten tenants and old accounts where it does not apply.
Unit 08 · 1 h 24 min
Privileged access
Cut standing admin rights, run just-in-time access, keep break-glass accounts safe and take secrets out of scripts.
Unit 09 · 1 h 42 min
Detecting identity attacks
Triage impossible travel, new MFA devices, mass downloads, payment fraud and QR phishing without drowning in false alarms.
- 1Impossible travel, possible explanations18 min · virtual lab
- 2A reset, a new device and an inbox rule20 min · virtual lab
- 3Mass downloads by a leaver16 min · virtual lab
- 4Case file: changed bank details18 min · virtual lab
- 5Case file: payments approved on a video call16 min · virtual lab
- 6Case file: a QR code that asks for MFA14 min · virtual lab
Unit 10 · 1 h 18 min
Capstone: an identity incident end to end
Work a vishing-led SSO takeover from the first alert to containment and a lessons-learned report.
Ten units built on real incidents, from sprays and push fatigue to help desk resets, stolen sessions and OAuth tokens. Every lab runs in your browser on Kestrel Outfitters' logs and settings.