Unit 1: Identities are the new perimeter · Lesson 1 of 4 · 18 min
What counts as an identity
People are only one kind of login. Service accounts, tokens and devices sign in too, and they are rarely reviewed.
mission
- You are
- You are the new identity engineer at Kestrel Outfitters, an online outdoor retailer.
- Situation
- Most breaches in the last five years started with a login, not an exploit. Your manager wants to know what can sign in to Kestrel before anything else changes.
- Goal
- Read the identity inventory and size up each kind of identity.
- Hand in
- Four numbers: people, service accounts, tokens and unmanaged devices.
Every identity is a key on the same ring
Open the People tab
Each row is someone who can sign in. Note the Type column: employees and contractors live side by side.
you should see 33 rows. Contractors are mixed in with staff, each with an end date.
Open Service accounts
Service accounts run jobs and integrations. They have no manager, no holidays and no one to notice odd sign-ins.
you should see 10 accounts. Look at the Owner and Interactive sign-in columns.
defender tip A service account that can sign in interactively with a password is a person-shaped hole. Block interactive sign-in for every account that does not need it.
Open Tokens and keys
Tokens and keys log in without a password or an MFA prompt. Expiry is the only clock on them.
you should see Filter for never: three keys that will work until someone revokes them.
Open Devices
Sessions live on devices. A personal laptop with malware hands its browser sessions to whoever controls it.
you should see Sort by Managed. Three devices say No: two personal laptops and a personal phone.
What a defender takes away
- 1People, service accounts, tokens and devices are all identities.
- 2Non-human identities outnumber people and get reviewed least.
- 3An inventory is the first control: you cannot protect a login you do not know exists.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.