Skip to content
Pwnversity

Identity management (IAM)

“Identity is the new perimeter”: in cloud and hybrid environments, compromising an identity often grants more access than breaching a machine. IAM governs who is who, what they can do, and how it’s verified, and it’s the direct countermeasure to almost everything the AD and cloud cards exploit.

Pillars

Section titled “Pillars”
Authentication   prove who you are (password + MFA, passkeys)
Authorization    what you can do (RBAC/ABAC, least privilege)
Administration   lifecycle: onboarding, changes, OFFBOARDING (the forgotten offboarding = orphan accounts)
Audit            log accesses and privilege changes (see def-deteccion)

MFA and strong authentication

Section titled “MFA and strong authentication”
MFA               something you know + something you have/are
Phishing-resistant  FIDO2/passkeys/WebAuthn -> not stolen by AiTM (see se-tools)
                  vs OTP/SMS, which ARE intercepted (Evilginx)
MFA fatigue       limit push, number-matching (see se-vishing)
SSO/IdP           a strong control point... and a high-value target (protect it heavily)

Least privilege and privileged accounts

Section titled “Least privilege and privileged accounts”
RBAC/ABAC     permissions by role/attribute, reviewed periodically (access reviews)
PoLP          least privilege: nobody permanent admin "for convenience"
PAM           privileged access management: credential vault, checkout, recording
JIT / JEA     Just-In-Time / Just-Enough privilege: temporary, scoped admin
Tiering       separate admin accounts and workstations by level (AD model, ad-*)

Risks and attacks IAM mitigates

Section titled “Risks and attacks IAM mitigates”
- credential/session theft -> phishing-resistant MFA + anomalous session detection
- escalation via excess permissions -> least privilege and access reviews (ad-delegation, cloud IAM)
- orphan/shared accounts -> lifecycle and named accounts
- service account abuse -> managed credentials, no weak kerberoastable SPNs (ad-kerberos)

Blue Team / operation

Section titled “Blue Team / operation”
  • Phishing-resistant MFA as the goal for everything, prioritized for privileged accounts and remote access.
  • Periodic access reviews and fast revocation on offboarding; named, not shared, accounts.
  • PAM + JIT for admins; monitor authentications (impossible travel, spraying) in the SIEM.
  • Protect the IdP/SSO as a critical asset; watch for MFA and permission changes (honeytokens, Honeypots & deception).

Real-world cases

Section titled “Real-world cases”
  • MGM/Caesars (2023): MFA reset via help desk (see Vishing & smishing) → access with a legitimate identity.
  • Okta (2022-2023): incidents showing the IdP as a maximum-value target.
  • Golden SAML / token abuse (SolarWinds): compromising federated identity evades network controls.

Testing checklist

Section titled “Testing checklist”
  • MFA (phishing-resistant) everywhere, prioritized for privileged/remote
  • Least privilege with RBAC/ABAC and periodic access reviews
  • PAM + JIT/JEA for privileged accounts; admin tiering
  • Lifecycle: fast offboarding, no orphan/shared accounts
  • Monitoring of anomalous authentications in the SIEM
  • Reinforced protection of the IdP/SSO
  • Managed service accounts (no weak SPNs, see Kerberos Attacks)

References

Section titled “References”