Identity is part of the attack surface. A compromised account is only dangerous because of what that account…
samuel watua Soita — Full Stack Software Engineer
Reshared from a post by Esla K.
Identity is part of the attack surface.
A compromised account is only dangerous because of what that account can access.
So during an investigation, don't stop at:
“Which account was compromised?”
Ask:
→ What privileges did it have?
→ What systems could it reach?
→ What data could it access?
→ Were there lateral movement opportunities?
→ Was MFA enabled?
→ Was the access actually required?
Identity → Privilege → Access → Exposure
Good detection needs identity context.
#Cybersecurity #IdentitySecurity #DetectionEngineering #SOC #SecurityOperations #NcryptoEdge
1 reactions · 0 comments