SANS 2026 State of Identity Threat Detection and Response: Key Findings
Zane A. — Security Consultant
Internet Structure, Breaches & Anonymity in OSINT and Cybersecurity:
Your Internet Footprint Is Talking:
Before an attacker sends a packet, your organization may already be telling a detailed story through public routing data, DNS delegations, certificate logs, peering records, historical infrastructure, and breach material.
Internet-structure intelligence is not simply reconnaissance; it is the baseline for understanding what an organization owns, where it interconnects, which services it has exposed over time, and where its defensive assumptions may be incomplete. Modern breach activity also increasingly targets authenticated sessions, browser artifacts, OAuth tokens, API keys, and other identity material, not just passwords.
Recent identity-threat research highlights token hijacking, compromised browsers, and MFA fatigue as significant attack paths alongside phishing.
Internet Cartography:
The internet is a network of independently managed networks exchanging traffic through TCP/IP. For security analysis, it helps to separate the environment into two connected layers:
• Underlay: The physical and routing foundation; ISPs, backbone providers, submarine cables, data centers, Autonomous Systems, and Internet Exchange Points.
• Overlay: The logical services operating across that foundation; DNS, CDNs, cloud platforms, edge nodes, web applications, identity services, and APIs.
Passive analysis of these layers can provide meaningful attack-surface visibility without directly probing an organization's infrastructure. Certificate history, passive DNS, public routing data, PeeringDB records, and registry information can help defenders build an external inventory and identify gaps between what the organization believes it owns and what the internet shows.
Build the Structural Dossier:
A useful external-security dossier should connect assets rather than treat each finding as isolated.
• Autonomous System Numbers: Identify the organization's ASNs, subsidiaries, acquired companies, and related network entities.
• CIDR prefixes: Track registered IPv4 and IPv6 address ranges across RIRs such as ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC.
• Upstreams and peers: Understand transit relationships and peering arrangements that influence how traffic reaches the environment.
• IXP presence: Exchange-point membership can indicate city-level or facility-level infrastructure presence.
• DNS authority chain: Map the delegation path from root and TLD servers to the organization's authoritative DNS infrastructure.
• Certificate Transparency history: Review certificates issued for corporate domains to identify forgotten hostnames, legacy services, staging environments, and naming conventions.
• Regional Internet Registries (RIR) contacts and records: Validate administrative, technical, and abuse contacts for accuracy and incident readiness.
The key is correlation: ASN to prefix, prefix to peer, peer to exchange point, domain to authoritative nameserver, certificate name to historic infrastructure. If an asset cannot be connected back to a known ASN, prefix, DNS record, certificate, or documented facility, treat it as a hypothesis, not a confirmed organisational asset.
What Public Layers Reveal:
Each public data layer answers different questions and supports different defensive actions.
• Routing and Autonomous System Number (ASN) data: Shows which network ranges are formally registered and which are actively announced. Helps detect stale records, unprotected prefixes, or unexpected origin ASNs.
• Peering and Internet Exchange Points (IXPs): Shows where the organization interconnects and maintains infrastructure presence.
Helps identify overlooked facilities and third-party dependencies.
• DNS authority: Shows who answers for a domain and whether DNSSEC is deployed consistently. Helps reduce delegation, takeover, and integrity risks.
• Certificate Transparency: Shows which hostnames have been publicly certified over time. Helps find shadow IT, staging systems, legacy names, and unexpected certificates.
• IP geolocation: Shows where infrastructure appears to be hosted. Helps validate regional exposure and investigate unexpected cloud or data-center presence.
• Breach intelligence: Shows which identity artifacts are circulating externally. Helps prioritize password resets, token revocation, and identity monitoring.
Certificate Transparency logs are especially valuable because they preserve a historical record. A hostname may disappear from current DNS while still appearing in certificate data—and it may point to a legacy application, staging deployment, or forgotten origin that deserves investigation.
Common Structural Exposures:
Several high-impact exposures emerge from internet structure rather than from software vulnerabilities.
• Missing or invalid Resource Public Key Infrastructure (RPKI ROAs): Prefixes without valid Route Origin Authorizations have weaker protection against route leaks and unauthorized BGP origin announcements.
• Stale IRR objects: Outdated Internet routing-registry records can cause confusion, weaken filtering decisions, and expose old or unowned address space.
• Leaked AS-SET membership: Routing-policy objects may reveal customer, supplier, or partner relationships that expose supply-chain adjacency.
• Open DNS zone transfers: A misconfigured authoritative server can reveal a broad host, mail, and TXT-record inventory.
• Missing DNSSEC: Unsigned zones lack an important integrity layer against DNS manipulation and cache-poisoning classes of risk.
• Orphaned nameservers: Legacy delegations and expired vendor relationships can increase domain or subdomain takeover risk.
• Wildcard CNAMEs to third parties: A released SaaS resource behind a wildcard record can become a takeover path.
• CDN or WAF origin exposure: Historical DNS, certificate data, or mail infrastructure may reveal addresses that bypass the public web edge.
• Certificate subject leakage: Internal naming conventions in public certificates can disclose architecture that was never intended for public visibility.
Identity Is the New Perimeter:
The breach landscape is increasingly shaped by identity, SaaS concentration, browser compromise, and session theft. A successful initial-access event may now look less like exploitation of a public-facing server and more like use of a legitimate session cookie, OAuth token, API key, or cloud identity.
Research published this week by SANS reports that organizations with identity tools still experience breaches, with compromised browsers, MFA fatigue, and token hijacking forming major parts of the threat picture. In parallel, threat reporting continues to highlight the operational importance of session controls, short-lived credentials, token revocation, and monitoring of non-human identities such as service accounts and automation keys.
Source:
2026 State of Identity Threat Detection and Response – SANS Institute
https://www.sans.org/research/identity-threat-detection-response-report
When breach material appears externally, avoid treating every record as proof of a corporate compromise.
Validate it first:
• Identify the exposed material; email address, password hash, cookie, session token, API key, or OAuth grant.
• Corroborate the claim against trusted breach notifications, vendor advisories, and threat-intelligence reporting.
• Separate recycled credential-stuffing lists and synthetic datasets from fresh, actionable material.
• Escalate quickly when current session material, privileged credentials, API keys, or evidence of active exploitation is present.
• Invalidate active sessions and rotate affected secrets as part of the response, not only passwords.
Anonymity Requires Discipline:
Privacy technologies, including Tor, can be lawful tools for research and authorised security engagements. They are not a substitute for authorization, documentation, or responsible operational practice.
Even passive queries can generate logs at a registry, resolver, API provider, or OSINT platform. Treat all structure-mapping activity as attributable unless engagement controls explicitly address attribution.
For authorised engagements:
• Use approved, isolated engagement infrastructure.
• Keep personal browsing and operational activity separate.
• Document sessions, scope, timing, and data-handling decisions.
• Prefer public data sources and passive collection before any live validation.
• Treat direct-origin checks, DNS-transfer attempts, and requests to live systems as active testing that requires explicit written approval.
Defensive Priorities:
Start with the controls that reduce exposure across routing, DNS, web infrastructure, and identity.
• Publish and maintain valid RPKI ROAs for every announced prefix.
• Keep IRR and route objects current; remove stale prefixes and obsolete AS-SET entries.
• Enable DNSSEC across production zones and validate DS-record consistency at the parent zone.
• Restrict DNS zone transfers to authorised secondaries, preferably with authenticated controls.
• Protect origin servers: restrict direct access, validate expected hostnames, and limit accepted source networks.
• Monitor Certificate Transparency streams for unexpected certificates and unfamiliar hostnames.
• Regularly review ASN, prefix, DNS, certificate, and cloud inventories as part of external attack-surface management.
• Build token-theft response playbooks that include session revocation, OAuth-grant review, API-key rotation, and investigation of browser compromise.
Ask yourself this question,
What is the most overlooked exposure in your organization's internet footprint right now?
Is it a forgotten subdomain that still resolves? A historic certificate revealing a staging host? A stale routing object? An MX host that sits outside the protections applied to the web perimeter? Or an active session token already circulating beyond your control?
Network scanning shows what responds today. Internet-structure intelligence shows what you own, where you connect, what you exposed before, and what adversaries can learn without directly touching your edge.
Your perimeter is visible. The real question is whether you know what it is showing the world.
ISCSECURITY Master Class Series: https://iscsecurity.org
Join the discussion: https://cyberr.ai/groups/iscsecurity
GitHub: https://github.com/zanderson73/
1 reactions · 0 comments