Identity Intelligence

Gartner defines identity intelligence as the process of gathering and converting information about users’ identity and access so that organizations can gain action-oriented insights and make informed IT and business decisions. As attackers increasingly target user credentials, identity intelligence enables organizations to identify risks that exist outside traditional corporate boundaries.

Understanding Flare’s Identity Intelligence Capabilities 

How does Flare answer identity intelligence needs?

Flare’s platform continuously monitors the clear, deep, and dark web as well as illicit Telegram channels to identify leaked customer and employee information, including:

• Names
• User IDs
• Email addresses
• Passwords
• Active session Cookies 
• Security questions 

With insights into at-risk identity data, organizations can mitigate risks as threat actors deploy more account takeover and credential-based attacks. 

Why is Flare important to operationalizing identity intelligence?

As data breaches increase in volume and sophistication, organizations need to proactively identify sensitive data leaks before threat actors can use the stolen data. Flare’s platform integrates into a security teams’ workflows, including their security incident and event management (SIEM) tool. By correlating security information with identity intelligence, security teams can detect and respond to sensitive data leaks faster. 

What are Flare’s key benefits for identity intelligence?

• Visibility into the coverage issues preventing an organization from detecting data leaks across an increasingly expansive attack surface. 
• Proactive continuous monitoring across various avenues, including credentials hardcoded in source code or posted on sites like Pastebin.
• Reduce the impact of human error risks, like weak passwords used across personal and professional applications. 

Identity Intelligence: A Brief Overview

What is identity intelligence?

Identity intelligence can be considered a subset of cyber threat intelligence focused around detecting an organization’s user credentials. As part of a robust threat intelligence program, organizations should ensure that they collect the following types of identity intelligence data:

• Leaked credentials being sold on dark web forums and in illicit Telegram channels
• Passwords compromised as part of large data breaches
• Infostealer malware logs containing credentials
• Initial access broker (IAB) sales containing compromised credentials that cybercriminals can use to gain unauthorized access
• Hardcoded credentials or API keys in source code stored in GitHub repositories

What identity intelligence challenges do organizations face?

Problematically, most organizations struggle to collect and operationalize identity intelligence because: 

• Data exists outside the company’s boundaries, making it difficult to find and remove it. 
• Extracting valuable data from illicit Telegram channels and the clear, deep, and dark webs is often a time-consuming, manual task that requires security analyst experience with specialized tools. 
• Security analysts lack language skills needed to translate forum and channel posts written in foreign languages, like Russian, Arabic, Spanish, or French. 
• Data lacks context so security analysts need to manually correlate the identity intelligence with internal security tools to gain insights. 
• Collecting and analyzing identity intelligence becomes cost-prohibitive and inefficient when security teams need to use more than one tool to collect and review various types of data. 

How is identity intelligence related to Continuous Threat Exposure Management (CTEM)?

Identity intelligence uplevels an organization’s continuous threat exposure and management (CTEM) monitoring by enabling:

• Anomaly Detection: scanning digital identities and user activities to identify deviations from historical behavior, signaling possible identity-based attacks.
• Vulnerable Account Cleanup: flagging accounts that may be compromised or represent a risk so security teams can take preemptive action.
• Blocking High-Risk Access: Mitigating risks arising from unauthorized access attempts to bridge the gap between authentication methods like multifactor authentication (MFA) and secure access management

Why is Identity Intelligence Important in Today’s Cybersecurity Landscape?

How is identity intelligence related to cybersecurity?

In highly connected, complex application ecosystems, threat actors increasingly deploy credential based attacks like:

• Password spraying: trying commonly used passwords against various user logins, hoping that one provides access
• Brute force attacks: targeting a single user ID then trying multiple passwords, hoping one works
• Credential stuffing: using breached or leaked credentials to access a resource

Identity intelligence provides insights into compromised accounts to mitigate risks arising from:

• Fraud: Cybercriminals pretend to be legitimate customers to engage in fraudulent transactions, like making purchases or transferring funds.
• Account takeover: Malicious actors use legitimate credentials to take over an individual’s account, enabling them to hide as a known user while accessing sensitive data or resources. 
• API attacks: Threat actors use stolen API keys to compromise the application-to-application communication points. 

What are the benefits of identity intelligence?

As organizations work to mitigate risk, identity intelligence provides the following benefits:

• Enhanced Zero-Trust Readiness: Identifies potentially risky logins so organizations can clean up unused and vulnerable identities, paving the way for a solid zero-trust framework.
• Reduced Compromise Impact: Detects compromised credentials so that security teams can take proactive steps, like requiring users to reset passwords, enforcing MFA, or blocking access.
• Integrated Security Approach: Closes the gap between authentication and access, fortifying against both present and emergent cyber threats.

What are the best practices for implementing identity intelligence?

When implementing identity intelligence, organizations can follow these suggested best practices:

• Monitor Threat Actor Forums and Channels: The cybercriminal ecosystem trades in credentials, including ones obtained through large data breaches or that provide unauthorized initial access.
• Scan Code Repositories: Developers may accidentally leak credentials or API keys by including them in source code, creating an additional risk if other developers incorporate them into their projects. 
• Automate Processes: Reduce costs by automating key activities and using artificial intelligence (AI) to help contextualize events and translate threat actor forum posts. 
• Integrate with Security Alerts: Incorporate identity intelligence for high-fidelity, real-time alerts that reduce detection, investigation, and response times. 
• Augment Identity and Access Management (IAM): Combine identity intelligence with IAM monitoring for high-risk accounts, like administrator credentials, that pose a higher data breach risk.

Identity Intelligence and Flare

Flare provides the leading Threat Exposure Management (TEM) solution for organizations. Our technology constantly scans the online world, including the clear & dark web, to discover unknown events, automatically prioritize risks, and deliver actionable intelligence you can use instantly to improve security. Flare’s platform collects, correlates, and analyzes identity intelligence so companies can take proactive steps to mitigate risks at the identity layer, like credential-based attacks or fraud. 

Our solution integrates into your security program in 30 minutes to provide your team with actionable intelligence and automated remediation for high-risk exposure. See it yourself with our free trial.