<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-identity-security-architecture-review
description: >-
  Conduct comprehensive reviews of identity security architecture covering identity providers, authentication, authorization, and federation.
domain: cybersecurity
subdomain: identity-security
tags:
  - architecture-review
  - identity-architecture
  - authentication
  - authorization
  - security-assessment
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078"]
---

# Performing Identity Security Architecture Review

## Overview

Identity security architecture review evaluates the design, implementation,
and security posture of an organization's identity infrastructure. Reviews
assess identity provider configuration, authentication strength, authorization
models, federation trust, and identity data flows.

## Prerequisites

| Requirement | Install |
|---|---|
| Architecture documentation | Current identity architecture diagrams |
| Identity provider admin | Configuration review access |
| Network diagrams | Identity traffic flow understanding |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Review Domains

| Domain | Focus Areas |
|---|---|
| Identity Providers | Configuration, redundancy, patch level |
| Authentication | MFA coverage, password policy, passwordless |
| Authorization | RBAC/ABAC model, least privilege, SOD |
| Federation | Trust relationships, protocol security |
| Directory | AD/LDAP security, replication, backup |
| Privileged Access | PAM deployment, just-in-time access |

### Assessment Framework

For each domain, evaluate:
- **Design** — Is the architecture sound in principle?
- **Implementation** — Does the deployment match the design?
- **Configuration** — Are settings aligned with best practices?
- **Monitoring** — Are security events detected and alerted?
- **Resilience** — Can the system survive component failure?

### Common Findings

- MFA not enforced for all users or critical applications
- Legacy authentication protocols still enabled
- Overly broad federation trust relationships
- No privileged access management (PAM) solution
- Insufficient monitoring of identity infrastructure

## Workflow

1. **Define review scope** — identify identity systems and boundaries
2. **Gather documentation** — collect architecture diagrams and configurations
3. **Assess identity providers** — evaluate configuration and security posture
4. **Review authentication** — analyze MFA coverage and password policies
5. **Evaluate authorization** — assess RBAC/ABAC models and least privilege
6. **Inspect federation** — review trust relationships and protocol security
7. **Report findings** — document gaps with severity and remediation guidance

## Quick Reference

```bash
# Run the agent
node scripts/agent.js analyze --target <scope>
node scripts/agent.js report --target <scope>
```

## Detection

```yaml
title: Identity Security Architecture Review Detection
id: ee386a89-896c-4e17-9694-bf46dfa47512
status: experimental
description: Detects suspicious activity related to performing identity security architecture review techniques in identity security context
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventType: authentication
    Status: failure
  condition: selection
level: high
tags:
  - attack.t1078
  - attack.credential_access
falsepositives:
  - Service account authentication during scheduled batch processing
```

## Verification

| Check | Method |
|---|---|
| Scope defined | All identity systems in scope identified |
| Documentation gathered | Architecture diagrams and configs collected |
| Providers assessed | Identity provider security posture evaluated |
| Authentication reviewed | MFA coverage and policy gaps documented |
| Findings reported | Architecture review report with recommendations |

## References

- [NIST SP 800-63 — Digital Identity Guidelines](https://csrc.nist.gov/pubs/sp/800/63/4/ipd)
- [Microsoft — Identity Security Best Practices](https://learn.microsoft.com/en-us/entra/fundamentals/concept-secure-remote-workers)
- [CIS Controls — Identity Management](https://www.cisecurity.org/controls)
- [NIST SP 800-207 — Zero Trust Architecture](https://csrc.nist.gov/pubs/sp/800/207/final)
