<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: identity-security
description: >-
  Identity security operations including identity threat detection and response
  (ITDR), credential compromise detection, identity posture assessment, adaptive
  authentication, identity governance, zero trust identity architecture, identity
  attack path analysis, decentralized identity, and identity lifecycle automation.
  Use when the operator asks about identity-based attacks, credential stuffing,
  MFA bypass, Entra ID, Okta, SCIM provisioning, OAuth/OIDC abuse, SAML attacks,
  identity risk scoring, or identity-aware zero trust policies.
domain: cybersecurity
subdomain: identity-security
tags:
  - identity-threat-detection
  - credential-compromise
  - identity-governance
  - adaptive-authentication
  - zero-trust-identity
  - identity-posture
  - attack-path-analysis
  - decentralized-identity
  - identity-lifecycle
  - identity-risk-scoring
  - itdr
  - iam
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI,
  and any agentskills.io-compatible agent.
metadata:
  mitre-attack:
    - T1078   # Valid Accounts
    - T1110   # Brute Force
    - T1556   # Modify Authentication Process
    - T1528   # Steal Application Access Token
    - T1539   # Steal Web Session Cookie
    - T1550   # Use Alternate Authentication Material
    - T1606   # Forge Web Credentials
    - T1621   # Multi-Factor Authentication Request Generation
    - T1098   # Account Manipulation
    - T1136   # Create Account
    - T1087   # Account Discovery
    - T1069   # Permission Groups Discovery
  nist-csf:
    - PR.AC   # Identity Management and Access Control
    - PR.MA   # Maintenance
    - DE.CM   # Security Continuous Monitoring
    - DE.AE   # Anomalies and Events
    - RS.AN   # Analysis
  frameworks:
    - "NIST SP 800-63"
    - "NIST SP 800-207"
    - "CIS Controls v8"
    - "ISO 27001:2022 Annex A.9"
    - "OWASP ASVS"
---

# Identity Security

## Overview

Identity is the new perimeter. As organizations adopt cloud-first architectures,
identity systems (IdPs, directories, federation protocols) become the primary
attack surface and the primary control plane. Identity security encompasses
detection of identity-based attacks, hardening of authentication and authorization
systems, governance of identity lifecycles, and zero trust identity architecture.

This domain covers the full identity security lifecycle: from detecting credential
compromise and MFA bypass to implementing adaptive authentication, identity risk
scoring, and decentralized identity. It bridges offensive identity attack techniques
with defensive detection and governance controls.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Python 3.10+ | Agent tooling and automation scripts |
| Azure CLI / `az` | Entra ID (Azure AD) operations |
| Okta CLI / API token | Okta tenant administration |
| `pip install msal` | Microsoft Authentication Library |
| `pip install okta` | Okta SDK for Python |
| `pip install python-jose` | JWT/OIDC token validation |
| `pip install scim2-filter-parser` | SCIM filter parsing |
| SIEM access | Log correlation for identity events |
| Graph API permissions | Microsoft Graph identity queries |

## Key Concepts

### Identity Attack Surface

```
┌─────────────────────────────────────────────────────┐
│                  Identity Attack Surface              │
├──────────────┬──────────────┬────────────────────────┤
│  Credentials │  Protocols   │  Governance            │
├──────────────┼──────────────┼────────────────────────┤
│ Password     │ SAML         │ Orphaned accounts      │
│ Spray        │ Assertion    │ Excessive privileges   │
│              │ Forgery      │                        │
├──────────────┼──────────────┼────────────────────────┤
│ Credential   │ OAuth Token  │ Stale service          │
│ Stuffing     │ Theft        │ principals             │
├──────────────┼──────────────┼────────────────────────┤
│ MFA Fatigue  │ OIDC Claim   │ Missing lifecycle      │
│ / Bombing    │ Manipulation │ automation             │
├──────────────┼──────────────┼────────────────────────┤
│ Token Replay │ Kerberos     │ Dormant admin          │
│              │ Attacks      │ accounts               │
└──────────────┴──────────────┴────────────────────────┘
```

### Identity Threat Detection and Response (ITDR)

ITDR is the discipline of detecting and responding to identity-based threats
across the authentication and authorization stack:

```python
# Core ITDR signal categories
ITDR_SIGNALS = {
    "credential_anomaly": [
        "impossible_travel",
        "password_spray_pattern",
        "credential_stuffing_velocity",
        "brute_force_threshold",
    ],
    "session_anomaly": [
        "token_replay",
        "session_hijack",
        "cookie_theft",
        "concurrent_sessions",
    ],
    "privilege_anomaly": [
        "role_escalation",
        "admin_creation",
        "permission_grant_spike",
        "service_principal_abuse",
    ],
    "protocol_anomaly": [
        "saml_assertion_forgery",
        "oauth_consent_phishing",
        "oidc_claim_manipulation",
        "kerberos_golden_ticket",
    ],
}
```

### Zero Trust Identity Principles

1. **Verify explicitly** — authenticate and authorize based on all available data points
2. **Least privilege access** — limit access with just-in-time and just-enough-access
3. **Assume breach** — minimize blast radius and segment access; verify end-to-end encryption

## Quick Reference

| Task | Technique | Key Tool |
|---|---|---|
| Detect credential attacks | `detecting-credential-compromise` | SIEM + IdP logs |
| Identity threat detection | `implementing-identity-threat-detection` | ITDR platform |
| Assess identity posture | `performing-identity-posture-assessment` | Graph API + Okta API |
| Decentralized identity | `implementing-decentralized-identity` | DID/VC standards |
| Attack path analysis | `performing-identity-attack-path-analysis` | BloodHound / Graph |
| Adaptive authentication | `implementing-adaptive-authentication` | Conditional Access |
| Governance violations | `detecting-identity-governance-violations` | IGA platform |
| Security monitoring | `implementing-identity-security-monitoring` | SIEM + UEBA |
| Identity risk scoring | `performing-identity-risk-scoring` | ML risk engine |
| Zero trust identity | `implementing-identity-zero-trust` | Policy engine |
| Lifecycle automation | `implementing-identity-lifecycle-automation` | SCIM + workflows |
| Detect identity attacks | `detecting-identity-based-attacks` | ATT&CK + Sigma |

## Workflow

```
PHASE 1: ASSESS
├── Enumerate identity providers and federation topology
├── Map identity attack surface (accounts, protocols, governance)
├── Inventory privileged identities and service principals
└── Baseline authentication patterns and normal behavior

PHASE 2: DETECT
├── Deploy identity threat detection rules (Sigma, KQL, SPL)
├── Configure ITDR signal correlation
├── Enable identity-aware UEBA baselines
└── Map detection coverage to MITRE ATT&CK identity techniques

PHASE 3: HARDEN
├── Implement adaptive authentication policies
├── Enforce least privilege via identity governance
├── Automate identity lifecycle (joiner/mover/leaver)
└── Deploy zero trust identity controls

PHASE 4: MONITOR
├── Continuous identity posture assessment
├── Identity risk scoring and anomaly detection
├── Attack path analysis and remediation
└── Governance violation detection and response

PHASE 5: RESPOND
├── Identity incident triage and containment
├── Credential revocation and session termination
├── Forensic analysis of identity-based attacks
└── Post-incident identity hardening
```

## Techniques

| # | Technique | Description |
|---|---|---|
| 1 | `detecting-identity-based-attacks` | Detect identity-layer ATT&CK techniques |
| 2 | `implementing-identity-threat-detection` | Build ITDR detection pipelines |
| 3 | `performing-identity-posture-assessment` | Assess and score identity hygiene |
| 4 | `implementing-decentralized-identity` | DID, verifiable credentials, SSI |
| 5 | `detecting-credential-compromise` | Detect stolen/leaked credentials |
| 6 | `implementing-identity-lifecycle-automation` | SCIM provisioning and JML workflows |
| 7 | `performing-identity-attack-path-analysis` | Graph-based privilege escalation paths |
| 8 | `implementing-adaptive-authentication` | Risk-based and step-up authentication |
| 9 | `detecting-identity-governance-violations` | Policy drift and access violations |
| 10 | `implementing-identity-security-monitoring` | Continuous identity telemetry |
| 11 | `performing-identity-risk-scoring` | ML-driven identity risk assessment |
| 12 | `implementing-identity-zero-trust` | Zero trust identity architecture |

## Verification

```bash
# Verify identity security tooling
python3 -c "import msal; print('MSAL:', msal.__version__)"
python3 -c "import jose; print('python-jose available')"
az account show --query '{sub: id, tenant: tenantId}' 2>/dev/null || echo "Azure CLI not configured"

# Validate agent scripts
for technique in techniques/*/scripts/agent.js; do
    python3 -m py_compile "$technique" && echo "OK: $technique" || echo "FAIL: $technique"
done

# Run ruff checks
ruff check techniques/*/scripts/agent.js

# Test identity posture assessment
python3 techniques/performing-identity-posture-assessment/scripts/agent.js assess --target entra-id

# Test credential compromise detection
python3 techniques/detecting-credential-compromise/scripts/agent.js scan --source haveibeenpwned
```

## References

- [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-3/)
- [NIST SP 800-207 Zero Trust Architecture](https://csrc.nist.gov/publications/detail/sp/800-207/final)
- [MITRE ATT&CK — Valid Accounts T1078](https://attack.mitre.org/techniques/T1078/)
- [MITRE ATT&CK — Credential Access Tactic](https://attack.mitre.org/tactics/TA0006/)
- [CIS Controls v8 — Control 5: Account Management](https://www.cisecurity.org/controls/account-management)
- [CIS Controls v8 — Control 6: Access Control Management](https://www.cisecurity.org/controls/access-control-management)
- [OWASP ASVS — Authentication Verification](https://owasp.org/www-project-application-security-verification-standard/)
- [Microsoft Entra ID Protection](https://learn.microsoft.com/en-us/entra/id-protection/)
- [Okta Security Technical Whitepaper](https://www.okta.com/resources/whitepaper-okta-security/)
- [W3C Decentralized Identifiers (DIDs)](https://www.w3.org/TR/did-core/)
- [W3C Verifiable Credentials](https://www.w3.org/TR/vc-data-model/)
