As we begin this journey through the area of cybersecurity, we find ourselves navigating an ever-expanding threat landscape. The digital age, while bringing unparalleled convenience and connectivity, also introduces complex challenges that demand sophisticated solutions.

ITDR was identified by Gartner Inc. (and the term ITDR was created by them as well), an IT research and advisory company, as one of the top security and risk management trends that IT leaders and security leaders need to have a strategy on. Adversaries, attackers, hackers, we can call them whatever we want, abuse access and identities, and the focus of their attacks is identity compromise, lateral movement, and privileged escalation. Therefore, we need tools and processes to detect, investigate, and respond to these types of threats to efficiently defend our organization. If we start thinking that ITDR is a security discipline and not just a product, to get...

As we continue our exploration of cybersecurity, it’s essential to recognize that the nature of identity threats has evolved significantly. Today’s adversaries employ increasingly sophisticated methods to exploit and manipulate identities within organizational networks. Unlike earlier attacks that might have relied solely on brute force or basic phishing techniques, modern identity threats are multi-faceted, leveraging advanced tactics to achieve their objectives.

Modern adversaries target identities using a variety of sophisticated techniques, including the following:

• Credential theft and reuse: Attackers obtain user credentials through phishing, malware, or social engineering and reuse them across multiple platforms to gain unauthorized access (think about the solarwinds123 password that caused the SolarWinds hack)
• Pass-the-Hash (PtH) attacks: Exploiting stolen hashed passwords, attackers authenticate...

MDI is designed to protect on-premises AD identities, our core foundation of the organization, and its primary feature is to monitor user activities, network traffic, Windows events, and entity behaviors continuously. It uses advanced algorithms and machine learning to detect unusual activities, such as lateral movement, privilege escalation, and reconnaissance attacks, which could indicate potential security breaches.

Today, it’s more common that we still use AD as our Source of Authority (SoA) and synchronize the identities to Microsoft Entra ID. It’s also still common that we are using Active Directory Federation Services (AD FS) and Active Directory Certificate Services (AD CS). These workloads must be protected at all times. Just because we are still required to keep using those legacy systems, they are critical workloads and should be treated as Tier 0 systems a.k.a. your most critical asset. We will...

MDI is designed to protect against identity-based attacks in hybrid environments, providing a vigilant watch over AD and Microsoft Entra ID. MDI continuously monitors user activities and authentication patterns, offering real-time alerts and insights to detect threats such as credential theft, lateral movement, and privilege escalation.

These are the key features of MDI:

• Behavioral analytics: MDI builds a baseline of normal user behaviors to spot unusual activities, such as unexpected logins or data access. This helps catch compromised accounts early before attackers can cause serious harm.
• Advanced threat detection: MDI excels at detecting sophisticated attack techniques, such as PtH, PtT, Golden Ticket, Silver Ticket, and Kerberoasting. It also catches threats such as DCShadow and DCSync, providing insights into potential AD manipulation.
• Lateral Movement Path (LMP) analysis: MDI maps potential pathways attackers could...

In this chapter, we delved into the growing identity threat landscape and the vital role that MDI plays in addressing these challenges. We explored the modern identity-based threats organizations face, the defense frameworks that help mitigate these risks, and how MDI strategically fits into the broader cybersecurity ecosystem. We also highlighted the key features of MDI, showing how it strengthens defenses against advanced attacks, providing critical ITDR capabilities.

As we move on to the next chapter, the focus shifts to practical deployment. I’ll guide you through important pre-installation planning to ensure you’re prepared, followed by a detailed step-by-step guide for deploying MDI. You’ll also learn how to configure proxy settings and ensure a successful setup by conducting vital post-installation activities.