Identity is the new perimeter. Test it like one.
Firewalls are no longer where the fight is. The adversary logs in.
The adversary logs in
For a long time, security had a shape. There was an inside and an outside, and a wall between them. Defending the organisation meant defending the wall.
That shape has gone. Work happens in services the organisation does not host, on devices it does not always own, in places it cannot see. What holds it together is identity: the accounts, sessions and permissions that decide who can do what.
Adversaries noticed first. Breaking through a wall is noisy and uncertain. Signing in with a valid account is quiet and, to most monitoring, perfectly normal. Increasingly, the adversary does not break in. They log in.
Why identity is hard to see
Identity is difficult to defend for the same reason it is useful: it is everywhere. Every service has its own accounts. Every integration has its own credentials. Every person has accumulated access over years of changing roles, and very little of it has ever been taken away.
The result is an estate of permissions that nobody fully understands. Service accounts with broad rights and no clear owner. Administrators whose privileges were granted for a project that ended. Third parties with standing access that made sense once. Each one is a door, and most of them are not on any diagram.
Monitoring makes it harder still. Tools built to spot intrusions look for things that are out of place. A valid account doing something it is permitted to do is, by definition, in place. The difference between an employee and an adversary using the same account is often only intent, and intent does not appear in a log.
Testing it like a perimeter
If identity is the perimeter, it deserves the scrutiny the network once had. That means testing it from the adversary's point of view rather than auditing it from the administrator's.
An audit asks whether policy is configured. A test asks what an adversary could do with a single account, and how far that account could take them. It follows the relationships between identities as well as the identities themselves: who can reset whose access, which groups grant control over other groups, which systems trust which.
We look at the whole life of an identity, well beyond the moment of sign-in. How access is requested, approved, used and removed. Where sessions persist longer than they should. Where recovery processes can be persuaded to do the wrong thing. Most weaknesses live in the joins between these stages.
The output is not a list of misconfigurations. It is a set of paths, each showing how an ordinary starting point becomes control of something that matters, and which single change would break the path.
What good looks like
Strong identity defence is not a single control. It is a set of habits that make the adversary's job slower and louder.
Privilege is granted for a purpose and removed when the purpose ends. High-value accounts are few, well known and closely watched. Unusual behaviour from a valid account is treated as a signal worth investigating. Recovery and support processes are tested as rigorously as the login page, because adversaries know they are often the softer target.
None of this is new. What is new is treating it as the front line rather than an administrative task.
What to do about it
Start where an adversary would.
- Map the paths from an ordinary account to your most privileged ones, and close the shortest first.
- Give every service and third-party account a named owner and a reason to exist, or remove it.
- Test your account recovery and support processes with the same rigour as your sign-in.