Blog By: SILVERFORT
Identity-based attacks that exploit compromised credentials to access resources are a blind spot in the security stacks of many organizations. As a result, identity-based attacks have increasingly become prevalent in today’s threat landscape. Furthermore, these are the threats that organizations find most challenging to mitigate, as lateral movement and ransomware spread cause widespread damage daily.
Even though real-time protection exists against a variety of attack types – such as malware, data access, and data exfiltration – it is not present when attackers are authenticating with valid credentials (yet compromised). To counter these attacks effectively, a paradigm change is required – user identities must be treated as distinct attack surfaces with their own characteristics.
To provide real-time protection against this type of threat, one must be able to accurately identify malicious authentication attempts and proactively prevent them. Since no security product is designed to be involved in the authentication process, the task is beyond their scope.
Identity providers are at the center of all authentication activities in today’s environment, they are the sole components capable of enforcing these types of protections. Typically identity providers do not go beyond validating the password that is received.
While identity providers play an important role in providing real-time protection against identity-based attacks, they cannot provide the full level of protection that is required. This is the gap Silverfort Unified Identity Protection addresses.
The Solution: Silverfort’s Unified Identity Protection Platform
Silverfort’s platform integrates natively with all identity providers in order to add risk analysis and proactive prevention capabilities to the initial credential check performed by the identity provider. Whenever an IDP on-prem or in the cloud receives an access request, it forwards it to Silverfort. As a result of receiving this data from all the IDPs, Silverfort is able to see the full authentication activity of every user across all the resources within the organization.
Silverfort MFA – How is it Different?
Silverfort extends MFA to any resource, regardless of whether it supports MFA natively or not. Utilizing agentless and proxyless technology, Silverfort integrates directly with all IdPs including Active Directory. When the IdP receives an access request, it awaits its verdict and forwards it to Silverfort. Silverfort analyzes the access request and, if necessary, challenges the user to verify its identity with MFA. Silverfort evaluates the user’s response to determine whether he or she should be trusted and passes the verdict on to the IdP that grants or denies access based on the user’s response.
As a result of this approach, it does not matter whether the access request was made over RDP or command line and if the system supports MFA or not. As long as the request was made through the IdP of your choice, Silverfort will be able to process it. Thus, real-time identity protection is achieved by switching from MFA at the resource level to MFA at the directory level.
Automating the Discovery, Monitoring, and Protection of Service Accounts
Silverfort automates the discovery, access control, and protection of all service accounts in the IT environment. By doing so, organizations can gain granular visibility into all non-human identities and machine-to-machine authentications, as well as their sources, destinations, authentication protocols, and activity volumes. Silverfort monitors the behavior of every service account and, upon detection of a risky deviation, can trigger a real-time response of either alert or real-time blocking.
Silverfort also provides tailored policies according to the specific behavior patterns of each service account. By providing this level of granular protection, service accounts can be completely protected without the need to rotate passwords, which can disrupt mission-critical functions.
The Silverfort ITDR Way: Real-Time Protection Against All Identity Threats
Silverfort’s Unified Identity Protection platform is the first to introduce a full set of ITDR capabilities with native integration into all IdPs (including AD, Azure AD, ADFS, Okta, and PingFederate). Silverfort ITDR is natively integrated into the authentication flow of these IdPs, which forward all incoming access requests to Silverfort for risk analysis, and then await Silverfort’s verdict before granting or denying access.
In addition, Silverfort ITDR is the only solution that can extend MFA to all legacy and on-prem authentication. This includes legacy applications, command-line access to workstations and servers, file shares, and many other systems that could not have been protected in this way before. This makes Silverfort’s ITDR solution the ultimate protection against lateral movement and ransomware attacks in AD environments.
Real-Time Protection Against Identity Threats is Essential
Accounts will inevitably be compromised, regardless of what we do. Against this inevitable reality, the question is how to gain the upper hand over adversaries. The Silverfort platform solves the critical security gaps in identity protection and prevents threat actors from using their credentials for malicious purposes, which allows organizations to maintain a secure environment.
