Identity Security
When a credential leaks, the attacker walks in the front door, with permission. This layer decides who can get in, from where, and with what privilege.
- MFA
- Single sign-on
- Conditional access
- Privileged accounts
Stealing a password is still cheaper than breaking a system.
Valid credentials are the preferred way in: they don't trip alarms and let an attacker move calmly. The control isn't the password itself but what's required around it, what each account is allowed to do, and how long it keeps an elevated privilege.
- There are accounts for people who no longer work at the organization.
- The administrator uses the same account for everything, all day.
- No one reviews which countries logins are coming from.
What the layer includes
Every component is implemented, configured, and left under SOC watch. We don't hand over bare licenses.
Second factor on anything that exposes data
Phased rollout, starting with administrators and remote access, with the least possible friction for the end user.
Single sign-on
One identity for the organization's applications, with centralized, traceable provisioning and deprovisioning.
Conditional access
Rules by device, location, and session risk: logging in from the corporate machine isn't the same as from an unknown device.
Privileged account management
Privilege is requested, approved, and expires. No one stays a permanent administrator out of convenience.
The layer isn't installed and forgotten.
Everything this layer generates flows into the SIEM, gets correlated with the rest of the stack, and is reviewed by an analyst on shift. What follows is the same across all nine layers.
Classified in under a minute
The Triage Agent reviews every event that comes in, at any hour, and discards the noise before it reaches a person.
Confirmed by an analyst
The decision to contain, isolate, or escalate is made by a person with context on your operation, not an automation.
It gets logged
Every action on this layer enters the period's report, with time, owner, and outcome.
- Inventory of active, orphaned, and privileged accounts.
- Report of anomalous access and what was done about each.
- Matrix of active conditional access rules.
This layer within the nine
No layer requires the others. Most of our clients start with two or three and move forward based on their reality.
What people ask about this layer
Will the second factor annoy users?
It's configured to only ask when the context warrants it. Day to day from the usual device, most people barely notice it.
Does it work if we use Microsoft 365 and other standalone apps?
Yes. Single sign-on extends to applications that support the standards; those that don't are documented as an exception with a compensating control.
How long does it take to implement?
The phased rollout usually takes four to eight weeks depending on the number of applications and users.
What if someone loses their phone?
There is a verified recovery procedure, operated by the SOC, so no one is locked out of their work or a gap opens up.
Let's see how this layer stands in your operation.
A free review, no strings attached. We'll tell you what we found, what to fix first, and what to expect.
We respond within one business day. Ecuador, Colombia, Bolivia, the United States, and Canada.