> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/identities.md). # Identities With DoControl's Identity Risk Management solution, [discover](/docontrol-user-guide/risk-management/identities/identity-security-posture.md), [monitor](/docontrol-user-guide/risk-management/identities/monitor-risk-change.md) and automatically [retrieve](/docontrol-user-guide/risk-management/identities/get-identity.md) your SaaS identities to protect your organization from identity threats. {% hint style="info" %} Identities is available as a public beta module. {% endhint %} This overview includes the following topics: * [One-stop-shop Identity Risk Management ](#one-stop-shop-identity-risk-management)- High-level functional overview of DoControl's Identity solution. * [What is ITDR? ](#what-is-itdr)The prevalence of identity risks in the SaaS ecosystem, the main attack vectors, and why organizations are challenged to mitigate these risks. * [The DoControl differentiator](#the-docontrol-differentiator) - How DoControl leverages enriched metadata from multiple sources to provide full context for risky identities, and use cases covered by DoControl's solution. * [Prerequisites](#prerequisites) - What to do before leveraging DoControl's Identity Risk Management solution. ## One-stop-shop Identity Risk Management End users are the weakest link in the organization’s SaaS security chain, and most data breaches are identity-initiated. To fortify your SaaS ecosystem security, DoControl consolidates all aspects of identity in one place, so you can: * **Aggregate all user data into a single identity posture**\ DoControl determines the risk profile for each identity based on comprehensive data collection, user permissions and relevant business context from HRIS and IdP (Okta). * **Analyze and benchmark identity risk profiles**\ Strong benchmarking data based on user and department benchmarks enables you to correlate abnormal identity activity with posture. * **Monitor risky users and investigate risk changes** \ DoControl tracks risk score spikes and provides you with enriched metadata so you can understand the reasons for risk score changes. * **Retrieve identity metadata**\ With DoControl's automated workflows, you can leverage the Get identity data step to retrieve both personal and risk exposure data for any internal user. {% hint style="info" %} **For example**: Anomalies include deviations from normal identity activity patterns, such as when a finance employee shares an unusually large number of files with an external account. {% endhint %} ## What is ITDR? Most attacks, breaches and security incidents are identity-initiated in that they use the identities of internal users. ITDR (Identity threat detection and response) is a core pillar for security teams, who require immediate visibility into the organization’s riskiest users, together with the ability to mitigate risk. The main goal of ITDR is to detect and respond to attacks on identity systems and infrastructure, such as compromised or stolen credentials, phishing, insider threats, and ransomware. To that end, ITDR monitors user activity and access management logs, flags any malicious activity, and collects data from multiple identity and access management (IAM) systems. ITDR protects your organization’s identity management infrastructure from attacks by detecting and blocking threats, verifying administrator credentials, responding to attacks, and restoring normal operations. ### Identities are everywhere Identity infrastructure is complex. Identity is not something that’s centrally controlled or localized to a specific system, but it’s applied over the internet, connecting various third-party apps and services. Multiple entities can be tied to a single account, whether your organization manages them or not. Sources of multiple identities include: * IdPs (identity providers), such as Okta, Google, JumpCloud, Ping, and Microsoft Entra ID. * Apps acting as an SSO platform for connected apps, such as Atlassian Access or Adobe Creative Cloud * SaaS apps using various authentication (SAML, OIDC) and authorization (OAuth) protocols * SaaS apps with a local username and password * Credentials and secrets stored in password manager and authenticator apps (in browsers, on a local operating system, and in 3rd party apps) Connecting multiple entities to a single account can be confusing and introduces a lot of overhead when trying to unravel the identity maze. {% hint style="info" %} **For example**: If an idP admin deletes an account, the account can still be accessed using another login method. DoControl's Identity module collects event data from all user accounts. {% endhint %} The way identities are utilized is also complex. Depending on the app, it’s possible to have multiple authentication mechanisms for the same account – for example via SAML, as well as via username and password. It’s usually difficult for organizations to know what identities exist across the company, and what apps are in use. ### Attack vectors Identities and credentials are the top targets for attackers, and SaaS is the ideal place for identities to expand, duplicate and sprawl.

ITDR attack vectors

There are several ITDR threats that organizations face in the form of attack vectors: * **Insider threat** - Employees can expose your organization's data in a variety of ways, including oversharing, sharing with their own personal email, massive downloading or uploading deviations, and cross-SaaS suspicious activity. Departing employees who are disgruntled or not leaving on good terms are a particular source of insider threat. * **Account takeover** - Abnormal access patterns can indicate possible account takeover, and include atypical or impossible travel, suspicious location access, IP/domain/URL anomalies, device or browser access deviations, password/login patterns, dormant accounts, and malware takeover. * **Supply chain attacks** - Users with installed shadow apps that are unsanctioned can unknowingly open the backdoor to malicious supply chain attacks. * **External data theft** - Users outside your organization, such as former employees and contractors, could access and exfiltrate sensitive assets. ### Challenge of responding to ITDR attacks On-premise deployments of business-critical apps have been replaced by cloud and SaaS applications. The cloud has become the locus for sensitive and valuable company data. The downside is that cloud access isn’t via a conventional network, making it a profitable target for attackers. In today’s cloud environment, the scale of the identity attack surface has significantly increased. ITDR attacks include Oktajacking, SAMLjacking, risky OAuth scopes, abusing SWA authentication, and stealing password manager secrets. It's a major organizational headache to detect and respond to these identity-based attacks in a timely manner. Since apps are usually directly exposed on the Internet, the only thing needed to access them is identities. Exposed identities are the outermost layer for organizations working in the cloud. ## The DoControl differentiator With DoControl, you can discover and monitor your SaaS identities to protect your organization from identity threats. Leverage DoControl’s unique and proprietary technology to visualize, monitor and mitigate SaaS identity risk: * **SaaS-agnostic identity management** - All corporate, private and discovered associated identities are represented as a single identity in a central view where you can manage, track, and analyze cross-SaaS identities. * **Risk profiling based on data exposure and not just behavior -** DoControl’s proprietary risk algorithms calculate an individual risk score based on various risk elements. Updated constantly, these algorithms cover almost all identity risk factors. * **Organization-wide risk posture management** - All users, and all product aspects are consolidated in a single view to track, monitor and manage risky users. * **Event-driven benchmarking** - Exposure and access pattern baselines are compared to historical activity per department and the entire company. DoControl creates a normal behavioral baseline (department, organization) as an anomaly anchor to determine potential risk. * **Broad UBA detection** - Smart anomalies are based on user data exposure, access, HR profile and benchmarking. ### Enriched power of identity context DoControl consolidates multiple user profiles to build a single user identity. Leveraging enriched metadata from multiple sources, DoControl gives you full visibility into risky identities to easily monitor and mitigate risk. The risk profile for each identity is based on comprehensive data collection, including data access patterns, user permissions, sensitive data sharing, policy violations, anomalous behavior, relevant business context from HRIS, shadow apps, events and inventory. In turn, risky identity scores are leveraged to enrich drive risk-based actions in DoControl: alerts, security posture, and workflows. ### Identity use cases To immunize your SaaS environment against identity breaches and attacks, DoControl addresses these main ITDR use cases: * **Access patterns -** DoControl leverages metadata from a user's last location, IP, and access permissions to determine if the user is risky or not. * **Data exposure** - Includes excessive file sharing, such as when a user publicly shares assets, performs massive downloads, and installs shadow apps. Using department benchmarking and HRIS metadata, DoControl can investigate whether this file sharing is part of a user’s role or not. * **Monitor risky users** - Using automated workflows, DoControl notifies your security team whenever a user's risk score changes, and provides enriched metadata so you can understand the reasons for risk score changes. ## Prerequisites To leverage the Identity Risk Management solution, you need to integrate DoControl with these apps: * HRIS (BambooHR, Deel HR, HiBob, Workday, SAP SuccessFactors) **or** Okta, and * Google Workspace {% hint style="warning" %} * These integrations are mandatory. If DoControl is not integrated with HR/Okta and Google Workspace, you cannot access the Identity Risk Management solution. * If a user does not exist in an HRIS app (BambooHR, Deel HR, HiBob, SAP SuccessFactors, Workday) or Okta, s/he will **not** be created as an identity in DoControl’s Identity Risk Management solution. * Integrating DoControl with **both** an HR system and Okta helps to enrich your Identity data and reflect a more accurate risk picture. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/identities.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.