> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/identity-risk-management.md). # Identity risk management **SaaS security problem** End users are the weakest link in the organization’s SaaS security chain, so it’s no surprise that most data breaches are identity-initiated. When your organization's resources are accessed from countless locations and devices, it’s difficult to know what identities exist, and what apps are in use, let alone deal with actual threats arising from compromised identities. **DoControl solution** DoControl connects the dots between all your SaaS apps, including Google Workspace, Slack, HRIS and IdPs, to provide your organization with a robust and secure ITDR solution based uniquely on enriched data context. DoControl aggregates user data into a single identity for organization-wide risk posture management so you can: * Monitor, track, and manage risky users across SaaS identities * Compare user behavior, login activities, and authentication patterns to detect access anomalies and potential threats * Get notified for any unusual activity, such as login attempts from strange locations, or dramatic changes in a user’s risk score DoControl leverages these tools to automatically monitor, mitigate and remediate the risks associated with identities across a variety of apps: * [Watchlist](#watchlist) * [Playbooks](#playbooks-for-identity-risk-management) ## What are identity threats? The proliferation of identities across SaaS apps has prompted a surge in identity-based attacks, making them a major threat to organizations. Most attacks, breaches and security incidents are identity-initiated since they use the identities of internal users. Identity infrastructure is not centrally controlled or localized, but it’s applied across the internet, connecting various third-party apps and services. As more companies adopt cloud services, remote work, and bring-your-own-device policies, attackers will try to exploit identities to gain the keys to your kingdom. ## What's the risk? The cloud has become the locus for sensitive and valuable company data, but it’s also increased the scale of the identity attack surface. Apps are usually directly exposed on the internet, so the only thing needed to access them is identities. Multiple identities across SaaS systems means there’s more than one way to breach your organization. With multi-faceted ITDR attack vectors, your cybersecurity system needs to be ten steps ahead. Consider these identity attack statistics: * [90% of organizations](https://www.vectra.ai/topics/identity-threat-detection-and-response) experienced an identity attack in the past year * [81% of hacking-related](https://www.vectra.ai/topics/identity-threat-detection-and-response) breaches leveraged either stolen or weak passwords * [68% of companies](https://www.securitymagazine.com/articles/99411-68-of-organizations-suffered-a-cyberattack-in-past-year) suffered direct business impact from an identity breach, losing on average millions of dollars Identity-based attacks are particularly dangerous because they use legitimate credentials to access systems, making these breaches harder to detect with traditional security tools. Common identity attacks include compromised or stolen credentials, phishing, insider threats from disgruntled employees, and ransomware. Sophisticated identity attacks include Oktajacking, SAMLjacking, risky OAuth scopes, abusing SWA authentication, and stealing password manager secrets. ## Watchlist With DoControl's watchlist, you can proactively monitor internal users in a centralized place, and detect potential threats before they escalate into security incidents. Examples of internal users who warrant watchlist monitoring include: * Users with a history of suspicious behavior or terms of service violations * Employees who are assigned to a performance improvement plan (PIP) * Users who have demonstrated unusual usage patterns that require closer scrutiny DoControl's identity watchlist is an early warning system that flags unusual behavior patterns among your users. It gives you instant visibility into account compromise or insider threats for high-risk users. The watchlist allows your security team to prioritize its investigation efforts by focusing on users who pose the greatest potential risk, without having to manually search and check individual users at regular intervals. {% hint style="success" %} To leverage the identity watchlist, you need to be connected to the Identities module with Google Workspace and HRIS/Okta. {% endhint %}
## Playbooks for identity risk management To address the use cases of identity risk management across various SaaS apps, you can define automated workflows with DoControl's out-of-the-box playbooks. These playbooks will: * Monitor and remediate overexposure that is initiated by watchlist users. * Notify your security team whenever a user's risk score increases and the user becomes risky. * Notify your security team whenever a terminated user's risk score increases.
Select a predefined and automated DoControl playbook to remediate identity risk:
Playbook nameSaaS appPlaybook description
Monitor and remediate watchlist users who share with personal emailsGoogle DriveWhen a watchlist user shares Google files with his/her own personal email, their manager is notified and any personal emails are removed from file sharing permissions.
Monitor downloads by watchlist usersGoogle DriveWhen a watchlist user downloads a Google Drive file, the file is scanned to check for sensitive content (PII). If PII is found, the SecOps team is notified.
Notify on identity risk spikeDoControlWhen a user's risk score increases and the user becomes risky, notify your security team.
Notify on identity risk spike for terminated userDoControlWhen a terminated user's risk score increases, notify your security team.
Monitor restricted file download in Slack by watchlist usersSlack Enterprise When a watchlist user downloads a restricted file in Slack Enterprise containing sensitive keywords from the customized lexical list, a notification is sent to the SIEM via webhook, and the SecOps team is notified.
{% hint style="success" %} To leverage identity risk management playbooks, you need to be connected to the Identities module with Google Workspace and HRIS/Okta. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/identity-risk-management.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.