Cloud and Identity Security
Identity and Privileged Access Security
An attacker often needs no vulnerability. A stolen password is enough. We map privilege relationships in Active Directory and Entra ID on a single map. We show the paths from an ordinary account to administrator rights and identify the changes that close them.
Identity and Privileged Access Security
An attacker using a valid account appears as a regular user. Privilege relationships determine how quickly they can spread. Financial regulators also often require extra controls for privileged accounts.
The need
When organizations need it
- After an acquisition, when two organizations' identity systems are connected.
- When on-premises Active Directory is synchronized with Entra ID and exposed to cloud applications.
- When an access review is due. PCI DSS requires accounts in the cardholder data environment to be reviewed at least every six months.
- After a password leak, when you need to know how far a compromised account could reach.
Questions
What this work answers
- Is there a path from an ordinary account to domain admin?
- Are there risky trust relationships between cloud and on-premises identities?
- Do we know the privileges and owners of service accounts?
- Can multi-factor authentication or conditional access be bypassed?
Identity and Privileged Access Security
What we do
-
Active Directory Security
We review delegation settings and group memberships. We examine trust relationships between domains.
-
Entra ID Security
We review admin roles and permissions granted to applications. We check tenant settings.
-
Identity and Access Management (IAM) Architecture
We design how access is granted and revoked at onboarding, role change and departure. We build the role model with you.
-
Privileged Access Management (PAM)
We assess where admin accounts are used and how their passwords are stored. We review how their sessions are monitored.
-
SSO, MFA and Conditional Access
We identify exceptions in multi-factor authentication and conditional access policies. We show sign-in flows that bypass these controls.
-
Service Accounts and Machine Identities
We identify the privileges and owners of service accounts and application identities.
-
Certificate Infrastructure and AD CS
We find template and permission errors that allow a user to obtain a certificate in someone else's name.
-
Hybrid Identity and Federation
We check if identity sync and federation settings open a path between on-premises and cloud in either direction.
-
Access Review
We find unnecessary access, unowned accounts and unused privileges. We plan their removal with you.
-
Password Resilience Assessment
We assess how well your password policy resists reused and previously leaked passwords.
Scope
Active Directory, Entra ID, privileged access solution, service accounts and certificate infrastructure. Most analysis can be performed with a standard user account.
How we work
We model privilege relationships as a graph. We calculate how many accounts can use each path. We find the single change that closes the most paths.
Deliverables
What you receive
A map of paths from ordinary accounts to domain admin and critical cloud roles. A priority list of changes that close the most paths at once.
NoteThe identity environment changes with every joiner, leaver and new project. Regularly repeating the analysis detects new paths early.
Related services
Request Identity Review
Tell us your objective and critical systems. We will settle the right scope in the first meeting.
Schedule a Meeting