WEEK 2: THESE AREN’T THE CREDENTIALS YOU’RE LOOKING FOR
Identity & Credential Attacks: Protecting the Keys to the Galaxy
One of my favorite cybersecurity lessons in Star Wars happens at a checkpoint. Obi-Wan does not break into a system or overpower the stormtroopers. He convinces the people who already have authority to let him through. That is surprisingly close to how many real attacks work.
Attackers know that getting a legitimate identity can be easier than breaking through layers of security technology. That is why identity has become such an important part of the modern security perimeter.
Identity Is the New Security Perimeter
Most companies no longer operate inside a neat network boundary. Employees work remotely, applications live in multiple clouds, business teams rely on SaaS, developers use APIs and CI/CD pipelines, and third parties connect to important systems. In that environment, identity often becomes the thing tying everything together.
A single compromised account can open the first door. Picture an attacker stealing the credentials of a low-level Imperial technician. Those credentials get them into one system. From there they learn about another system, find a service account, reach a management platform, and gradually work their way toward something far more valuable.
In an enterprise, the path might be Employee -> SaaS Application -> Cloud Environment -> Service Account -> Privileged Identity -> Critical Data. The attacker does not have to break every lock. They just have to keep finding doors that trust the identity they already control.
Passwords Are Only the Beginning
And this is no longer just a password problem. Today's identity attacks can take a number of forms:
- Credential phishing
- Password spraying
- Credential stuffing
- Session-token theft
- MFA fatigue
- Adversary-in-the-middle phishing
- OAuth abuse
- API-key theft
- Service-account compromise
- Cloud access-key theft
- Machine and workload identity compromise
- Social engineering of help desks and password-reset processes
MFA Is Essential—but Not All MFA Is Equal
MFA is still one of the best controls we have for reducing account takeover, but simply saying 'we have MFA' is not the finish line. Attackers have learned to abuse push notifications, steal authenticated sessions, and socially engineer help desks and recovery processes.
Where practical, organizations should move toward phishing-resistant authentication, especially for administrators, executives, finance teams, developers, cloud administrators, security personnel, and anyone else who can reach sensitive systems or data.
Put another way: not everyone in the Empire should have the code to the Death Star's reactor controls.
The Rise of Non-Human Identities
There is also a growing identity problem that has nothing to do with employees. Machines have identities too. Applications use service accounts. CI/CD pipelines hold secrets. Cloud workloads use IAM roles. Containers have service accounts. APIs rely on tokens. And AI agents may need credentials to interact with databases, SaaS platforms, cloud services, APIs, and other agents.
Those identities deserve the same scrutiny we give human users. What can they access? Do they really need that access? How long do their credentials live? Can they escalate privileges? Would we notice if one started behaving strangely? And, just as important, could we shut it down quickly?
Adopt Zero Trust Thinking
Zero Trust is useful here because it starts with a simple idea: having a valid credential does not automatically make something trustworthy. Authentication tells us who or what is connecting. Authorization determines what that identity should actually be allowed to do. We need both.
- Verify explicitly
- Apply least privilege
- Use conditional access
- Monitor authentication behavior
- Protect privileged identities
- Remove dormant accounts
- Rotate secrets
- Use just-in-time privileged access where practical
- Continuously evaluate permissions
Your Cybersecurity Awareness Mission
This month, take a fresh look at identity. Instead of stopping at 'Do we have MFA?' ask the harder question: 'Could an attacker still steal, replay, bypass, or socially engineer their way around our authentication?'
Do the same for privileged accounts, service accounts, workloads, API keys, and AI agents. The goal is to understand and protect the full identity lifecycle, not just the password.
Attackers understand something Emperor Palpatine certainly did: access is power. Make sure you know exactly who - and what - has it.
