Belajar IAM Engineer - Identity Threat Detection
Deteksi credential attacks, token abuse, dan User Entity Behavior Analytics (UEBA) menjadi pertahanan aktif terhadap ancaman identity-based
#Pendahuluan
Setelah di episode 17 kita membahas conditional access, pada episode ini kita masuk ke identity threat detection — kemampuan mendeteksi serangan yang menargetkan identity: credential attacks, token abuse, dan anomali perilaku. Deteksi dini adalah kunci sebelum kerusakan terjadi.
Mengapa identity threat detection penting? Karena 80%+ breach melibatkan credential yang dikompromi. Tanpa deteksi aktif, attacker bisa menggunakan credential curian selama berminggu-minggu tanpa ketahuan.
#Credential Attacks
#Brute Force & Credential Stuffing
| Serangan | Karakteristik | Deteksi |
|---|---|---|
| Brute force | Banyak failed login dari IP sama | Rate limiting, anomaly detection |
| Credential stuffing | Banyak login dari IP berbeda menggunakan credential leak | Breached password detection |
| Password spraying | Satu password dicoba ke banyak account | Unusual sign-in patterns |
#Deteksi
# Entra ID: query sign-in logs
curl -H "Authorization: Bearer $TOKEN" \
"https://graph.microsoft.com/v1.0/auditLogs/signIns?\$filter=status/errorCode eq 50126" \
| jq 'group_by(.userPrincipalName) | map({user: .[0].userPrincipalName, failures: length})'#Prevention
| Measure | Effectiveness |
|---|---|
| MFA | Mencegah 99%+ credential attacks |
| Breached password detection | Mencegah credential reuse |
| Rate limiting | Memperlambat brute force |
| Smart lockout | Block IP setelah N failures |
#Token Abuse
#Jenis Token Abuse
| Tipe | Penjelasan |
|---|---|
| Token theft | Steal token dari compromised device |
| Token replay | Gunakan token di device berbeda |
| Token scope abuse | Gunakan token untuk akses di luar scope |
| Refresh token abuse | Gunakan refresh token untuk long-term access |
#Deteksi Token Abuse
# Cek anomali: login dari device berbeda dengan token yang sama
curl -H "Authorization: Bearer $TOKEN" \
"https://graph.microsoft.com/v1.0/auditLogs/signIns?\$filter=deviceDetail/operatingSystem ne 'Windows'" \
| jq 'group_by(.userPrincipalName) | map({user: .[0].userPrincipalName, devices: [.[].deviceDetail.operatingSystem] | unique})'#Prevention
- Token binding — bind token ke device tertentu
- Continuous access evaluation — revoke token secara real-time
- Token lifetime policies — pendekkan token lifetime
#UEBA (User Entity Behavior Analytics)
#Konsep UEBA
UEBA membangun baseline perilaku normal dan mendeteksi anomali:
#Signals yang Dianalisis
| Signal | Yang Dicari |
|---|---|
| Login patterns | Waktu, lokasi, device yang tidak biasa |
| Resource access | Akses resource yang tidak pernah diakses sebelumnya |
| Data volume | Download/upload volume yang tidak normal |
| Permission changes | Perubahan role atau permissions yang tiba-tiba |
#Implementasi UEBA
from datetime import datetime, timedelta
import statistics
def detect_anomalous_logins(logins, user_id):
user_logins = [l for l in logins if l['user'] == user_id]
# Analyze location distribution
locations = [l['location'] for l in user_logins]
most_common = max(set(locations), key=locations.count)
# Alert if login from unusual location
recent = user_logins[-1]
if recent['location'] != most_common:
return {
'alert': 'Unusual location',
'user': user_id,
'location': recent['location'],
'normal_location': most_common,
'timestamp': recent['timestamp']
}
return None#Microsoft Identity Protection
#Fitur Utama
| Fitur | Fungsi |
|---|---|
| Sign-in risk | Mengevaluasi risk setiap login |
| User risk | Mengevaluasi risk keseluruhan user |
| Risk detections | Daftar semua risk detection events |
| Remediation policies | Otomasi response terhadap risk |
curl -H "Authorization: Bearer $TOKEN" \
"https://graph.microsoft.com/v1.0/identityProtection/riskDetections" \
| jq '.value[] | {user: .userPrincipalName, risk: .riskLevel, type: .riskDetectionType}'Warning
Identity threat detection harus dikombinasikan dengan response automation. Deteksi tanpa response hanya menambah noise. Pastikan ada playbooks untuk setiap tipe threat yang terdeteksi.
#Penutup
Inti yang harus dibawa pulang:
- Credential attacks (brute force, stuffing, spraying) dideteksi melalui log analysis.
- Token abuse bisa dideteksi dari anomali device, location, dan scope.
- UEBA membangun baseline perilaku dan mendeteksi anomali secara otomatis.
- Deteksi harus dikombinasikan dengan response automation.
Di episode 19 selanjutnya kita akan membahas zero trust identity enforcement — identity sebagai perimeter, continuous verification, dan step-up auth. Siapkan implementasi zero trust kalian!