When applications lived in a building, the network was the perimeter. Now they live everywhere, and the thing that consistently decides whether someone gets in is their identity.
That makes identity infrastructure the highest value target in most organizations, and it makes identity controls the highest value defensive investment.
The Pieces
Authentication proves who you are. Authorization decides what you may do. Keeping those separate in your head prevents a common architectural mistake, which is treating a successful login as permission to do anything.
An identity provider is the system of record for authentication. Single sign on means authenticating once to the provider and being granted access to many applications, using protocols such as SAML and OpenID Connect.
Lifecycle management is the unglamorous half: accounts created when people join, changed when they move, and removed when they leave. Orphaned accounts from people who left are a recurring finding in real assessments.
Why Single Sign On Is a Security Control
It looks like a convenience feature and it is a control. Without it, every application has its own password, users reuse them, and there is no single place to revoke access.
With it, you get one enforcement point where multi factor authentication, conditional access, and logging apply consistently, and one place to disable an account the moment someone leaves.
The tradeoff is concentration. Compromise of the identity provider is catastrophic, which is why administrative access to it deserves the strictest controls in the organization.
Not All MFA Is Equal
SMS codes are the weakest common form. They are vulnerable to SIM swapping and interception, and they are still much better than nothing.
Authenticator app codes are better, and they can still be relayed. A user typing a code into a convincing fake login page hands it to a proxy that uses it immediately.
Push notifications are convenient and vulnerable to fatigue attacks, where an attacker with a valid password sends repeated prompts until someone taps approve. Number matching reduces this considerably.
Hardware security keys and passkeys built on FIDO2 and WebAuthn are phishing resistant, because the credential is cryptographically bound to the real site origin. A fake site cannot use it, full stop. Specifications come from the FIDO Alliance.
If you make one change, make it phishing resistant MFA on administrative accounts. See password attacks for why.
Conditional Access
Conditional access is policy evaluated at sign in and, ideally, continuously afterwards. It is where identity becomes a real decision point rather than a yes or no gate.
Typical conditions are device compliance, location, network, application sensitivity, sign in risk score, and whether the session is coming from a managed browser.
Typical outcomes are allow, allow with additional authentication, allow with limited session, or block. The useful pattern is requiring more assurance for more sensitive actions rather than applying one rule to everything.
Privileged Access Management
Administrative accounts are the ones that end an incident quickly, in the wrong direction. PAM is the set of controls around them.
Separate administrative accounts from daily use accounts, so an administrator browsing the web is not doing it as an administrator.
Just in time elevation, where privilege is granted for a window and expires, instead of standing membership in a powerful group.
Credential vaulting with checkout, rotation, and session recording for the highest tiers.
Vendors include CyberArk, BeyondTrust, and Delinea, and the major identity platforms include elements of it.
Non Human Identities
Service accounts, API keys, machine certificates, and workload identities now outnumber human accounts in most environments, often by a large factor.
They are also worse protected. They rarely have MFA, their credentials often do not expire, they are frequently over privileged because it made an installation work, and nobody owns them after the person who created them leaves.
This is now one of the most productive attack paths in real intrusions, and it is why AI agent identity deserves the same treatment from the start rather than later.
The Identity Attacks to Know
Credential phishing, defeated by phishing resistant MFA. Password spraying, defeated by breached password checks and detection on the pattern.
MFA fatigue, reduced by number matching and by alerting on repeated denied prompts.
Token theft, where an attacker steals a session token after authentication and bypasses the login entirely. This is why continuous evaluation and token binding matter, and why shorter session lifetimes for sensitive applications are worth the friction.
Consent phishing, where a user is tricked into granting an application permission to their data. The fix is restricting who can consent to third party applications and reviewing what has already been granted, which almost nobody does.
Learn This at HackRange
Week 3 of the mentorship covers identity, authorization, and least privilege on real systems, including the service account problems every organization has.