Unit 03 of 03
Enterprise Identity
Where the trust root stands at enterprise scale and what it costs when it breaks: the number of systems bound to the central identity repository and the items replication rescues, the ticket flow reduced to the ticket-granting service's key, the paths a fallback behavior opens when the central network authentication service is unreachable, the applications bound to a single identity provider along with the assertion's lifetime and revocation window, the paths each factor type closes and fails to close, the central policy's propagation rounds and the items it never reaches, the count of horizontal and vertical privilege escalation paths, and the paths controls close against credential theft.
Published Updated
Lessons
- 01 Directory Services Measuring the central identity repository as a trust root: 13 of 16 systems being bound to a single repository, the chain from root to login holding 9, 8, or 2 items depending on connection mode, a 12-hour outage stopping 609 account logins across 13 systems, the third replica rescuing no new system, and 646 items needing manual renewal when integrity breaks. 14 min read
- 02 Ticket-Based Authentication Reducing the ticket flow to the ticket-granting service's key: the claims proven across six steps and the key each step rests on, 471 key items dividing across five types, a single root key's compromise dropping all 214 principals and 21 services, and renewal holding to two rounds and a 176-hour window. 14 min read
- 03 Authentication for Network Access Measuring the central network authentication service in terms of access decisions: 80 devices asking a single service, a 6-item chain per device, four fallback behaviors opening between 0 and 1348 paths when the service is unreachable and stopping up to 957 legitimate ends, 436 new paths staying open in today's mix, and renewing the one shared secret meaning manually touching 80 devices. 13 min read
- 04 Single Sign-On Measuring federation along the axis of the assertion: 15 of 18 applications bound to a single provider and 1562 user connections resting on 90 items, the revocation window determined not by the assertion's 5-minute lifetime but by the application's local session reaching 72 hours, and key rotation producing a manual item and an outage in 5 applications. 13 min read
- 05 Multi-Factor Authentication Measuring factor types by the path they close: in a set of 10 paths, no factor type closing more than 6, 4 paths closing with none of the six types, using two factors that close the same path together not increasing the closed path count, and closing costing between 428 and 856 registration items for 214 people, 9 to 31 recovery requests, and up to 41 left-out endpoints. 14 min read
- 06 Group Policies and Authorization Management Measuring central enforcement in terms of propagation: 319 of 325 machines being set to pull policy but only 295 of them being reached within the 24-hour window, first-round coverage staying at 51.4%, 30 machines never receiving the policy at all, and local overrides on 67 machines dropping 5 of 12 settings to open 335 paths. 12 min read
- 07 Privilege Escalation Measuring horizontal and vertical escalation as path counting: finding 37 distinct paths from a limited user to a domain administrator across 9 nodes and 20 edges, 32 paths passing through at least one horizontal edge, a single control closing at most 24 paths, three controls together closing all 37, and one control closing no path at all. 13 min read
- 08 Credential Theft How long verification items stay in memory and the path controls close: 6 of 8 item types can be presented directly without knowing the password, 22 paths and 298,958 machine-hours of exposure, six controls closing 17 paths and dropping exposure to 1%, and the remaining 5 paths not closing under any control. 12 min read