Identity Threat Detection and Response (ITDR)

Abstract

Identity Threat Detection and Response (ITDR—not to be confused with IT Disaster Recovery which is the other ITDR) refers to the combination of security tools and processes required to adequately defend identity-based systems. It is a layer in our IAM model from Chapter 7 since every IAM solution needs to be protected per discipline and when integrated together. Gartner defines ITDR as “a security discipline that encompasses threat intelligence, best practices, a knowledge base, tools, and processes to protect identity systems. It works by implementing detection mechanisms, investigating suspicious posture changes and activities, and responding to attacks to restore the integrity of the identity infrastructure.”