Why identity became the perimeter

Twenty years ago, security meant a strong network perimeter: firewalls around the office and data centre, with trusted people inside. That model no longer matches how work happens. Staff work from home and on the move, applications are cloud services reachable from anywhere, and partners and contractors need access too.

In this world, the meaningful boundary is identity: the account a person or system uses, and the decision about what that account may do.

How attackers exploit identity

• Credential stuffing and password spraying: trying leaked or common passwords across many accounts.
• Phishing, increasingly with adversary in the middle kits that sit between the user and the real login page, capturing the password, the MFA code and the resulting session cookie in real time.
• MFA fatigue: flooding a user with push approvals until they accept one.
• Help desk social engineering: calling support pretending to be an employee to reset MFA. Several well known breaches started exactly this way.
• Token and session theft: stealing cookies or tokens from a compromised device, which bypasses the login entirely.
• Abused service accounts and API keys: long lived secrets with broad permissions, often stored in code or configuration.

Three questions for every access

Every access decision answers three questions:

1. Identification: who claims to be making the request?
2. Authentication: how sure are we that the claim is true?
3. Authorisation: given who they are, what are they allowed to do?

A strong programme improves all three: one clear identity per person and system, strong and phishing resistant authentication, and authorisation that follows least privilege and changes when roles change.

What a mature setup looks like

• A central identity provider (IdP) that all applications trust through single sign on.
• Phishing resistant MFA, ideally passkeys, for everyone, and mandatory for administrators.
• Conditional access that considers device health and risk, not just a password.
• Automated lifecycle: accounts created, changed and removed from the HR system of record.
• Privileged access that is separate, time limited and monitored.
• Logs and detection for risky sign ins and token misuse.

This course builds each of these pieces in order. Even partial progress on the first three dramatically reduces the most common attacks.