Identity and AI Threats: Developing an Access Management Defence-in-Depth Strategy

Summary: A Hacker News article by One Identity's Stuart Sharp argues that AI-driven phishing is becoming more convincing, can better replicate human behavior, and can bypass existing phishing-detection mechanisms. It recommends identity defenses including preemptive checks before authentication, context-based and step-up authentication, multiple authentication types such as OTP, FIDO2 passkeys and ID verification, and phishing-resistant factors to limit session hijacking and lateral movement.
What you should know: The article notes there is very little organizations can do to prevent or detect employees, contractors and partners from using AI tools, and that session hijacking lets attackers steal session details and skip authentication entirely - so the controls that matter are the ones that still hold when the credential step is bypassed.

Read the original at The Hacker News ↗