Skip to main content
Style:
Size:

Chapter 5: Practical Controls for Human Risks (Phishing, Insider Threats)

You can build the most beautiful Zero Trust architecture in the world, with perfect automated HR provisioning and flawless Role-Based Access Control. But if Alice from Finance clicks on a frantic email that says, "URGENT: Update your HR portal password," and she types her credentials into a fake website... your architecture is in serious trouble.

When dealing with human workloads, Identity and Access Management is fundamentally about mitigating the inherent flaws of the human brain. We are distracted, we are trusting, we want to be helpful, and sometimes, we are disgruntled.

Let's look at the two biggest human risks—Phishing and Insider Threats—and how we use our 5 Pillars to build practical, un-bypassable controls against them.

Risk 1: Phishing (The External Threat)​

Phishing remains the number one way attackers breach corporate networks. As the old cybersecurity adage goes: Attackers don't hack in; they log in.

The Problem with Legacy MFA​

In the past, we thought SMS text messages or authenticator apps (like Google Authenticator) solved the phishing problem. They don't. Modern attackers use Adversary-in-the-Middle (AiTM) attacks.

They build a fake login page that sits exactly between the user and the real Microsoft or Okta login. When Alice types her password into the fake site, the attacker captures it and immediately forwards it to the real site. When the real Microsoft site sends Alice an MFA push notification on her phone, she clicks "Approve," thinking she is logging in. The real site grants access and issues a Session Token. The attacker intercepts that Session Token and bypasses the MFA entirely.

Visual Logic: AiTM Phishing vs. FIDO2 Defense​

The Solution (Control): Phishing-Resistant MFA​

To stop AiTM attacks, we must remove the fallible human from the MFA decision entirely.

  • FIDO2 Security Keys: Hardware keys (like YubiKeys). When Alice plugs in her key, the cryptographic hardware mathematically verifies that the website she is on is the real domain, not a fake one. If the domain doesn't perfectly match, the key refuses to authenticate, even if Alice is screaming at it to work.
  • Platform Authenticators: Using the biometric hardware built into the laptop (Windows Hello or Apple TouchID), bound securely to the device's Trusted Platform Module (TPM).

The Network Tie-in (Technology)​

If Alice somehow bypasses her FIDO2 key (perhaps she was tricked into giving the attacker a remote desktop session over Zoom), the Zero Trust Network Access (ZTNA) proxy steps in as the final fail-safe.

The attacker might possess Alice's identity token, but they are attempting to use it from an unmanaged Windows machine in an external country, while Alice’s corporate laptop is a highly managed, encrypted Mac. The ZTNA context engine sees the device mismatch and drops the connection instantly.

Interactive Simulator: Phishing Defense Mapper​

See how different IAM controls interrupt an Adversary-in-the-Middle (AiTM) attack chain step-by-step:

Phishing Defense Mapper

See how different IAM controls interrupt an Adversary-in-the-Middle (AiTM) attack chain.

Attack Chain Timeline
Click 'Simulate AiTM Attack' to view defense behavior.

Risk 2: The Insider Threat (The Internal Enemy)​

Phishing assumes the human is an unwitting victim. The Insider Threat assumes the human is the attacker.

Imagine Bob is a database administrator who is furious because he was passed over for a promotion. He decides to download the entire customer database onto a USB drive and sell it to a competitor before he quits on Friday afternoon.

  • The Problem: Bob isn't hacking the network. He has legitimate access. He is using his own credentials, from his own approved laptop, during normal business hours. Your Zero Trust network proxy sees absolutely nothing wrong.
  • The Solution (Process & Control): Separation of Duties (SoD) and Just-in-Time (JIT) Access.

Separation of Duties (SoD)​

Never let one single human hold all the keys to a critical process.

  • The Concept: Bob might have the ability to write a script that exports the database, but he should never have the ability to execute that script on the production server without a second person (like his manager) digitally approving it.
  • The Check: If the IAM system sees Bob trying to hold both the "Creator" and "Approver" roles simultaneously, it flags it as a "Toxic Combination" and denies the access.

Just-in-Time (JIT) Access​

Even administrators should have zero standing privileges by default.

  • The Concept: Bob normally has the exact same access level as a standard employee. When he actually needs to perform database maintenance, he logs into a Privileged Access Management (PAM) portal and requests "DB Admin" rights.
  • The Control: The access is granted for exactly 2 hours (a time-bound token), and every single keystroke he makes during that window is recorded for audit. When the time is up, his privileges instantly drop back down to zero.

The 5 Pillars of Human Risk Mitigation​

Let’s map this back to our core framework to close out the Human Workload section:

  1. People: Training is necessary, but we must assume people will eventually fail. The CEO is just as likely to click a sophisticated phishing link as a first-year intern.
  2. Process: Implement strict Separation of Duties to ensure no single human can cause a catastrophic network event alone.
  3. Technology: Utilize FIDO2 standards (hardware keys/biometrics) for all authentication, and Privileged Access Management (PAM) systems for recording administrative sessions.
  4. Control: Time-bound access (JIT) and Phishing-Resistant MFA are mandatory for critical roles.
  5. Impact: By restricting standing privileges (JIT) and requiring a second pair of eyes (SoD), the blast radius of a rogue or compromised human is severely limited.

Consultant's Corner: The "VIP Exception"​

The quickest way to completely ruin your IAM program is to grant security exceptions to executives.

If the CEO or a board member says, "I hate using the YubiKey, just give me a password and SMS text," you must hold the line. This is where you leverage the Impact pillar.

Explain it to them in business terms: The CEO has access to the company's financial data, upcoming merger plans, and confidential HR records. If their account is compromised via a simple AiTM phishing attack, the blast radius isn't just an IT headache—it is a company-ending event that will make national news.

Security controls must always be applied based on the risk of the identity, not the rank of the human. No exceptions.