IAM Meets CTI: Make Identity and Access Management Ready for Cyber Threat Intelligence

Enterprises rely on Identity and Access Management (IAM) systems as their primary solution for digital identity management and access control. While regulatory compliance is often a driving factor for such systems, they also serve as an essential security gate fortifying the defense against cyber attacks. However, when analyzing suspected or actual attacks, Security Information and Event Management (SIEM) systems and Cyber Threat Intelligence (CTI) are commonly employed but under-utilize valuable IAM data. IAM analysts can overcome such challenges by designing and implementing suitable mechanisms for a swift, easy-to-use, and faultless data transfer from IAM to SIEM. We contribute with a survey to identify ten central IAM findings relevant to CTI. We also evaluate their real-world feasibility by applying them within an anonymized data set of TrustCorp and make our tools open-source.