The Problem: When Attackers Have No Off-Ramp
Your risk register assumes attackers want something negotiable. Ransomware? Pay or restore from backup. Data theft? Containment and notification. But state-level actors targeting critical infrastructure suppliers don't follow that script. They're not after your data or money. They want disruption, and they'll exploit any entry point you've left open.
IBM reported that the average data breach cost $4.4 million last year, but that figure assumes recovery is possible. When an attacker's goal is to wipe systems or create chaos in connected infrastructure, traditional incident response plans fall short. According to the World Economic Forum, 64% of organizations now account for geopolitically motivated cyberattacks in their planning. If you're in that majority, this playbook provides the technical steps to harden your identity perimeter before an adversary finds it.
What You Need Before Starting
Access inventory:
- Complete list of all user accounts (employees, contractors, service accounts)
- Current role assignments and permission sets
- Third-party vendor access points and partner integrations
- Service account credentials and their associated systems
Technical requirements:
- Privileged Access Management platform (CyberArk, BeyondTrust, Delinea, or equivalent)
- Identity Provider with MFA enforcement capability (Okta, Azure AD, Ping Identity)
- SIEM or log aggregation tool (Splunk, Elastic, Chronicle)
- Configuration management database or asset inventory
Organizational prerequisites:
- Executive sponsorship for access revocations
- Defined process for emergency access requests
- Communication plan for access changes
Step-by-Step Implementation
Phase 1: Establish Identity Baseline (Week 1-2)
1. Audit all active accounts
Run these queries against your identity provider:
# Azure AD example
Get-AzureADUser -All $true | Where-Object {$_.AccountEnabled -eq $true} |
Select UserPrincipalName, LastLogonDate, CreatedDateTime
Export to CSV. Flag any account with no login in 90+ days.
2. Map privilege escalation paths
For each administrative account, document:
- What systems it can access
- What data it can reach
- Which production resources it controls
- Whether it has cross-environment permissions (dev → prod)
Use BloodHound for Active Directory environments or your cloud provider's IAM analyzer (AWS IAM Access Analyzer, Azure AD Access Reviews).
3. Identify orphaned access
Query HR systems for termination dates. Cross-reference against active accounts. Every former employee account still active is a potential initial access vector. Disable immediately, delete after retention requirements are met.
For vendors and contractors, verify:
- Contract end dates
- Project completion status
- Whether access was time-bound
Phase 2: Implement Continuous Validation (Week 3-4)
4. Deploy Just-in-Time Access for privileged operations
Configure your PAM solution to require approval for elevated access:
# Example policy structure
privilege_escalation:
requires_approval: true
approver_group: "security-approvals"
max_duration: 4h
justification_required: true
session_recording: enabled
No standing admin access. Engineers request elevation, provide business justification, get time-boxed credentials.
5. Enforce MFA on all accounts
Not just privileged users. State-level actors will compromise any account that gets them in the door, then pivot laterally. Configure your IdP to require MFA for:
- All interactive logins
- API access (use service principals with certificate auth, not passwords)
- VPN connections
- Cloud console access
Disable SMS-based MFA. Use authenticator apps, hardware tokens, or WebAuthn.
6. Implement automated access reviews
Schedule quarterly reviews in your identity platform:
[Access Review](/glossary/access-review):
- Scope: All accounts with production access
- Reviewers: Resource owners (not IT)
- Auto-revoke if no response in 7 days
- Log all decisions for audit trail
Resource owners know who should have access better than IT does. Make them certify it.
Phase 3: Harden the Management Plane (Week 5-6)
7. Segment administrative access
Create separate admin accounts for infrastructure management. Your domain admin account should never read email or browse the web. Implement:
- Privileged Access Workstations for admin tasks (isolated, hardened endpoints)
- Network segmentation between management VLANs and production
- Separate authentication domains for administrative functions
8. Monitor for anomalous access patterns
Configure your SIEM to alert on:
- Logins from new geolocations (especially if user has never traveled there)
- Access outside normal working hours for that account
- Privilege escalation attempts
- Failed authentication spikes
- Service account usage from unexpected source IPs
Sample Splunk query:
index=authentication action=success
| stats dc(src_ip) as unique_ips by user
| where unique_ips > 5
Adjust thresholds based on your environment, but investigate anything that breaks pattern.
9. Revoke legacy authentication protocols
Disable basic authentication in Office 365, IMAP/POP3 access, legacy TLS versions. Attackers love these because they bypass MFA.
For Azure AD:
Set-OrganizationConfig -OAuth2ClientProfileEnabled $false
Validation: How to Verify It Works
Test 1: Attempt access with dormant account
Pick a disabled test account. Try to authenticate. It should fail immediately. Check that the failure generates a SIEM alert.
Test 2: Request privileged access
As a regular user, request admin rights to a test system. Verify:
- Approval workflow triggers
- Access is time-bound
- Session is recorded
- Access auto-expires
Test 3: Simulate credential compromise
With authorization, attempt login from an unusual location using valid credentials. Your monitoring should flag it within minutes.
Test 4: Review access audit logs
Spot-check 20 user accounts. For each:
- When was access last reviewed?
- Are current permissions justified?
- Is MFA enforced?
- Has the user logged in recently?
If you can't answer these questions in under 5 minutes per account, your validation isn't continuous.
Maintenance: Ongoing Tasks
Weekly:
- Review privileged access requests and approvals
- Check for new accounts created outside normal provisioning
- Scan for failed authentication patterns
Monthly:
- Run access recertification for high-risk systems
- Update service account credentials
- Review and tune SIEM detection rules
Quarterly:
- Full access review across all systems
- Audit third-party and vendor access
- Test incident response procedures for identity compromise
- Update access request approval groups
Annually:
- Reassess which roles require privileged access
- Evaluate PAM platform effectiveness
- Review and update access policies against current threat intelligence
The Operational Reality
This playbook won't stop a determined nation-state actor forever. But it forces them to work harder, make noise, and spend time you can use to detect and respond. When your adversary has no clear motive and unlimited patience, your job is to make every identity control a friction point they have to overcome.
Start with the access you can see and control today. Former employees, dormant service accounts, and overprivileged users are the low-hanging fruit that attackers will grab first. Close those gaps before building elaborate detection systems.
The management plane is your perimeter now. Harden it accordingly.
