The Value and Importance of Identity Intelligence

In the fast-evolving digital threat landscape, our identities have become the new currency. They power everything from online shopping to global social connections. This value is not lost on threat actors, who continue to find increasingly sophisticated methods to exploit them – targeting both our human vulnerabilities and technological weaknesses. As a result, identity intelligence has emerged as a critical tool to help businesses and governments safeguard our digital footprints, combat crime, and defend national security.

Understanding Identity Intelligence

Identity Intelligence in the business context primarily focuses on detecting and mitigating risks associated with compromised credentials and other relevant identifiers tied to an individual or machine. Organizations leverage identity intelligence to analyze data from various sources to identify and mitigate potential security threats, particularly those stemming from stolen or leaked login information. By monitoring exposed credentials, businesses can proactively detect unusual login patterns and suspicious access attempts, enabling them to respond swiftly to potential unauthorized access and account takeovers.

In contrast, the government context of identity intelligence centers on identifying and tracking potential threats for national security purposes. It relies on data sources like biometric information, forensic data, and open-source and classified information to support real-time decision-making, threat assessment, and operational support.

While both applications of identity intelligence analyze digital footprints, their methodologies and goals differ significantly. While businesses use this information to protect their employees and customers against fraud and account takeover, government organizations across public safety, defense, and law enforcement use identity intelligence to uncover missing links and understand networks to support criminal or terrorist investigations, attribution, identity validation, and other operational requirements.

Key Sources of Identity Intelligence

In the first half of 2024 alone, Flashpoint observed over 53 million compromised credentials and 13 million infected devices due to information-stealing malware, also known as infostealers. These attacks enable cybercriminals to stealthily collect sensitive data like login credentials, cookies, autofill data, credit card information, and device applications—including versions, from infected systems. They use this information to gain unauthorized access to networks, leading to data breaches, ransomware attacks, and other severe security incidents. 

Infostealer data has emerged as a significant source of identity intelligence, allowing organizations to identify these attacks in their early stages to respond swiftly and minimize damage.

Alongside infostealer data, key sources include:

1. VirusTotal: Google-owned platform scanning files and URLs for threats, aiding security researchers and analysts.
2. Forums, marketplaces, chat services: Hubs for illegal goods, including stolen credentials, accessed by attackers.
3. Paste sites: Anonymously shared text platforms used by threat actors for leaking stolen credentials and data.
4. Analyst research and direct actor engagements: Our Intelligence Team discovers credentials and other unique data sets during investigations or interactions with threat actors that serve as the backbone of our identity intelligence data.

With this information, organizations can effectively confront myriad security challenges, including account takeover, fraud, terrorism, and cybercrime. By addressing these challenges, businesses can strengthen their security posture, and governments can protect communities against identity-related risks in an increasingly complex threat landscape.

Identity Intelligence in Action

Flashpoint helped Texas A&M identify over 395,000 compromised credentials, enabling the university to proactively protect its digital assets and community members. By utilizing Flashpoint’s identity intelligence, Texas A&M has enhanced its cybersecurity posture and responded more effectively to potential threats.

“Flashpoint’s platform allows us to uncover stolen credentials, flag accounts, reset employee passwords, identify IOCs, filter false positives, understand password complexity and quality, restrict permissions, set up alerts to legitimate compromised accounts, and ultimately prevent account takeover faster than ever before.”

Cody Autry, Security analyst, Texas A&M University CTI Team

Identity Intelligence Implementation Best Practices

Privacy and legal considerations are crucial when using identity intelligence. Complying with data privacy regulations such as GDPR is imperative to safeguard sensitive information. Establishing policies and procedures for secure handling of sensitive data, implementing data encryption, and access controls to prevent unauthorized access are vital. Clear data retention and disposal guidelines should also be established to ensure responsible data management throughout its lifecycle. By adhering to these best practices, organizations can effectively use identity intelligence while ensuring individuals’ privacy and legal rights.

How Flashpoint Supports Identity Intelligence

With the most relevant and actionable data, Flashpoint supports businesses and governments worldwide with various identity intelligence applications.

• Protect your employees, third parties, and suppliers: Get a clear picture of your organization’s credential status and recent breaches. Access detailed breach entries that reveal compromised users, passwords, sources, domains, dates, and contextual host and cookie information so you can take action before damage occurs.
• Protect your customers and users: Monitor customer email addresses and domains for breaches. Quickly identify compromised credentials, pinpoint the source to detect and respond to fraudulent activities, protecting their customer base and maintaining trust.
• Analyze and attribute malware: Collect infostealer malware data from various sources, including dark web forums, marketplaces, and malware logs. Identify recurring attack patterns and adjust defenses accordingly by linking stolen infostealer data to specific known cybercriminal groups and theft campaigns.

• Investigate threat actor activity and networks: Enhance criminal investigations with comprehensive insights into suspects’ digital footprints and connections. Uncover missing links to piece together evidence and solve crimes more efficiently, especially complex cases involving cybercrime, organized crime, or terrorism. 
• Augment national security operations: Gain insight into individuals, groups, and networks of interest, enabling real-time decision-making in special operations worldwide and enhancing situational awareness across the operational environment.

Looking Toward the Future

Identity Intelligence has emerged as a critical tool for businesses and governments to safeguard their digital footprints, protect sensitive information, and protect the public. As the digital landscape continues to evolve and threats become more sophisticated, Identity Intelligence will play an increasingly vital role in ensuring the security of our online interactions and the safety of communities and individuals worldwide.

Contact us to learn how Flashpoint can support your organization’s Identity Intelligence requirements.