Exploring the Integration of ITDR Solutions with Existing IAM Systems

As organisations increasingly rely on digital identities, the traditional Identity and Access Management (IAM) systems, that govern and provision identities, face growing challenges in detecting and mitigating identity-based threats. This thesis explores how Identity Threat Detection and Response (ITDR) solutions can be integrated into IAM infrastructures and enhance real-time threat visibility and response. The research focuses on a proof of concept integration between the open-source IAM system Keycloak and the ITDR solution Verosint. Documentation analysis and practical implementation was used to localize integration points between the two and establish communication. The results partially demonstrate the feasibility of enhancing IAM capabilities with ITDR functionalities although limitations were observed, such as missing data metrics as well as a missing threat response. The result also addressed historical data, meaning already existing data in IAM systems, which gives an insight to how one would integrate an ITDR solution with an existing complex system. Despite the challenges, the proof of concept as well as documentation showcase that this type of integration will enhance the system in the context of Zero Trust Architecture (ZTA) and Continuous Adaptive Risk and Rust Assessment (CARTA) models. Broader implementation raises additional concerns including API-related risks, system integration complexities, and ethical issues related to user monitoring, data retention, and the use of AI. Overall, the thesis highlights both the potential benefits and the critical considerations associated with integrating ITDR solutions into IAM systems.