Defining common identity attacks
As stated in the first section of this chapter, identity and access is the security perimeter when utilizing cloud services. Therefore, many of the most common security threats to our companies are identity-based attacks. Identity attacks are focused on stealing the credentials of a user and then using these credentials to authenticate to services that that user is authorized to access.
Let's look at some of the more common types of identity attacks.
A password-based attack is when an attacker is attempting to guess the combination of username and password to gain access. A password spray attack is a password-based attack where the attacker is utilizing a list of weak passwords against a username to gain access. A brute-force attack is similar to a password spray attack; it attempts many passwords against multiple accounts to find a weak password on an account. In all of these attacks, when an attacker finds a match on a username and password...