Powerful Identity Protection for Modern IT Environments
Use Cases and Deployment Scope
ITDR was originally put in because of insurance reasons. We needed to have MFA on RDP sessions, but it is utilized for more than that now. We have multiple policies that block lateral movement with privileged accounts, alert on unauthorized access, monitor for compromised passwords, and the list goes on.
Pros
- The MFA component has worked great when it comes to privileged accounts accessing RDP.
- We wanted to stop lateral movement between endpoints and with CrowdStrike Falcon Identity Protection we were able to do that.
- Identity has done a great job at supplementing our MDR service with telemetry.
Cons
- It's not really a fault of the product, but unless you have Falcon installed on all your endpoints your visibility is limited.
- I've yet to get MFA working on CIFS and Powershell traffic.
- The interface could be streamlined a little. CrowdStrike Falcon Identity Protection keeps changing where things are.
Return on Investment
- Being able to see right away during a Penetration Test that the product detected anomalies, but our MDR service didn't. It allowed us to go back to the MDR service to show them the results and fix the issue from slipping through the cracks.
- By satisfying the requirements from our insurance provider, our premiums didn't go up (MFA on RDP).
Usability
Alternatives Considered
Cisco Duo, Silverfort and Microsoft Defender for Identity
Other Software Used
Sophos Managed Detection and Response, KnowBe4 PhishER/PhishER Plus, KnowBe4 Security Awareness Training
