TOP Mission IAT-D01: Identity Threat Detection
Deploying detection capabilities for identity-based attacks including credential compromise, privilege escalation, and lateral movement.
Last updated Apr 7, 2026Current
Continue your mission
Deploying detection capabilities for identity-based attacks including credential compromise, privilege escalation, and lateral movement.
Deploying detection capabilities for identity-based attacks including credential compromise, privilege escalation, and lateral movement. This mission is part of CDA's Theater of Operations Playbook (TOP), which organizes security work into structured, executable missions with clear objectives and measurable outcomes.
Organizations that neglect this area face increased risk of security incidents, compliance failures, and operational disruption. This mission addresses a specific gap in many security programs where reactive approaches leave organizations exposed to preventable threats.
Consistent execution of this mission produces measurable improvements in security posture and demonstrates due diligence to regulators, customers, and partners.
Before beginning this mission, ensure you have: executive sponsorship for the initiative, identified stakeholders and resource owners, baseline data about your current state, appropriate tooling or a plan to acquire it, and defined success criteria.
Step 1: Assessment. Evaluate your current capabilities against the mission objectives. Identify gaps, quantify risk, and document the current state as a baseline for measuring progress.
Step 2: Planning. Develop an execution plan with specific milestones, resource allocation, and timelines. Identify dependencies on other missions or organizational initiatives.
Step 3: Implementation. Execute the plan in phases, starting with the highest-risk gaps. Document configurations, decisions, and exceptions. Follow change management procedures.
Step 4: Validation. Verify that implemented controls function as designed. Test with realistic scenarios. Validate that metrics show improvement.
Step 5: Operationalization. Transition from project mode to operational mode. Define ongoing responsibilities, monitoring processes, and review cadences.
The most frequent failure mode is implementing a control without the operational processes to sustain it. A tool without staff trained to use it, an automated scan without someone reviewing results, or a policy without enforcement mechanisms all represent incomplete execution.
Another common mistake is failing to measure baseline before implementation. Without a starting point, you cannot demonstrate improvement to stakeholders.
Scope creep derails missions when teams try to solve adjacent problems simultaneously. Stay focused on the defined mission objectives and address related needs through separate missions.
Define both leading indicators (activities that predict outcomes) and lagging indicators (outcomes that measure past performance). Report metrics in terms that resonate with your audience: technical metrics for security teams, risk metrics for management, compliance metrics for auditors.
Track: current state vs. target state, time to achieve milestones, resource utilization, blockers and dependencies, and risk reduction achieved.
This mission maps to a specific domain within the Planetary Defense Model, connecting individual security activities to the broader organizational defense strategy. Progress feeds into campaign-level metrics that inform strategic priorities.
The Theater of Operations Playbook ensures this mission is executed with the same rigor and documentation as every other security initiative, enabling consistent improvement across the entire program.
CDA Theater missions that address topics covered in this article.
A service account is a non-human identity used by an application, script, scheduled task, or automated process to authenticate to systems, call APIs, and access resources.
Managing the complete identity lifecycle from provisioning through deprovisioning, ensuring timely access grants and revocations.
Planning and executing MFA deployment across all user populations and critical systems with appropriate method selection.
Written by CDA Wiki Team
Found an issue? Help improve this article.