Secure SaaS Tokens from Misuse

The Obsidian Approach

ML-Based Detections

- Gain a normalized view of identities to help detect suspicious behavior across apps
- Identify anomalous user behaviors across various phases of the kill chain
- Thwart attacks using AiTM frameworks like Evilginx
- Gain deeper context to pivot investigations using explainable ML models

Rule-Based Detections

- Accelerate investigations with out-of-the-box rules mapped to the MITRE ATT&CK framework
- Benefit from detection rules informed by hundreds of IRs
- Define, test, and deploy custom rules to tailor detection for specific needs
- Understand expected alert volume through automated backtesting
- Fine-tune rules based on risk factors such as terminated employees

Respond with Context

- Simplify SecOps workflows with months of searchable SaaS logs available in a human-readable format
- Pivot and hunt with contextual insights, including IP, user, event type, and more
- Baseline understanding with context on normal behavior for a user
- Analyze identities and activity across SaaS apps to enhance incident response
- Start with tailored remediation steps to accelerate response efficiency

Frequently Asked Questions

What is token compromise in SaaS environments?

Token compromise occurs when attackers steal or misuse authentication tokens to gain unauthorized access to SaaS applications. Because these tokens allow user-like access, attackers who obtain them can mimic legitimate users, making detection much harder for security teams.

Why are attacker-in-the-middle (AiTM) frameworks a significant threat?

Attacker-in-the-middle (AiTM) frameworks, such as Evilginx, intercept authentication flows to capture session tokens. According to Obsidian Security, 1 in 3 SaaS attacks now use AiTM frameworks, making them a growing and urgent security threat.

How does Obsidian detect token compromise?

Obsidian uses machine-learning-based detections to identify anomalous user behavior across SaaS apps and phases of the kill chain. Their solution also leverages rule-based detections mapped to the MITRE ATT&CK framework, including both out-of-the-box and customizable rules to flag suspicious activities.

How does Obsidian differentiate between legitimate and malicious user activity?

Obsidian's ML models provide a normalized view of identities and baseline user behavior, allowing organizations to identify deviations that could indicate compromise. Contextual insights such as IP addresses, event types, and user activity support quick and accurate investigations.

What contextual information does Obsidian provide during incident response?

Security teams can search months of human-readable SaaS logs, enabling pivots on IP, user, geolocation, event type, and more. Obsidian enriches each alert with context about normal user behavior, making it easier to identify and respond to suspicious activity.

Can detection rules in Obsidian be customized?

Yes, Obsidian lets users define, test, and deploy custom detection rules tailored to their organization’s specific needs. Automated backtesting helps teams understand expected alert volumes and fine-tune rules based on real risk factors, such as recently terminated employees.

How quickly can Obsidian detect and stop abnormal SaaS access?

Obsidian’s approach is designed for rapid detection, helping organizations identify and respond to abnormal access in minutes. Continuous monitoring and real-time alerting enable swift remediation, critical for meeting service level agreements (SLAs).

What other SaaS identity security use cases does Obsidian support?

In addition to stopping token compromise, Obsidian helps prevent SaaS spear phishing, detect threats before data exfiltration, and respond to attacks like SSPR (self-service password reset) and social engineering. Their platform delivers comprehensive identity security across all your SaaS apps.

Stop Token Compromise

36% of SaaS Breaches Involve Token Compromise

Tokens Make Access to Apps Easier for Users, Same for Attackers

1-in-3 Attacks Use Attacker in the Middle (AiTM) Frameworks

Token Compromise is Harder to Detect Since Attackers Mimic Users to Stay Hidden