| TEHDİT | SALDIRI YÜZEYİ | ÖNCELİKLİ KONTROLLER |
|---|---|---|
| Credential stuffing | CIAM ve workforce login | Bot rate limit, passkey, device risk, incident feedback. |
| Phishing & Adversary-in-the-Middle | Password/MFA oturumları | Phishing-resistant passkeys, token binding olanakları, step-up. |
| MFA fatigue / push bombing | Push onay sistemi | Riskli tekrar örüntüsü, rate limiting, number matching ve kullanıcı bildirimi. |
| Helpdesk / recovery social engineering | Account recovery ve destek masası | Katmanlı kanıt, step-up, iki kişi onayı, soğuma süresi. |
| OAuth consent phishing | Üçüncü taraf API erişimi | Publisher kontrolü, scope yönetimi, consent audit, revoke. |
| Token theft and replay | OAuth, OIDC, session | Refresh token reuse detection, kısa ömürlü token, revocation. |
| Privilege escalation via group nesting | AD/Entra/IAM | Effective permission graph, admin change review, SoD. |
| Dormant admin / orphan account | PAM, IGA | Sahiplik, activity recertification, JIT ve kısa grant. |
| SCIM deprovision failure | JML lifecycle | Connector confirmation, reconciliation, retry/DLQ. |
| MSSP tenant data crossover | Multi-tenant platform | Tenant-scoped keys, RBAC, cache & export negative tests. |
| Service principal secret theft | NHI & cloud IAM | Vault, key rotation, least privilege, token audience. |
| Certificate/CA compromise | PKI/VC/trust | HSM, chain validation, revocation, separate custody. |
| Workload impersonation | SPIFFE/mesh | Attestation, mTLS, short-lived SVID and identity scopes. |
| AI agent delegated authority abuse | AI agent & tools | Signed delegation chain, tool policy, human approval, deny by default. |
| Prompt injection against identity copilot | AI decision support | RAG ACL, tool allowlist, independent authorization, red team. |
| Digital document forgery | Remote onboarding | Issuer validation, crypto, document forensics, specialist review. |
| Audio/video deepfake impersonation | Voice/video channel | Multi-modal signals + independent verification channel. |
| Digital wallet credential replay | VC/wallet | Presentation challenge, status/revocation, audience and nonce. |
| IdP outage / loss of signing key | Core identity infrastructure | Break-glass and DR exercise, HSM key custody and RP continuity. |
| Malicious insider identity misuse | High-trust users | Risk-based UEBA, least privilege, monitoring governed by privacy. |
Identity & Digital Trust Pro · Yetenek raporuBölüm 13 / 17
Kimlik Tehdit Modeli ve Saldırı Yolları — Trust Pro Identity & Digital Trust
Kimlik kriptografisi ve policy authorization, LLM/metin sınıflandırma mekanizmalarının yerine geçmez. Şüpheli bir prompt, doküman, ses veya servis hesabı üstünden izinli görünse de “eylemi gerçekleştirebilir mi?” kararı yalnızca yetkili…