Identity Security as a Service: What to Hand Over and What to Keep

Identity is where most organizations hand over the keys without noticing. A provider that runs your joiner-mover-leaver process, your privileged access vault or your help desk holds the power to create accounts, reset credentials and approve access. That is the power an attacker wants. Handing identity operations to a specialist can raise quality. Handing over the wrong parts, or handing them over without controls, creates a single point of compromise.

The threat that decides the split

CISA, the FBI and partners published Advisory AA23-320A on the group known as Scattered Spider (first issued 16 November 2023, last revised 29 July 2025). It says the group targets large companies and their contracted IT help desks. Its methods include posing as employees to persuade IT or help desk staff to reset a password and to transfer the employee’s multi-factor authentication to a device the group controls, abusing trusted relationships with contracted help desks, registering their own MFA tokens, and in earlier activity adding a federated identity provider to the target’s single sign-on tenant. The advisory’s listed mitigations include FIDO or WebAuthn authentication or PKI-based MFA, which it describes as resistant to phishing and not susceptible to push bombing or SIM swap, and phishing-resistant MFA for all services to the extent possible.

Our reading: when you outsource identity operations, you also outsource the help desk’s resistance to impersonation. That is a control you must specify, test and own.

What to hand over and what to keep

What current standards say about the controls you specify

NIST SP 800-63B-4 (July 2025), the authentication volume of NIST’s digital identity guidelines, is written for US federal agencies. Other organizations can use it as a reference. It says verifiers must offer at least one phishing-resistant option at authenticator assurance level 2, and it calls phishing a significant threat vector. At level 3 it requires a phishing-resistant authenticator with a non-exportable key. It also says verifiers and credential service providers must not impose other password composition rules and must not require subscribers to change passwords periodically. It has a section on account recovery, which is the area that help desk resets fall into. AA23-320A also advises refraining from recurring password changes.

Verizon’s 2026 DBIR executive summary reports credential abuse as the initial access vector in 13% of breaches, with vulnerability exploitation at 31%. It also reports third-party involvement in 48% of breaches and says only 23% of third-party organizations fully remediated missing or improperly secured MFA on cloud accounts. The data is global and weighted to the US.

Contract and service controls

• Help desk verification: written procedure, call-back or in-person verification for MFA reset and privileged account changes, and no reset on the basis of a caller’s claims alone.

• Phishing-resistant authentication for provider staff who can change identities, and for your own administrators.

• Separation: provider staff cannot create privileged accounts without approval from your named approver, recorded in a log you can read.

• Testing: social-engineering tests of the provider’s help desk at least yearly, with results shared.

• Evidence: logs of identity changes available to you in your own tooling, not only in the provider’s portal.

• Exit: documented export of identity data, roles and policies, and the ability to take admin control back.

Decision

Decision: write the help desk verification standard and the break-glass process before you sign. If a provider cannot meet them, the commercial terms do not matter.

What this evidence does not show

AA23-320A describes one group’s methods. It does not measure how common help desk attacks are across industries. DBIR figures are global. NIST SP 800-63B-4 binds US federal agencies, not UAE organizations. The activity table is Cybrilliant analysis. We did not verify the details of specific incidents reported in the press, and none is cited.

A short test

Ask your help desk what they would do if a caller with the right employee number and a plausible story asked to move MFA to a new phone. If the answer is a judgment call, the control is not engineered.

Sources

1. CISA, FBI and partners, Advisory AA23-320A, Scattered Spider (revised 29 July 2025). Accessed 9 October 2026. cisa.gov/news-events/cybersecurity-advisories/aa23-320a

2. NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, July 2025. Accessed 9 October 2026. nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63B-4.pdf

3. Verizon, 2026 Data Breach Investigations Report, Executive Summary. Accessed 9 October 2026. verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf