IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
When things go wrong — kill switch, ITDR & ISPM
This is Zara's chapter. Sooner or later an account is hacked. Good teams notice fast and cut access everywhere in under a minute. Your goal: name the common fraud types and explain how a kill switch, ITDR and ISPM work.
- Fraud has a few repeating patterns. Learn their names.
- A kill switch ends an identity's access everywhere at once.
- ITDR spots attacks live. ISPM finds weak setup before an attack.
- Prove that the old token is refused. Do not just send the order.
The kinds of fraud
🥷 ATO — Account takeover (theft)
A criminal gets into Maya's real account by phishing, a SIM swap or a stolen password. A common start is a call from a fake "bank officer" who asks Maya to read out her OTP. Then they empty the account. This is an account takeover.
🤝 AHO — Account handover (cooperation)
The real owner gives the account to criminals, often for money. A student who lends a bank account for a small fee is one example. The owner becomes a money mule.
🆕 AO — Fraudulent account opening
An account opened with stolen or made-up details from day one.
🧟 Synthetic identity
A fake person built from real pieces: a real ID number, a fake face, a new device. Simple checks miss it.
The kill switch
The tokens lesson showed the problem. A stolen session and tokens already issued keep working until they expire. The kill switch is the answer. It is one trigger that ends an identity's access everywhere at once. It needs three pieces.
| Piece | What it does |
|---|---|
| SSF: Shared Signals Framework (OpenID) | A "group chat" where security systems tell each other urgent news. The messages are signed. They are called SETs (Security Event Tokens). |
| CAEP: the event words (OpenID) | The standard words used in that chat: session-revoked, credential-change, token-claims-change. Everyone can react without custom work. |
| Revocation enforcement | Kill sessions and refresh tokens at every IdP. Also keep a deny-list ("revocation markers") that APIs check. Then even tokens already issued are refused. |
a banned list at a festival gate. You cannot take back a wristband that is already on an arm. But you can put the name on a list, and every bar and stage checks the list. Share the list fast. Then the wristband is dead in under a minute.
The defense trio: ITDR, ISPM and the SOC stack
🚨 ITDR (live)
Identity Threat Detection and Response is the burglar alarm. It spots attacks as they happen. Examples are a password spray (one password tried on many accounts), impossible travel (two far-away logins minutes apart), or a service account suddenly acting like a person. Then it reacts: lock, step-up or kill switch.
🧹 ISPM (prevention)
Identity Security Posture Management is the hygiene inspector. It keeps finding orphaned accounts, too many permissions, old credentials and settings that drifted, before attackers do.
A detection is only as good as the logs behind it. A system that keeps logs only on itself for one day and never sends them out is a blind spot. An attacker can hide there.
Go deeper: more fraud, SIEM and SETs
📵 SIM swap
The attacker moves the victim's phone number to their own SIM card. Then they receive the victim's SMS codes (the proof lesson warned you).
🕸️ Fraud ring / mule network
Many accounts, few people. Each looks innocent alone. As a network, it is obvious, if you have a graph (the personas lesson).
🏢 SIEM + SOAR + SOC
The SIEM is the warehouse for security events. SOAR is the automation that reacts with playbooks. The SOC is Zara's team that runs both, all day and night.
Security Event Tokens are defined in RFC 8417. A rescue runs in this order. Zara pulls the kill switch. A signed session-revoked SET goes out over SSF. Each IdP kills sessions and refresh tokens, and each API loads a revocation marker. Last, a probe confirms that the already-issued access token is now refused.
🧪 Interactive lab — enable JavaScript to play with this one.
Grade your revocation and Shared Signals setup with SSF Check. Audit your logout and revocation endpoints with Logout Check.