CSE2SIA – Assignment 3: Identity & Access Management Strategies for ABC Pty Ltd

Introduction

ABC Pty Ltd, a large financial services company with around 5,000 employees, plans to migrate its existing on-premises Customer Relationship Management (CRM) system to a cloud-based Software-as-a-Service (SaaS) platform. Currently, employees log in to a Windows 10 Standard Operating Environment (SOE) that is joined to an on-premises Active Directory (AD) domain. This migration introduces several important identity and access management challenges, as users must securely access the CRM both from corporate devices within the network and personal devices through the internet.

A secure federated identity solution is needed to maintain centralised authentication control while ensuring resistance to identity-based attacks. This report analyses key identity threats, proposes an appropriate federation technology, and explains the technical architecture, authentication flows, and residual risks for ABC Pty Ltd.

Identity-Based Cybersecurity Threats

Migrating to an external SaaS platform increases exposure to many identity-related threats. The key risks include:

Credential theft and phishing

Phishing attacks can compromise user credentials and personal identities, targeting untrained individuals and enabling unauthorised access to sensitive systems and data (Bhardwaj et al., 2021).

Replay and token theft

Attackers capture and replay legitimate authentication tokens to impersonate users or systems, leading to unauthorized access, data forgery, as well as financial losses (Ayuma et al., 2025).

Man-in-the-Middle (MitM) attacks

Man-in-the-Middle attacks in federated identity management occur when attackers intercept or alter authentication data between entities, compromising user credentials and trust (Cekerevac, 2025).

Session hijacking

Attackers may exploit cross-site scripting (XSS) vulnerabilities to steal cookies that contain personal information, enabling session hijacking and unauthorized access to user accounts (Rodriguez-Galan & Torres, 2024).

Endpoint compromise

Endpoint compromise occurs when attackers gain unauthorized access to remote devices, exploiting vulnerabilities to steal data, disrupt operations, or infiltrate organizational networks (Singh, 2024).

Proposed Federated Identity Technology

To address all these challenges, a Security Assertion Markup Language (SAML) 2.0-based federated identity solution is recommended, integrated with Active Directory Federation Services (AD FS) or Azure Active Directory (Azure AD) as the Identity Provider. SAML 2.0 enables secure Single Sign-On (SSO) by transmitting authentication and authorization data between identity and service providers, enhancing the interoperability and security in federated systems (Jayaraman & Goel, 2025).

To strengthen the identity assurance, the solution should enforce Multi-Factor Authentication (MFA), short-lived assertions, and conditional access policies based on user location, device posture, and risk level. In alignment with the modern Zero-Trust principles, continuous authentication mechanisms like behavioural analysis, device compliance monitoring, and risk evaluation should be employed. The use of short-lived tokens, digitally signed identity assertions, and context-aware policies also ensures secure, scalable, and compliant access management across multiple environments (Anasuri, 2022).

Business and Security Benefits

Implementing a federated identity solution offers significant business and security benefits for ABC Pty Ltd. It offers users a seamless experience with single sign-on, reduced authentication friction, and scalable management across many platforms. It also enhances security by centralizing access control, enabling multi-factor authentication, as well as supporting real-time monitoring and risk detection. Federated identity also helps organizations meet regulatory requirements and safely share data, particularly in sensitive sectors. Furthermore, decentralized blockchain-based systems can improve and enhance trust, give users more control over their data, and provide stronger protection against data breaches (Akpe et al., 2021).