GCRI · Cybersecurity and Digital Resilience
Identity and data security
Most intrusions involve stolen or misused credentials, and most harm involves data: stolen, encrypted, altered or exposed. Identity and access management, strong authentication, encryption and data minimisation are the core defences. This page sets out how identity and data are attacked, how they are protected, how breaches are measured, and what evidence serves the organisations and data protection authorities responsible.
Identity and data security on the record.
Identity and data security: how the risk develops.
Authentication, authorisation and privacy. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Credentials are the main entry
Phishing, password reuse, stolen session tokens and credential stuffing let attackers log in rather than break in. Phishing-resistant authentication blocks many of these paths.
Privilege expands harm
Accounts with broad or standing privileges let attackers move laterally and reach sensitive data. Least privilege and just-in-time access limit the damage.
Data spreads beyond control
Copies of data accumulate in backups, analytics, test systems and third parties. Data that is not needed and not kept cannot be stolen.
Breaches harm people
Exposed personal data leads to fraud, identity theft, extortion and loss of trust, and the harm continues long after the breach.
How identity and data security is modelled, measured and tested.
The model, its assumptions, its data and its uncertainty, in the form a scientist or engineer would check. Structures follow published methods. The values drawn are illustrative, not findings.
System model
The couplings between the systems in identity and data security: signs of influence, a reinforcing and a balancing loop, and cross-links where stress jumps.
Identity and data security protect people in every domain.
Findings are designed for the Evidence Brief series. NIST's Digital Identity Guidelines (SP 800-63, revision 4) set assurance levels for authentication.
- Breach case studies.
- Identity assurance evaluations.
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Accounts using phishing-resistant authentication | percent of accounts | monthly | Identity system reports | OBSERVED |
| Privileged accounts | count | monthly | Access management records | OBSERVED |
| Personal data breaches notified to regulators | count | annual | Data protection authority statistics | Published statistics |
| Records exposed in breaches | count | per breach | Breach notifications | REPORTED |
| Sensitive data encrypted at rest | percent of data stores | per assessment | Security assessments | DECLARED |
| Credential exposure in breach datasets | count of organisational accounts | monthly | Breach monitoring services | OBSERVED |
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| Data protection authority annual reports and breach statistics | Breach notifications and enforcement | Public records, licence per authority |
| NIST Digital Identity Guidelines (SP 800-63) | Requirements for identity proofing and authentication | Public domain, US government |
| FIDO Alliance specifications | Standards for phishing-resistant authentication | Public, FIDO terms |
| Have I Been Pwned | Aggregated data from public breaches for exposure checks | Free service, terms of use |
| Verizon Data Breach Investigations Report | Patterns of credential use in breaches | Public report, Verizon terms |
Who decides, and what the evidence serves.
Cybersecurity and Digital Resilience prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Organisations and their security teams | Which authentication and access controls to adopt | Authentication reviews; privilege counts |
| Data protection authorities | Where to focus guidance and enforcement | Breach statistics and trends |
| Product and service designers | What data to collect and keep | Minimisation methods |
Outputs this topic produces
- Authentication strength reviews
- Privileged access reduction plans
- Data inventory and minimisation methods
- Breach trend analyses from regulator data
What experts ask.
As organisations move to cloud services and remote work, the network perimeter matters less and identity matters more. An attacker with valid credentials can often move through systems unnoticed. At the same time, organisations hold growing volumes of personal and sensitive data, and breaches expose people to fraud, discrimination and loss of privacy long after the incident.
- How strongly are users, devices and services authenticated, and how resistant is that authentication to phishing and credential theft?
- Are access rights limited to what each role needs, and are they reviewed and removed when no longer needed?
- Where are sensitive data held, who can reach them and how are they protected at rest, in transit and in use?
- How are privacy rights respected in the design and operation of security controls themselves?
Drivers and processes.
Identity and data risks arise from credentials, privileges and data flows.
Proving identity
Passwords alone are weak. Phishing-resistant multi-factor methods, such as hardware keys and passkeys, greatly reduce account takeover.
Limiting access
Least privilege and regular review limit what a compromised account can do. Excessive standing privileges are a common enabler of serious breaches.
Safeguarding information
Encryption, data minimisation and retention limits reduce what can be lost, and privacy-by-design keeps controls proportionate.
Identity has become the main target because it is the main key. Attackers increasingly bypass technical defences by tricking users, abusing password reset processes, stealing session tokens or exploiting service accounts with broad privileges that nobody reviews. Defences therefore combine strong authentication with careful management of privileges, monitoring of unusual behaviour and processes that make it easy to revoke access quickly.
How the evidence is built, and its limits.
- 01
Identity logs
Sign-in and access logs show patterns of misuse. They need careful retention and privacy safeguards.
- 02
Breach reports
Public breach notifications and incident reviews show common failure modes, though reporting thresholds differ between jurisdictions.
- 03
Cryptographic analysis
Evaluation of encryption and authentication schemes, applying cybersecurity and cryptography. Implementation errors often matter more than algorithm strength.
- 04
Usability research
Studies of how people use authentication show where security measures are bypassed because they are hard to use.
How it is studied, and what the methods cannot say.
- 01Cybersecurity and cryptographyControl baselines and gap analysis · Exploited vulnerability prioritisationApplied here
- 02Software and safety-critical systems engineeringSecure development life cycle · Safety and security co-assuranceApplied here
- 03Network science and contagionAttack path analysis · Digital dependency concentration · Coordination detectionApplied here
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Questions and answers.
What is phishing-resistant authentication?
What is least privilege?
Do I have to report a data breach?
What is zero trust?
Does security monitoring conflict with privacy?
Does the platform handle personal data from breaches?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.