Identity Risk Storyboard

A defensive cybersecurity tool that transforms IAM (Identity and Access Management) data into a human-readable identity risk narrative.

Overview

This tool analyzes IAM data from CSV files to identify security risks related to privileged roles, stale accounts, weak MFA coverage, break-glass access, and third-party access. It generates comprehensive reports including an executive summary, detailed findings, and a Markdown storyboard for easy review and action.

Features

• Comprehensive Risk Analysis: Evaluates multiple risk factors including privileged roles without MFA, stale privileged accounts, over-privileged users, outdated break-glass accounts, and risky third-party access.
• Multiple Output Formats: Produces terminal summaries, detailed Markdown reports, and structured data for integration.
• Severity-Based Prioritization: Assigns severity levels (Critical, High, Medium, Low) to findings for focused remediation.
• No External Dependencies: Uses only Python standard library for maximum portability and security.
• Sample Data Included: Comes with realistic sample CSV data for immediate testing.

Sample Inputs

The tool expects CSV files in the data/ directory:

• users.csv: User account information
• roles.csv: Role assignments and privilege levels
• mfa.csv: Multi-factor authentication status
• break_glass.csv: Emergency/break-glass account details
• third_party.csv: Third-party vendor access information

Data Format

users.csv

user_id,display_name,email,account_type,department,enabled,created_date,last_login_date

roles.csv

user_id,role_name,privilege_level,assignment_type

mfa.csv

user_id,mfa_enabled,mfa_method

break_glass.csv

user_id,emergency_account,last_review_date

third_party.csv

user_id,vendor_name,contract_owner,access_scope,review_status

Risk Logic

The tool implements the following risk detection rules:

• Privileged users without MFA: Critical risk for users with privileged roles lacking multi-factor authentication
• Stale privileged accounts: High risk for privileged accounts inactive for 90+ days
• Over-privileged users: Medium risk for users with multiple privileged roles
• Outdated break-glass accounts: High risk for emergency accounts not reviewed in 90 days
• Risky third-party access: Medium risk for third-party accounts with privileged access
• Disabled users with privileges: Low risk for disabled accounts still holding privileged roles

How to Run

1. Ensure Python 3.6+ is installed
2. Place your CSV data files in the data/ directory (or use the provided sample data)
3. Run the analysis:

   python main.py

The tool will:

• Load and validate all CSV files
• Perform risk analysis
• Generate reports in the output/ directory
• Display a terminal summary

Sample Output

Identity Risk Storyboard - Analysis Complete
==========================================

Total Users: 10
Privileged Users: 4
Accounts without MFA: 2
Stale Privileged Accounts: 1
Risky Break-Glass Accounts: 1
Risky Third-Party Accounts: 1

Report generated: output/identity_risk_storyboard.md

Roadmap

• Support for additional input formats (JSON, database connections)
• Integration with SIEM systems
• Automated remediation workflows
• Historical trend analysis
• Custom risk rule configuration

Ethical Use Note

This tool is designed for defensive cybersecurity purposes only. Use responsibly and in accordance with your organization's policies and applicable laws. The tool should only be used to analyze IAM data for which you have proper authorization and consent.