DISCOVERY
ANALYZE
REMEDIATE
TRACK
DART  METHOD
0/5
Cloud Identity Discovery · DART Method

Secure Every Identity
with the DART Method

Delinea's structured approach to privileged access management — Discover every identity, Analyze risks and anomalies, Remediate over-permissioned access, and Track/Audit continuously. Applied here to Cloud Identity Discovery across AWS, Azure, and GCP.

5 Modules · DART-Aligned
~60 min
AWS · Azure · GCP
Intermediate
🌐
The DART Method for Cloud Identity Security
A structured, cyclical approach — Discovery → Analyze → Remediate → Track/Audit
🎯
FRAMEWORK OVERVIEW
Why DART? Reactive security doesn't work anymore.
DART transitions organizations from reactive incident response to proactive identity posture management — especially critical in hybrid and multi-cloud environments where identities span users, machines, and AI systems.
D
Discovery
Identify every identity, privilege, and access point. Eliminate blind spots with continuous scanning across on-prem, cloud, and SaaS.
A
Analyze
Assess risks and detect anomalies using ML-powered behavioral analytics, risk scoring, and ITDR capabilities.
R
Remediate
Enforce JIT access, credential rotation, privilege elevation controls, and CIEM-driven least-privilege enforcement.
T
Track / Audit
Continuously monitor, maintain compliance audit trails, feed insights back into Discovery — completing the cycle.

📋 What you'll learn in this training

This module applies the DART method specifically to Cloud Identity Discovery — Delinea's capability that automatically scans AWS, Azure, and GCP to find all human and non-human identities, map effective permissions, and highlight least-privilege violations. Each of the four subsequent modules maps to one DART phase.

⚡ The Identity Sprawl Problem

The average enterprise runs 3–5 cloud platforms with thousands of IAM roles, service accounts, and API keys — 80% of which have never been audited. Non-human identities now outnumber human accounts 45:1 and represent the leading initial-access vector in cloud breaches.

🔄 The Cyclical Nature of DART

DART is not a one-time project — it's a continuous cycle. Track/Audit feeds new insights back into Discovery, refining the process over time. Delinea's cloud-native architecture makes each cycle faster and more precise than the last.

IDENTITY TAXONOMY — WHAT DELINEA DISCOVERS (THE "D" IN DART)
Human Identities HUMAN
IAM Users (AWS) · Entra ID Users (Azure) · Cloud Identity Users (GCP) USER
Federated / SSO identities mapped to cloud roles FED
Non-Human Identities (NHI) — Primary DART focus NHI
Service Accounts · Managed Identities · Workload Identities SVC ACCT
Lambda Execution Roles · Cloud Run SA · Azure Function Identity · AI Agents FUNCTION
CI/CD Pipeline Identities (GitHub Actions, ADO, Jenkins) PIPELINE
IAM Roles & Groups — Remediation targets ROLE
AWS IAM Roles · Azure RBAC Roles · GCP IAM Bindings ROLE
Policies & Audit Records — Tracked continuously POLICY
Inline Policies · Managed Policies · Permission Boundaries · Session Logs POLICY
🧠
Knowledge Check · Overview
DART FRAMEWORK FUNDAMENTALS
According to the DART method, what makes it fundamentally different from traditional reactive security approaches?
A DART focuses exclusively on blocking external threats rather than managing internal identities.
B DART is a continuous, cyclical process — Track/Audit feeds insights back into Discovery — enabling organizations to proactively manage identity posture rather than respond only after incidents occur.
C DART replaces all existing PAM tools with Delinea Secret Server and starts from scratch.
D DART is a one-time audit methodology applied annually during compliance reviews.
D
DART PHASE 1 OF 4
Discovery — Unveiling the Identity Landscape
Identify all identities, privileges, and access points across on-premises, cloud, and SaaS. Eliminate blind spots with continuous automated scanning.
🔌
Connect Cloud Accounts & Run the Scan
Onboard AWS, Azure, and GCP into Delinea's discovery engine

🔍 DART · Discovery Phase

Delinea Secret Server's discovery tools automatically detect human and machine identities — including service accounts, API keys, and AI agents — across every connected cloud platform. By integrating with identity providers (IdPs) and cloud platforms, it maps access entitlements and identifies misconfigurations such as over-privileged accounts or unused credentials. Real-time AI-driven insights flag dormant or risky identities early.

📋 Prerequisites

Before connecting: (1) Delinea Platform admin or Connector Manager role, (2) Read-only IAM credentials in the target cloud account, (3) Network/API access from the Delinea connector host. No long-lived keys are required for AWS (uses STS AssumeRole).

✅ AWS — Cross-Account Role (Recommended)

Delinea uses STS AssumeRole — no static access keys required. Create a read-only IAM role with an ExternalId condition to prevent confused-deputy attacks.

{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": [ "iam:List*", "iam:Get*", "sts:GetCallerIdentity", "organizations:Describe*", "access-analyzer:List*" ], "Resource": "*" }] }
1

Delinea → Connectors → Cloud Accounts → Add Account → Amazon Web Services

Choose connection method: Cross-Account Role (recommended) or Access Keys (legacy). Copy Delinea's AWS Account ID and generated ExternalId shown in the UI.

2

Create the cross-account IAM role in AWS Console

IAM → Create Role → Another AWS Account. Set Delinea's Account ID as the principal and add the ExternalId condition.

{ "Principal": { "AWS": "arn:aws:iam::DELINEA_ACCT_ID:root" }, "Condition": { "StringEquals": { "sts:ExternalId": "YOUR_EXTERNAL_ID" } } }
3

Paste the Role ARN into Delinea and validate

Delinea runs sts:GetCallerIdentity to confirm access. Set scan scope (regions, tag filters) and scan frequency (default: daily).

✅ Azure — App Registration + RBAC

Delinea connects via an Entra ID App Registration with client secret or certificate. Assign Reader RBAC at Management Group or Subscription scope, plus Microsoft Graph → Directory.Read.All.

1

Entra ID → App Registrations → New Registration

Name it Delinea-CloudDiscovery. Copy the Application (client) ID and Tenant ID into Delinea.

2

Create a client secret (or upload certificate)

Certificates & Secrets → New client secret, 12–24 month expiry. Certificate-based auth preferred for production. Copy the secret value immediately.

3

Assign Reader role + grant Graph API admin consent

Assign Reader at subscription scope. Add Directory.Read.All as an application permission, then have a Global Admin grant admin consent.

✅ GCP — Service Account + Security Reviewer

Delinea uses a GCP Service Account with Security Reviewer and Browser roles at the Organization level.

1

Create service account: delinea-discovery@PROJECT.iam.gserviceaccount.com

IAM & Admin → Service Accounts → Create Service Account.

2

Grant roles at Organization level

gcloud organizations add-iam-policy-binding ORG_ID \ --member="serviceAccount:delinea-discovery@PROJ.iam.gserviceaccount.com" \ --role="roles/iam.securityReviewer" gcloud organizations add-iam-policy-binding ORG_ID \ --member="serviceAccount:delinea-discovery@PROJ.iam.gserviceaccount.com" \ --role="roles/browser"
3

Download JSON key → paste into Delinea → Validate

Cloud Accounts → Add Account → Google Cloud Platform → paste key JSON → Validate Connection.

🔬
Running the Discovery Scan
What the engine collects — and how it works
DART · DISCOVERY ENGINE — LIVE VIEW
READY
–
IDENTITIES FOUND
–
POLICIES ANALYZED
–
CLOUD PROVIDERS
–
RISKS FLAGGED
–
CRITICAL SEVERITY
–
UNUSED PERMISSIONS
1

Phase 1 — Identity Enumeration

Calls iam:ListUsers, iam:ListRoles, Graph API, and GCP IAM list. For multi-account orgs, fans out in parallel across all sub-accounts. This phase consolidates data from disparate sources into a centralized view.

2

Phase 2 — Policy & Permission Collection

Retrieves all attached policies for each identity — inline, managed, group-inherited, resource-based, and SCPs. Resolves full policy JSON including Allow/Deny statements.

3

Phase 3 — Effective Permission Computation

Mirrors the cloud provider's own evaluation logic to compute effective permissions — what the identity can actually do, not just what's listed.

4

Phase 4 — Usage Data Correlation → ANALYZE PHASE

Ingests CloudTrail / Azure Monitor / GCP Audit Logs. Determines which permissions were actually used in the last 30/60/90 days. The delta between granted and used permissions becomes the input to the Analyze phase.

D→A→R→T
Discovery output feeds directly into Analyze — the identity inventory, effective permissions, and usage data are the inputs for risk scoring and anomaly detection in the next DART phase.
🧠
Knowledge Check · D — Discovery
DART PHASE 1 ASSESSMENT
What is the key security purpose of computing "effective permissions" during the Discovery phase, rather than simply listing which policies are attached to an identity?
A It reduces the number of API calls made to the cloud provider during scanning.
B An identity may have 10 policies attached, but Deny rules, SCPs, and permission boundaries mean only a subset are usable — effective permission computation reveals what the identity can actually do, providing a true picture of the attack surface.
C It allows Delinea to automatically create replacement IAM policies during the scan.
D Effective permissions are only needed when auditing human accounts — service accounts use simple policy listing.
A
DART PHASE 2 OF 4
Analyze — Assessing Risks and Identifying Anomalies
ML-powered behavioral analytics assign risk scores to every identity based on access patterns, privilege levels, and external threat intelligence.
📊
Interpret Risk Findings
Reading the dashboard, understanding severity scoring, and prioritizing action

🔬 DART · Analyze Phase

Delinea Secret Server's ITDR (Identity Threat Detection and Response) capabilities use machine learning to detect deviations from normal behavior. The system assigns risk scores based on access patterns, privilege levels, and potential external threats. It flags abnormal login attempts, excessive cloud permissions, or unusual AI agent activities — and cross-references authentication logs, session monitoring, and entitlement usage for a holistic view.

⚠️ Risk Score Factors

Delinea's analytics engine scores each identity on: privilege level (admin vs. scoped), last usage (days since last API call), access pattern anomalies (unusual times, IPs, regions), entitlement breadth (number of services accessible), and external threat intel (leaked credentials, known-bad IPs).

🎯 Severity Definitions

Critical — Admin wildcard, privilege escalation path, data-exfil-capable. Act in 24h. High — Broad write access on NHIs. Act in 7 days. Medium — Unused 90+ day permissions. Low — Hygiene issues (e.g., password auth instead of managed identity).

DART · ANALYZE — SAMPLE RISK FINDINGS · CLICK ROW TO EXPAND ● ITDR ACTIVE
SEVERITYIDENTITYPROVIDERFINDINGLAST USED
● CRITICAL
ci-deploy-prod
Service Account · NHI
 ⬡ AWS iam:* wildcard + privilege escalation path to full org control Never
● HIGH
analytics-reader@corp.com
Human User
 ⬡ Azure Storage Blob Data Owner on all storage accounts — write/delete production data 47 days ago
● HIGH
dataflow-worker@proj.iam.gsa.com
Service Account · NHI
 ⬡ GCP Project Editor role — write access to all services in project 3 days ago
● MEDIUM
john.smith@company.com
Human User
 ⬡ AWS EC2 full access — zero EC2 API calls in 134 days 134 days ago
● LOW
reporting-bot
Service Account · NHI
 ⬡ Azure Password-based auth — lacks MFA, credential rotation overdue by 180 days Today

🔗 Privilege Escalation Path Detection

A key differentiator of Delinea's Analyze phase is the privilege escalation path detector. Even if an identity lacks admin permissions directly, combinations like iam:CreateRole + iam:AttachRolePolicy + sts:AssumeRole form a multi-step path to full admin. Delinea detects and surfaces these chains — they cannot be seen by simply reading policy lists.

D→A→R→T
Analyze output directly drives Remediate — every finding includes a recommended action (right-size, access review, or auto-remediate) based on severity and identity type. Click any finding above to see the recommendation.
🧠
Knowledge Check · A — Analyze
DART PHASE 2 ASSESSMENT
A CI/CD pipeline service account has zero iam:* usage in 90 days. An engineer argues this is Medium — "it's never been used to cause harm." How does the DART Analyze framework respond?
A The engineer is correct — ITDR downgrades findings when a permission has never been exercised.
B Severity in the Analyze phase is based on blast radius potential, not historical usage. An unused iam:* is Critical because compromise of that account grants full IAM control — dormancy means it's an unexploited attack vector, not a safe one.
C Delinea auto-removes the permission since it has been dormant, without raising a finding.
D It's a false positive — CI/CD accounts require admin access by design per the DART method.
R
DART PHASE 3 OF 4
Remediate — Taking Action to Secure Privileges
Enforce JIT access, credential rotation, and privilege elevation controls. CIEM-driven least-privilege enforcement across multi-cloud environments.
🔧
Remediate Over-Permissioned Cloud Identities
Targeted access reviews, automated right-sizing, and RBAC-controlled enforcement

⚡ DART · Remediate Phase

Once the Analyze phase surfaces risks, Remediate takes action. Delinea facilitates remediation by enforcing just-in-time (JIT) access, credential rotation, and privilege elevation controls. Automated actions — revoking excessive entitlements, enforcing MFA, isolating compromised accounts — mitigate threats while maintaining business continuity. Delinea's Cloud Infrastructure Entitlement Management (CIEM) applies least privilege across multi-cloud environments. All remediation actions are auditable and comply with regulatory standards via RBAC and workflow approvals.

🔄
Right-Size (AI-Recommended)
Delinea generates a least-privilege replacement policy based on actual 90-day usage data. One click applies the right-sized policy via cloud API.
📋
Access Review Workflow
Creates a manager/owner review task with a plain-language summary. Reviewer chooses Certify, Revoke, or Right-Size. Business justification is recorded in the audit trail.
⚡
Automated Enforcement
For Revoke/Right-Size decisions, Delinea calls the cloud API immediately — no manual IAM console work. Automated password resets and access denials for active threats.
⏱
Just-in-Time (JIT) Access
Replace standing privileges with time-bound, approval-gated JIT access — eliminating long-lived, over-permissioned roles that sit idle between uses.
📋

Step 1 — Initiate Access Review (from any Analyze finding)

Click Start Access Review on any finding. Delinea creates a review task, assigns it to the identity owner or designated approver, sets a deadline (default 7 days), and sends a notification with a plain-language summary of excess vs. used permissions.

→
🤝

Step 2 — Reviewer Decision: Certify / Revoke / Right-Size

Certify — keep access, provide business justification, auto-schedule re-review in 90 days. Revoke — remove the specific excess permission. Right-Size — accept Delinea's ML-generated least-privilege policy replacement.

→
⚡

Step 3 — Automated Cloud API Enforcement

For Revoke and Right-Size decisions, Delinea calls iam:PutRolePolicy and iam:DetachRolePolicy (AWS), Azure RBAC assignments, or GCP IAM bindings — immediately enforcing the change. Full audit trail is generated.

→
🔄

Step 4 — Post-Remediation Verification → back into DART cycle

Delinea re-scans the identity within 24 hours and marks the finding Resolved. Certification decisions trigger a new 90-day Discovery cycle. This feeds the Track/Audit phase with a complete change record.

→
CIEM RIGHT-SIZING EXAMPLE — ci-deploy-prod
❌ BEFORE — OVER-PERMISSIONED (Analyze found this)
{ "Statement": [{ "Effect": "Allow", "Action": "*", "Resource": "*" }] }
✅ AFTER — DELINEA CIEM RIGHT-SIZED POLICY
{ "Statement": [{ "Effect": "Allow", "Action": [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "s3:GetObject" ], "Resource": [ "arn:aws:ecr:us-east-1:123:repo/app", "arn:aws:s3:::deploy-artifacts/*" ] }] }
D→A→R→T
Every remediation action generates an audit record that feeds directly into the Track/Audit phase — creating the compliance trail, triggering re-scans, and scheduling the next DART cycle for certified access.
🔬 Lab Exercise — Remediation Workflow
✓
Navigate to Findings Dashboard — Filter by Severity: Critical. Confirm ci-deploy-prod appears at top.
✓
Review effective permissions panel — Confirm iam:* is listed as Critical with zero 90-day usage.
✓
Click "Right-Size" — Review the CIEM-generated least-privilege policy. Confirm it contains only ECR and S3 GetObject scoped to specific ARNs.
✓
Apply the right-sized policy — Delinea calls iam:PutRolePolicy + iam:DetachRolePolicy to enforce the change.
✓
Initiate Access Review for john.smith — Medium EC2 finding → Start Access Review → assign to manager, 7-day deadline.
✓
Migrate reporting-bot to Managed Identity — Replace password auth with Azure Managed Identity to eliminate credential management overhead.
🧠
Knowledge Check · R — Remediate
DART PHASE 3 ASSESSMENT
What does Delinea's CIEM capability do differently than traditional PAM access review processes?
A CIEM is only applicable to human user accounts — service accounts are handled separately by Secret Server.
B CIEM minimizes standing cloud privileges by automatically generating least-privilege replacement policies based on actual usage data — and enforces them via direct cloud API calls — rather than requiring manual policy authoring or console work by an admin.
C CIEM requires all access to be approved by the security team before it can be used, adding latency to every operation.
D CIEM is a compliance reporting tool that generates audit reports but does not change any IAM permissions.
T
DART PHASE 4 OF 4
Track / Audit — Continuous Monitoring & Compliance
Log all access, changes, and activities. Maintain audit trails for GDPR, NIST, and SOC 2. Feed insights back into Discovery to restart the DART cycle.
📈
Continuous Monitoring, Compliance & the DART Cycle
Session recording, behavioral analytics, audit trails, and cycle closure

📋 DART · Track/Audit Phase

The Track/Audit phase ensures security measures are continuously monitored and compliance is maintained. Delinea logs all access, changes, and activities for forensic review. Real-time alerts respond to identity-related threats, while the platform maintains audit trails required for regulatory compliance (GDPR, NIST, SOC 2, PCI-DSS). Session recording and behavioral analytics enable retrospective analysis. This phase feeds insights back into Discovery — completing the DART cycle and enabling continuous improvement over time.

📼
Session Recording
Every privileged session is recorded — keystrokes, screen capture, and command logs. Enables forensic replay and behavioral analysis for anomaly detection.
🔔
Real-Time Alerts
Instant notification on policy changes, anomalous access patterns, new high-risk entitlements, or dormant accounts suddenly becoming active.
📜
Compliance Audit Trail
Immutable log of who accessed what, when, from where — with manager approval records for every access review decision. Ready for GDPR, NIST, and SOC 2 auditors.
🔄
Cycle Feedback → Discovery
Track/Audit insights — new identities detected via session logs, drift from certified baselines — automatically queue new Discovery scans, restarting the DART cycle.
DART · TRACK — AUDIT LOG (SAMPLE) LIVE
Today 14:32:07 UTC
Policy right-sized: ci-deploy-prod · iam:* removed, scoped ECR+S3 applied · Change ID: #CID-8821
delinea-ciem
Today 14:30:11 UTC
Access review approved: ci-deploy-prod right-size decision by j.torres@corp.com
j.torres
Today 12:14:55 UTC
Access review initiated: john.smith · AmazonEC2FullAccess · Assigned to m.patel@corp.com · Deadline: 7 days
delinea-itdr
Today 08:01:30 UTC
Discovery scan completed: 2,847 identities, 312 risks, 28 critical · AWS + Azure + GCP
system
Yesterday 17:22:44 UTC
Alert triggered: Dormant service account legacy-etl-sa made 14 API calls to s3:GetObject on prod-data-store
alert-engine
Yesterday 16:45:02 UTC
Certification recorded: analytics-reader Blob Data Owner — justification: "Needed for Q4 data lake migration" · Re-review scheduled: 90 days
k.wong (mgr)
Yesterday 09:00:00 UTC
Credential rotation enforced: reporting-bot migrated to Azure Managed Identity — password auth disabled
delinea-ciem

📊 Compliance Frameworks Covered

GDPR — Access logs and data-access audit trails for data subject requests. NIST 800-53 — AC-2 Account Management, AU-2 Audit Events. SOC 2 Type II — Continuous evidence collection. PCI-DSS — Privileged access logging for cardholder data environments. HIPAA — PHI access audit records.

🔄 Feeding Back into Discovery

Track/Audit insights that trigger new Discovery scans: new identities detected in session recordings that weren't in the last scan, entitlements drifting from certified baselines, dormant accounts reactivating unexpectedly, and new cloud accounts or subscriptions provisioned outside normal IaC pipelines.

THE DART CYCLE — CONTINUOUS IDENTITY SECURITY
D
DISCOVERY
Scan identities
→
A
ANALYZE
Score risks
→
R
REMEDIATE
Fix & enforce
→
T
TRACK/AUDIT
Monitor & log
↺
Track/Audit feeds insights back into Discovery — the cycle repeats continuously, with each iteration producing a smaller attack surface.
🧠
Knowledge Check · T — Track / Audit
DART PHASE 4 ASSESSMENT
A manager certifies that an analyst needs Storage Blob Data Owner for a project. What does the DART Track/Audit phase do with this decision?
A The finding is permanently closed — certification decisions cannot be revisited in DART.
B The certification with its business justification is recorded in the immutable audit trail. A re-review is auto-scheduled for 90 days. If a new risk finding triggers on this identity before then, the manager is re-notified — the DART cycle ensures no certified access escapes ongoing oversight.
C Delinea removes the permission anyway, since the least-privilege principle overrides manager approval in the DART method.
D The audit trail records the decision but no follow-up action is taken until the next annual review.