.svg)
.svg)
As an IAM SaaS company, our work often remains in the shadows—until something goes wrong. Today, I want to shed light on how we handle security at the very first layer all IAM systems have: the login page. Specifically, I’ll walk you through an incident we managed at Cloud-IAM, where we provide a managed Keycloak solution, and share some insights on securing authentication systems against evolving DDoS threats.
Many of our clients are tech enthusiasts and small companies that want to avoid the complexity of configuring and maintaining Keycloak. Our larger clients, on the other hand, demand resilience. However, resilience is often measured in terms of Monthly Active Users (MAUs), without fully considering the exposure of their service.
For example, take two hypothetical companies:
Despite Company A having more MAUs, Company B is likely more exposed to attacks because of the nature of its infrastructure. This exposure factor is rarely accounted for but plays a critical role in IAM security.
Attackers exploit the same logic and processes as normal users, making them difficult to detect. The more information they have, the better they can impersonate real users and bypass detection systems. Many companies rely on Load balancer rate limiting or Low Level Firewall, both of which are great initial defenses. However, attackers have evolved beyond these measures.
At Cloud-IAM, we take a multi-layered approach to attack mitigation:
All our clients operate with two distinct lifecycles:
One of our clients, a widely used SaaS platform, regularly experiences DDoS attacks due to its high exposure and millions of MAUs. In this particular case, the client had a specific IP restriction policy that influenced how the attack unfolded.
A major challenge for this client is that they demand to scale up their infrastructure in advance to handle high user loads efficiently. This means they anticipate peak demand and adjust their infrastructure capacity before the load arrives. For instance, before major events like an SSO update, they anticipate and prepare for 1 million users reconnecting within a short window. While this improves user experience, it also complicates attack detection, as malicious traffic can blend with legitimate user activity, making it significantly harder to distinguish between normal behavior and an attack.
This operational complexity required a highly tailored security response.
Analyzing the attackers' strategy, we observed a shift in their approach across phases. Initially, in Phase 1, they experimented with limited but targeted attempts. In Phase 2, they believed that overwhelming the system with a high number of requests (8,000 per minute) would break through defenses. However, this only led to rapid bans.
By Phase 3, they changed their strategy, opting for a prolonged attack rather than an intense burst. Even though the request rate dropped to 2,500 per minute, the total number of requests in this phase was significantly higher due to the 12-hour sustained attack.
This shift is evident in the following visualizations:
Our goal isn’t to become a full-fledged Security Information and Event Management (SIEM) system, but to integrate smarter protections. We’re currently developing an AI-driven tool that dynamically adjusts security rules based on user prompts, allowing for:
IAM security isn’t just about stopping attackers—it’s about learning, adapting, and empowering. The attack we faced in January reinforced that traditional defenses aren’t enough. A layered, context-aware approach is critical for modern IAM systems, especially in high-exposure environments.
At Cloud-IAM, we take pride in our resilience, but security is an ever-evolving challenge. We continuously refine our defenses, learning step by step from every incident. There is always room for improvement, and we remain humble in our commitment to staying ahead of emerging threats.
If you believe there are areas where we can improve or if you want to strengthen your own system’s security, don’t hesitate to reach out. We’re always open to collaboration and new insights.
If you manage an IAM service, consider: How well are you protecting your login page?
