Connecting Legacy Systems to Identity Management: Lessons from the TU Munich Attack

What We Know About the TU Munich Attack

After the cyber attack, TUM took its central campus system offline. The attackers began by stealing credentials. TUM believes they were mainly after administrator passwords, giving them access to TUMonline, the central system for students, staff, courses, and exams.

The investigation into how much data was taken and exactly how the attack unfolded is still ongoing. For the lessons learned, though, those details matter less than the pattern: A poorly secured legacy system exposed privileged credentials, and those credentials opened the door to a business-critical core system.

This pattern is far from unique, as ENISA’s Threat Landscape 2026 report also shows: Attackers increasingly try to take over legitimate identities. Once they control privileged accounts, they move laterally through the infrastructure, from system to system. Attackers look for the weakest link, and in long-established IT landscapes, that is often the oldest system.

Why Legacy Systems Become a Security Risk

IT landscapes that have grown over many years are rarely replaced all at once. Custom-built applications, specialized software, and legacy systems often remain business-critical for a long time because they support processes for which no off-the-shelf replacement exists. Replacing them is costly, risky, and resource-intensive.

That is why the same vulnerabilities tend to show up there:

• Siloed User Management: Accounts are created locally within the application, often manually and disconnected from central processes.

• Orphaned Accounts: People who leave the company or change roles keep their accounts and permissions, because the legacy system isn’t part of any offboarding process.

• Shared and Weak Admin Credentials: Technical and admin accounts are rarely documented, and their passwords rarely change.

• Lack of Transparency: Nobody can tell who has which permissions or why, which makes audits and compliance reporting difficult.

• No Modern Authentication: Multi-factor authentication or single sign-on can’t easily be added.

As a result, these systems fall outside the security strategy, even though they often have access to sensitive data or core services. That makes them attractive targets. Common entry points, such as broken access control, misconfigurations, or weak authentication, are well-known vulnerabilities that clear processes and the right controls can address.

Identity Management Is Only as Good as Its Connectivity

An identity & access management (IAM) system can only manage identities and permissions in the systems it is connected to. Connectivity is therefore not a technical detail but a prerequisite for effective access control.

Connecting a legacy system makes it possible to manage the full identity lifecycle there as well:

• Joiner: Accounts are created automatically and assigned roles and permissions, instead of via tickets or email.

• Mover: Permissions that are no longer needed in the new role are removed, and new ones are added as required.

• Leaver: Accounts are locked or deactivated promptly and permissions revoked, even in the last specialized system.

• Privileged Accounts: Admin rights are known, justified, time-limited, and reviewable.

• Recertification and Audit: Business units regularly confirm who needs which permissions, and the evidence is stored centrally.

The benefit is twofold. The risk of attack drops, because there are fewer forgotten and over-privileged accounts. And if something does happen, it is easy to quickly establish which accounts were affected and what permissions they had.

Connecting Heterogeneous IT Landscapes: Integration Options with Garancy

No two IT landscapes are alike. Whether it’s a cloud service, off-the-shelf software, or a decades-old in-house application, target systems vary widely in technology and interfaces, so a single integration method isn’t enough. Garancy offers several options, which can be combined:

An interface alone isn’t identity management. Only when integration, processes, and control work together can accounts and permissions be managed consistently, legacy systems included. Permissions are granted centrally, adjusted automatically, and revoked when necessary, and accounts are locked or deactivated. None of this requires modernizing the legacy system itself.

• Centralized Control: Identities, accounts, groups, and permissions are managed in one place, regardless of the target system they apply to.

• Automated Provisioning: Accounts are created, modified, or locked, including group memberships and roles.

• Secure Integration: Communication is encrypted, and password management and help desk functions are integrated.

• Ongoing Reconciliation: Garancy compares the desired state with the actual state in the target system in both directions. Deviations become visible immediately.

New applications, cloud services, or in-house systems can be added later without rebuilding existing processes.

A pragmatic way to get started is to connect the systems with the highest risk and the most sensitive data first, especially those with privileged accounts. The remaining applications can follow step by step.

Conclusion: Systems Can Be Old, but Their Access Management Shouldn’t Be

The cyber attack on TU Munich shows how a legacy system can become a stepping stone. Whether it’s a university, a mid-sized company, or a large enterprise, any organization that excludes legacy systems from access control leaves a gap open for cyber threats and attackers.

The solution isn’t necessarily to replace every legacy system right away, but to bring them into central identity management. That requires connectivity: standard connectors, open interfaces, and custom integrations. With these in place, accounts and permissions can be managed centrally even in legacy systems, with permissions adjusted or revoked automatically and accounts locked when needed.

Want to know how your existing systems can be connected to Garancy? Get in touch. We’ll analyze your system landscape with you and show you which integration options fit.