The top identity-based attacks and how to stop them