Applying Attack Path Management to Identity Security