Identity and attack paths - can you stop hackers getting from A to B?

Attackers use identities to get across networks. How can you secure those identity attack paths first?