Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

4/20/2021
01:00 PM
Arthur Coviello
Arthur Coviello
Commentary
50%
50%

2020 Changed Identity Forever; What's Next?

For all the chaos the pandemic caused, it also sparked awareness of how important an identity-centric approach is to securing today's organizations.

Nearly overnight, the COVID-19 pandemic left business leaders in 2020 scrambling to support a workforce that had suddenly gone almost entirely remote. Simultaneously, as the number of telecommuters grew, so did cloud spending, which accelerated two of the last decade's leading technology trends. Underpinning it all was the ability to provide secure identity and access management (IAM).

Identity and access management reemerged as a strategic focus during the pandemic because it is a natural outgrowth of cloud adoption, an increasingly remote workforce, and the disappearance of the traditional network perimeter. With many workers operating entirely out of the office, the ability to securely utilize cloud solutions was even more critical than it had been previously — making protecting and proving user identity at the front end paramount.

Related Content:

You've Got Cloud Security All Wrong: Managing Identity in a Cloud World

Special Report: How Data Breaches Affect the Enterprise

New From The Edge: 9 Modern-Day Best Practices for Log Management

But the quarantine also exposed just how central IAM systems are to digital transformation. IAM provides the assurance and trust that users, systems, and applications need for technology initiatives that drive the business. For all the chaos it caused IT operations, the pandemic also sparked more awareness of how important an identity-centric approach is to securing today's organizations.

And there are still identity challenges that need to be solved. The ecosystem of human and non-human worker or "entity" identities that require secure access to corporate networks is growing. Beyond employees, there are third-party users such as partners, vendors, and contractors that need access to data and systems, including privileged access. But this opens up its own set of risks. As an example, look no further than the breach General Electric experienced last year, in which an attack on one of its service providers exposed personal information belonging to then-current and former employees.

Many organizations, unfortunately, are still behind when it comes to the basics of securing identities. In a survey of IT security and identity decision-makers in 2020, 79% of participants told the Identity Defined Security Alliance (IDSA) that they had experienced an identity-related breach during the previous two years. Less than half, however, had fully implemented any of the key technologies and practices necessary to achieve the identity-related security outcomes advocated by IDSA, such as requiring multifactor authentication for privileged access and applying the principle of least privilege.

The technical piece is only one aspect of the challenge, however. In the same IDSA study, many of the surveyed organizations had made organizational changes to the ownership of identity management during the past five years. Most of these changes were made to align the risk and identity functions more effectively. Decisions about access controls, privileged accounts, and the provisioning and deprovisioning of users cannot be made in silos. That's why facilitating collaboration between the identity and risk functions within an organization has to be a top priority.

In a way, it is similar to the conflict that often exists between security and DevOps. I like to joke that developers throw the party, and security ops people wake up with the hangover. Striking the right balance between different parts of IT is a business necessity, yet harmony still eludes many of us. If there is one goal all of IT should have for 2021, it should be to recognize the symbiotic relationship between security and the rest of IT. It is a cliché (but true nonetheless) that security should be an enabler, not a stop sign, and the organizations that best apply that idea will have the operational agility needed to deal with the challenges ahead.

One final thought on the importance of protecting identity: the controversy of the 2020 US presidential election highlighted the role social media can play in shaping public opinions. The importance of closely controlling the identity related to social media accounts will continue to be an important part of protecting a company's online reputation. This is not just about controversial political opinions; it is also about guarding against account hijacking and other actions that could lead to the spread of misinformation that is damaging to the company.

In the end, implementing effective security in today's modern business and IT environments involves a mix of tools, processes, and people — just like in the past. But it does all start with who or what is getting access and from where. Hopefully, we can all build on the lessons we learned from our experiences in 2020 to grow the effectiveness of our IAM systems.

Mr. Coviello is a venture partner at Rally Ventures, LLC, a position he has held since May 2015. From February 2011 to February 2015, Mr. Coviello served as executive chairman of RSA Security LLC. Mr. Coviello has served on the boards of directors of Synchrony Financial since ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Tim Sadler, CEO and co-founder of Tessian,  6/17/2021
Edge-DRsplash-10-edge-articles
7 Powerful Cybersecurity Skills the Energy Sector Needs Most
Pam Baker, Contributing Writer,  6/22/2021
News
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-2322
PUBLISHED: 2021-06-23
Vulnerability in OpenGrok (component: Web App). Versions that are affected are 1.6.7 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise OpenGrok. Successful attacks of this vulnerability can result in takeover of OpenGrok. CVSS 3.1 ...
CVE-2021-20019
PUBLISHED: 2021-06-23
A vulnerability in SonicOS where the HTTP server response leaks partial memory by sending a crafted HTTP request, this can potentially lead to an internal sensitive data disclosure vulnerability.
CVE-2021-21809
PUBLISHED: 2021-06-23
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.
CVE-2021-34067
PUBLISHED: 2021-06-23
Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file.
CVE-2021-34068
PUBLISHED: 2021-06-23
Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file.