- For new digital business models to succeed, customers’ privacy preferences need to be secure, and that begins by treating every identity as a new security perimeter.
- Organisations need to recognise that perimeter-based security, which focuses on securing endpoints, firewalls, and networks, provides no protection against identity and credential-based threats. Until they start implementing identity-centric security measures, account compromise attacks will continue to provide a perfect camouflage for data breaches.
- 74% of data breaches start with privileged credential abuse that could have been averted if the organisations had adopted a privileged access management (PAM) strategy, according to a recent Centrify survey.
- Just 48% of organisations have a password vault, and only 21% have multi-factor authentication (MFA) implemented for privileged administrative access.
New digital business models are redefining organisations’ growth trajectories and enabling startups to thrive, all driven by customer trust. Gaining and strengthening customer trust starts with a security strategy that can scale quickly to secure every identity and threat surface a new business model creates.
Centrify’s recent survey, Privileged Access Management in the Modern Threatscape, found 74% of data breaches begin with privileged credential abuse. The survey also found that the most important areas of IT infrastructure that new digital business models rely on to succeed — including big data repositories, cloud platform access, containers, and DevOps — are among the most vulnerable. The most urgent challenges executives are facing include protecting their business, securing customer data, and finding new ways to add value to their business’ operations.
Why executives need to know about identity and access management now
Executives have a strong sense of urgency to improve identity and access management (IAM) today to assure the right individuals access the right resources at the right times and for the right reasons.
IAM components like access management, single sign-on, customer identity and access management (CIAM), advanced authentication, identity governance and administration (IGA), IoT-driven IAM, and privileged access management address the need to ensure appropriate access to resources across an organisation’s entire attack surface and to meet compliance requirements.
Considering that privileged access abuse is the leading cause of today’s breaches, they’re especially prioritising privileged account management as part of their broader cybersecurity strategies to secure the “keys to their kingdom.” Gartner supports this view by placing a high priority on privileged account management, including it in its Gartner Top 10 Security Projects for 2018, and again in 2019.
During a recent conversation with insurance and financial services executives, I learned why privileged access management is such an urgent, high priority today. Privileged access abuse is the leading attack vector, where they see the majority of breach attempts to access the company’s most sensitive systems and data. It’s also where they can improve customer data security while also making employees more productive by giving them access systems and platforms faster. All of them know instances of hackers and state-sponsored hacking groups offering bitcoin payments in exchange for administrative-level logins and passwords to their financial systems.
Several of the executives I spoke with are also evaluating Zero Trust as the foundation for their cybersecurity strategy. As their new digital business models grow, all of them are focused on discarding the outdated, “trust, but verify” mindset and replacing it with Zero Trust, which mandates a “never trust, always verify” approach. They’re also using a least privilege access approach to minimise each attack surface and improve audit and compliance visibility while reducing risk, complexity, and costs.
The following are the five things every executive needs to know about identity and access management to address a reality that every company and consumer must recognise exists today. Attackers no longer “hack” in, they log in.
Designing in the ability to manage access rights and all digital identities of privileged users require privileged access management (PAM) and identity governance and administration (IGA) systems be integrated as part of an IAM strategy
For digital business initiatives’ security strategies to scale, they need to support access requests, entitlement management, and user credential attestation for governance purposes. With identities being the new security perimeter, provisioning least privileged access to suppliers, distributors, and service organisations is also a must-have to scale any new business model. Natively, IGA is dealing only with end users – not privileged users. Therefore integration with PAM systems is required to bring in privileged user data and gain a holistic view of access entitlements.
IAM is a proven approach to securing valuable Intellectual Property (IP), patents, and attaining regulatory compliance, including GDPR
The fascinating digital businesses emerging today also function as patent and IP foundries. A byproduct of their operations is an entirely new business, product and process ideas. Executives spoken with are prioritising how they secure intellectual property and patents using an Identity and Access Management strategy.
Knowing with confidence the identity of every user is what makes every aspect of an IAM strategy work
Having multi-factor authentication (MFA) enabled for every access session, and threat surface is one of the main processes that make an IAM strategy succeed. It’s a best practice to reinforce Zero Trust principles through multi-factor authentication enforcement on each computer that cannot be circumvented (or bypassed) by malware.
Designing in transaction verification now for future eCommerce digital business models is worth it
Think of your IAM initiative as a platform to create ongoing customer trust with. As all digital business initiatives rely on multi-channel selling, designing in transaction verification as part of an IAM strategy is essential. Organisations are combining verification and MFA to thwart breaches and the abuse of credential access abuse.
In defining any IAM strategy focus on how privileged access management (PAM) needs to be tailored to your specific business needs
PAM is the foundational element that turns the investments made in security into business value. It’s a catalyst for ensuring customer trust turns into revenue. Many organisations equate PAM with a password vault.
But in a modern threatscape where humans, machines, applications, and services dynamically require access to a broadening range of attack surfaces such as cloud, IoT, big data, and containers, that outdated legacy approach won’t effectively secure the leading attack vector: privileged access abuse. Vendors such as Centrify and others are looking beyond the vault and offering Zero Trust solutions for PAM that address these modern access requestors and attack surfaces.
Conclusion
Insurance and financial services executives realise, and even predict, that there’s going to be an increase in the number and intensity of efforts to break into their systems using compromised credentials. Prioritising privileged access management as part of the IAM toolkit is proving to be an effective cybersecurity strategy for protecting their businesses and customers’ data while also making a valuable contribution to its growth.
The bottom line is that identity and access management is the cornerstone of any effective Zero Trust-based strategy, and taking an aggressive, pre-emptive approach to privileged access management is the new normal for organisations’ cybersecurity strategies.
Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.