Cyber Defense eMagazine July Edition for 2022

Poor Identity Management Amplifies Ransomware
By David Mahdi, Chief Strategy Officer and CISO Advisor, Sectigo
While ransomware is malware, security leaders must go beyond legacy anti-malware approaches to
mitigate risk. Ransomware is a data-centric threat; that is, ransomware preys on corporate data. Cunning
and successful ransomware attacks hijack user access with an aim to encrypt sensitive files, stealing
data. So, if ransomware is all about the data and the hijacking of user access to get to the data, then the
more data a user can access, the more attractive target the user is for the attacker.
Ransomware is a multi-faceted cybersecurity issue, and best practice dictates using email security and
antivirus, in addition to other tools to fend it off. Indeed, while these are good best practices, IT leaders
need to undergo a crucial perspective change when it comes to ransomware and understand it isn’t solely
a traditional malware problem. Bad actors want access to data, and they gain access by compromising
user accounts, or in other words, by compromising the identity layer of an organization. Without
considering the importance of identity and data access, organizations will remain vulnerable to attack.
Yet, organizations and security leaders can’t simply lock down identity and data access to prevent
ransomware. Typically, IT departments tend to over privilege users to avoid interrupting business. While
this approach generally helps day-to-day operations, it’s also precisely what allows bad actors who
breach the perimeter to run amok throughout the environment. If a highly privileged user and their
associated accounts have a lot of access, when compromised, the amount of damage could be
catastrophic. Focusing on identity and data security in terms of right-sized access will significantly reduce
the attack surface for many threats, including ransomware.
With that in mind, enterprises must focus on establishing and maintaining trust for every single identity in
their environment, both human and machine (software, bots, devices, applications, etc.). Otherwise
known as identity-first security, the aim is to mitigate the damage from identity and data-centric attacks,
such as ransomware.
Cyber Defense eMagazine – July 2022 Edition 113
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.