Cyber Defense eMagazine July Edition for 2022

The Danger of Poor Identity Security
Systems are growing ever more complex, and as that complexity increases visibility becomes more
difficult. While many businesses had already been undergoing digital transformations, the past two years
have accelerated the trend significantly—particularly as it applies to identity security. With remote work
as the norm, new users and devices now need to access corporate networks from unfamiliar places every
day. IT teams also need to grapple with securing the new applications that employees need to function
remotely, such as Slack and Zoom. And of course, use of the cloud continues to expand, adding entirely
new infrastructure and applications to the mix.
As the complexity of IT environments grows, so too does the potential threat surface. Users might need
to access data across multiple servers, cloud environments, file sharing applications, and other locations.
In an organization with hundreds or thousands of employees, determining access rights and privileges
for each individual user can seem like an incredibly daunting task, especially when business operations
are taken into account. And here’s the real issue: no IT team wants to be seen as a roadblock to
productivity. This is the core of the problem that leads to overprovisioning. It is easier to grant more
access than necessary than it is to field access requests on a case-by-case basis. This makes it
challenging to manually govern identities at scale.
Unfortunately, overprovisioning can have negative consequences. If our old friend the chef has a keycard
that opens the door to the war room, anyone with access to that keycard could throw on an apron, grab
a sandwich platter, and make off with top secret intelligence. In an enterprise IT environment, it’s much
the same. Should software developers have access to human resources files? Should the public relations
team be able to approve purchase orders? When employees have outsized access levels, it opens the
door to chaos. Anyone can be tricked into giving away their password—it happens every day. But
compromising an administrative assistant’s identity should not allow an intruder to access financial
records or personal information. No individual identity should give an attacker the keys to the castle.
No “Set It and Forget It” for Identity Security
I was a CISO fifteen years ago when I first heard Mandiant CEO Kevin Mandia say that compromise was
inevitable, and that smart companies should focus on preparation, detection, and response instead of
assuming that prevention will work. Even though it’s been 15 years—and “compromise is inevitable” is
no longer even controversial—it seems like most of today’s security tools focus primarily on stopping or
preventing attacks, rather than mitigating their potential impact. Shifting the focus to mitigation represents
a change in philosophy, but one that will have positive results for businesses. This isn’t to say that
preventative tools are not necessary—they absolutely are—but that they can be used most effectively in
conjunction with tools that help lessen the impact of those attacks that slip through the cracks.
Given that 61% of breaches today involve credential data, that process starts with ensuring that individual
identities have access only to the data and areas of the network they need access to. That means that if
a marketing employee falls victim to a phishing email, some marketing data might be compromised—but
the attacker won’t be able to access payment information or personnel files.
Cyber Defense eMagazine – July 2022 Edition 220
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.