Identity Management Day: Experts Outline Best Practices To Secure Online Identities

In the past few years, hackers have upped their game considerably, deploying a variety of sophisticated tools and techniques to get past organizations’ IT defences, crack open secured accounts and servers, exfiltrate sensitive data back to their own servers, and encrypt business-critical data to blackmail organizations to part with huge sums of money.

In recent years, nation-states have delved into the world of cyber crime to settle scores with their foes, investing massive resources to nurture sophisticated APT groups and using them to target governments, the defense sector, and critical infrastructure organizations to paralyse these sectors and create widespread chaos. Hackers have gone to the extent of stealing advanced hacking tools from the NSA and using them to target cash-rich organizations that are not equipped to deal with such threats.

One of the most common attack vectors used by well-resourced hacker groups to infiltrate IT networks is the targeting and hijacking of accounts that enjoy privileged access to internal resources. Once breached, these accounts leave organizations wide open to large-scale data theft, cyber espionage, and malware attacks that cripple operations and cause huge financial and reputational loss.  Despite the emergence of such threats, Keyfactor recently found that 60% of organizations lack policies to govern, manage, and automate machine credentials.

On Identity Management Day, experts from the cybersecurity industry shared their insights with Toolbox on the cyber threats that result from weak identity protections, and how organizations can prevent credential-related breaches by prioritizing privileged access management, implementing passwordless authentication processes, and training employees on how to keep their corporate accounts secure at all times.

Learn More: Top 10 Customer Identity Management Solutions in 2021

Ensuring Identity Management in the Remote Work Era

Greg KellerOpens a new window , CTO, JumpCloud

“In a phrase: Remote work. The biggest challenge facing our customers is properly securing their employees as they shift – many permanently – to home office and remote work. Given this model, the concept of a traditional ‘domain’ has essentially imploded, leaving IT and security professionals scrambling to ensure their employees’ devices are secure, that they are the only devices allowed access to corporate resources, and that users accessing those same resources really are who they say they are. At a minimum, IT must ensure their MFA game is strong and establish an identity management system that has no prerequisites to being on-premises any longer. Those days are gone.” 

Jerome BecquartOpens a new window , COO, Axiad

“As the number of remote users and devices on company networks increases, many customers are searching for a passwordless solution to protect them against the threats of today and tomorrow. However, there’s currently no one credential that can authenticate all business use cases. Our customers are finding themselves adopting multiple identity credentials to meet all use cases, such as YubiKeys, smart cards, TPM, mobile authenticators, and more. This can strain their IT resources and is complex for their end users to manage and keep track of. 

“We advise customers to stop managing their credentials in silos. They can instead use one credential management platform to manage all their identity credentials. This streamlines deployment and lifecycle management for IT teams and simplifies the user experience. By taking a holistic approach to identity management, businesses can accelerate their journey to passwordless and ensure identity security for all their users and devices.”

Dan DeMicheleOpens a new window , VP of Product, LastPass by LogMeIn

“Since remote and hybrid work has become the new norm, the threat surface has exponentially expanded, and organizations’ IT departments are facing new security challenges. The biggest challenge our customers face is that regardless of their size, they’re increasingly targeted by hackers looking to get their hands-on personal data and intellectual property. 

“In order to maintain a high level of security, IT managers have to focus on securing the identity of the user, as it is the new security perimeter. To do this, IT managers should implement solutions like enterprise password management, single-sign-on, and multifactor authentication solutions that will provide visibility into user behaviors across apps and devices, keeping remote employees and company networks secure. 

“Perimeter security is bolstered when these technologies work together under one umbrella. With these solutions in place, IT can quickly deploy tools, enable authentication methods, and set security policies while providing end users easy access to the tools they need to get work done. Both administrators and end users are enabled to seamlessly carry out their day-to-day work and responsibilities.”

Learn More: How to Secure Online Identities With Passwordless Authentication

Investing in Zero Trust, ML-Based Behavioral Analytics, and Centralization

Art GillilandOpens a new window , CEO, Centrify

“In the last year, 90% of cyberattacks on cloud environments leveraged compromised privileged credentials. This alarming finding illustrates how cyber-attackers are easily accessing critical systems and sensitive data through improperly managed credentials — and leveraging identity sprawl across a threatscape expanded by digital transformation. 

“The reality is that these adversaries no longer ‘hack’ in – they log in, using stolen identities and weak or default credentials. Identity Management Day not only reinforces the need for good cyber-hygiene but also to use technology solutions available to vault, authenticate, manage, and secure privileged identities and access. 

“Modern privileged access management (PAM) solutions based on Zero Trust principles can minimize shared accounts and allow human and machine identities to log in as themselves. These tools should automate privileged access controls, reduce administrative risk, and strengthen compliance postures to protect the keys to the kingdom.”

Ralph PisaniOpens a new window , President, Exabeam

“Billions of previously stolen credentials live on the dark web, and we’ve just accepted that they fuel the underground economy and enable more credential stuffing attacks. We know that the hackers are bold and unconcerned with being detected on the network because they use sophisticated methods that mimic typical user activity. If their access is gained using valid credentials, it makes them even more difficult for administrators to catch.

“To prevent credential-based attacks from continuing, organizations across industries can invest in machine learning-based behavioral analytics solutions to help detect malicious activity. These analytics tools can immediately flag when a legitimate user account is exhibiting anomalous behavior, providing greater insights to SOC analysts about both the compromised and the malicious user, which results in a faster response time.”

Carlos GarciaOpens a new window , Optum Sr. Principal Architect, Enterprise Clinical Technology – Genomics

“I think the biggest challenges remain the fundamentals. So many organizations are still trying to implement provisioning and attestation beyond the core major identity systems like their AD and HR systems. I think great technologies like SAML, when used within an enterprise are great for integrating applications especially after acquisitions, but often become band-aides that mask the underlying issues of dispersed identity silos. 

“The hard work is getting all these systems centralized or at least well managed through best practices around governance and especially deprovisioning. This is an endless challenge with large enterprises that do many small acquisitions a year.  Many times the challenge becomes the cost of integrating acquired entities if your systems are too inflexible. 

“In addition, as multi-cloud adoption grows, managing all those identities and especially the governance around what authorization they have is a big challenge. The business wants to move faster than you have time to create new policies, so thinking ahead of the business challenges coming is important.”

What do you think is the best approach to secure digital identities in our organization? Comment below or let us know on LinkedInOpens a new window , TwitterOpens a new window , or FacebookOpens a new window . We’d love to hear from you!