Almost all modern smart technology regardless of industry or applicability has some form of an identity today. We are not talking about just your username (person), but your iPhone, to your Alexa, to your web enabled refrigerator; they all have an identity, and they are all potential targets for a cybersecurity attack. Without an identity you can't see it, you can’t enable it, and you can’t protect it. The processes and technology for managing identities and their lifecycle is called Identity and access management (IAM) and it’s essential if not critical to guarding against cybersecurity attacks.
Let’s look at the Equifax breach for instance. If Equifax had a formal privileged account access audit process and technology in place in addition to a robust review process of their privileged identities, they would have determined that the account used by the struts framework had elevated account privileges (access to databases and admin rights). This would have prompted for strict cybersecurity rules and monitoring of that sensitive account. With the lack of these privileged account management controls, It was a matter of “when” and not “if” a breach was going to occur.
As all three can at times be tightly integrated together they make both potential entry points and targets for a cybersecurity breach. Identities represent a mission critical resource for any organization, especially those that include all three identity types, like a retailer, bank, hospital or university. The growth of more internet enabled objects increases the risk of a breach if they are not properly protected in an organization or home, especially if they are connected to databases or data holding consumer or workforce identities.
In order to protect against cybersecurity breaches such as Equifax, organizations must significantly increase their cybersecurity discipline and best practices of managing all their identity types. Current infrastructure and IAM technology will need to be modernized in order to add support for IDoT objects as they grow and increase the awareness in an organization of the importance of IAM and IGA. In addition the processing time of editing roles and identities must also go down from days to minutes to be able to manage changes that can become potential breach entry points; such as changes due to lost credentials, lost devices, or unmanaged privileged accounts such as in the Equifax breach.
Aldo Pietropaolo is a cybersecurity evangelist, identity security expert, and co-founder of Good Dog Labs, A Lighthouse Company. Good Dog Labs, modernizes identity and access management and governance for SMB’s and large enterprises using advisory and implementation services in addition to bringing new innovative products such as Perseus IAM (www.perseusiam.com) to market.