Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


01:00 PM
Arthur Coviello
Arthur Coviello

2020 Changed Identity Forever; What's Next?

For all the chaos the pandemic caused, it also sparked awareness of how important an identity-centric approach is to securing today's organizations.

Nearly overnight, the COVID-19 pandemic left business leaders in 2020 scrambling to support a workforce that had suddenly gone almost entirely remote. Simultaneously, as the number of telecommuters grew, so did cloud spending, which accelerated two of the last decade's leading technology trends. Underpinning it all was the ability to provide secure identity and access management (IAM).

Identity and access management reemerged as a strategic focus during the pandemic because it is a natural outgrowth of cloud adoption, an increasingly remote workforce, and the disappearance of the traditional network perimeter. With many workers operating entirely out of the office, the ability to securely utilize cloud solutions was even more critical than it had been previously — making protecting and proving user identity at the front end paramount.

Related Content:

You've Got Cloud Security All Wrong: Managing Identity in a Cloud World

Special Report: How Data Breaches Affect the Enterprise

New From The Edge: 9 Modern-Day Best Practices for Log Management

But the quarantine also exposed just how central IAM systems are to digital transformation. IAM provides the assurance and trust that users, systems, and applications need for technology initiatives that drive the business. For all the chaos it caused IT operations, the pandemic also sparked more awareness of how important an identity-centric approach is to securing today's organizations.

And there are still identity challenges that need to be solved. The ecosystem of human and non-human worker or "entity" identities that require secure access to corporate networks is growing. Beyond employees, there are third-party users such as partners, vendors, and contractors that need access to data and systems, including privileged access. But this opens up its own set of risks. As an example, look no further than the breach General Electric experienced last year, in which an attack on one of its service providers exposed personal information belonging to then-current and former employees.

Many organizations, unfortunately, are still behind when it comes to the basics of securing identities. In a survey of IT security and identity decision-makers in 2020, 79% of participants told the Identity Defined Security Alliance (IDSA) that they had experienced an identity-related breach during the previous two years. Less than half, however, had fully implemented any of the key technologies and practices necessary to achieve the identity-related security outcomes advocated by IDSA, such as requiring multifactor authentication for privileged access and applying the principle of least privilege.

The technical piece is only one aspect of the challenge, however. In the same IDSA study, many of the surveyed organizations had made organizational changes to the ownership of identity management during the past five years. Most of these changes were made to align the risk and identity functions more effectively. Decisions about access controls, privileged accounts, and the provisioning and deprovisioning of users cannot be made in silos. That's why facilitating collaboration between the identity and risk functions within an organization has to be a top priority.

In a way, it is similar to the conflict that often exists between security and DevOps. I like to joke that developers throw the party, and security ops people wake up with the hangover. Striking the right balance between different parts of IT is a business necessity, yet harmony still eludes many of us. If there is one goal all of IT should have for 2021, it should be to recognize the symbiotic relationship between security and the rest of IT. It is a cliché (but true nonetheless) that security should be an enabler, not a stop sign, and the organizations that best apply that idea will have the operational agility needed to deal with the challenges ahead.

One final thought on the importance of protecting identity: the controversy of the 2020 US presidential election highlighted the role social media can play in shaping public opinions. The importance of closely controlling the identity related to social media accounts will continue to be an important part of protecting a company's online reputation. This is not just about controversial political opinions; it is also about guarding against account hijacking and other actions that could lead to the spread of misinformation that is damaging to the company.

In the end, implementing effective security in today's modern business and IT environments involves a mix of tools, processes, and people — just like in the past. But it does all start with who or what is getting access and from where. Hopefully, we can all build on the lessons we learned from our experiences in 2020 to grow the effectiveness of our IAM systems.

Mr. Coviello is a venture partner at Rally Ventures, LLC, a position he has held since May 2015. From February 2011 to February 2015, Mr. Coviello served as executive chairman of RSA Security LLC. Mr. Coviello has served on the boards of directors of Synchrony Financial since ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-09-20
The Post Views Counter WordPress plugin before 1.3.5 does not sanitise or escape its Post Views Label settings, which could allow high privilege users to perform Cross-Site Scripting attacks in the frontend even when the unfiltered_html capability is disallowed
PUBLISHED: 2021-09-20
The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross-Site Scripting (XSS). Furthermore, the plugin also does not have any CSRF and capability checks in place when saving such setting, allowing any authenticated us...
PUBLISHED: 2021-09-20
The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated users, allowing any authenticated user (such as subscriber) to call them and 1) Get and search through title and content of Draft post, ...
PUBLISHED: 2021-09-20
The Print My Blog WordPress Plugin before 3.4.2 does not enforce nonce (CSRF) checks, which allows attackers to make logged in administrators deactivate the Print My Blog plugin and delete all saved data for that plugin by tricking them to open a malicious link
PUBLISHED: 2021-09-20
The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings, allowing users with as role as low as Contributor to perform Stored Cross-Site Scripting attacks via blockType (combined with content), align, color, variant and fontID argument of a Gu...