Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


// // //

2020 Changed Identity Forever; What's Next?

For all the chaos the pandemic caused, it also sparked awareness of how important an identity-centric approach is to securing today's organizations.

Nearly overnight, the COVID-19 pandemic left business leaders in 2020 scrambling to support a workforce that had suddenly gone almost entirely remote. Simultaneously, as the number of telecommuters grew, so did cloud spending, which accelerated two of the last decade's leading technology trends. Underpinning it all was the ability to provide secure identity and access management (IAM).

Identity and access management reemerged as a strategic focus during the pandemic because it is a natural outgrowth of cloud adoption, an increasingly remote workforce, and the disappearance of the traditional network perimeter. With many workers operating entirely out of the office, the ability to securely utilize cloud solutions was even more critical than it had been previously — making protecting and proving user identity at the front end paramount.

Related Content:

You've Got Cloud Security All Wrong: Managing Identity in a Cloud World

Special Report: How Data Breaches Affect the Enterprise

New From The Edge: 9 Modern-Day Best Practices for Log Management

But the quarantine also exposed just how central IAM systems are to digital transformation. IAM provides the assurance and trust that users, systems, and applications need for technology initiatives that drive the business. For all the chaos it caused IT operations, the pandemic also sparked more awareness of how important an identity-centric approach is to securing today's organizations.

And there are still identity challenges that need to be solved. The ecosystem of human and non-human worker or "entity" identities that require secure access to corporate networks is growing. Beyond employees, there are third-party users such as partners, vendors, and contractors that need access to data and systems, including privileged access. But this opens up its own set of risks. As an example, look no further than the breach General Electric experienced last year, in which an attack on one of its service providers exposed personal information belonging to then-current and former employees.

Many organizations, unfortunately, are still behind when it comes to the basics of securing identities. In a survey of IT security and identity decision-makers in 2020, 79% of participants told the Identity Defined Security Alliance (IDSA) that they had experienced an identity-related breach during the previous two years. Less than half, however, had fully implemented any of the key technologies and practices necessary to achieve the identity-related security outcomes advocated by IDSA, such as requiring multifactor authentication for privileged access and applying the principle of least privilege.

The technical piece is only one aspect of the challenge, however. In the same IDSA study, many of the surveyed organizations had made organizational changes to the ownership of identity management during the past five years. Most of these changes were made to align the risk and identity functions more effectively. Decisions about access controls, privileged accounts, and the provisioning and deprovisioning of users cannot be made in silos. That's why facilitating collaboration between the identity and risk functions within an organization has to be a top priority.

In a way, it is similar to the conflict that often exists between security and DevOps. I like to joke that developers throw the party, and security ops people wake up with the hangover. Striking the right balance between different parts of IT is a business necessity, yet harmony still eludes many of us. If there is one goal all of IT should have for 2021, it should be to recognize the symbiotic relationship between security and the rest of IT. It is a cliché (but true nonetheless) that security should be an enabler, not a stop sign, and the organizations that best apply that idea will have the operational agility needed to deal with the challenges ahead.

One final thought on the importance of protecting identity: the controversy of the 2020 US presidential election highlighted the role social media can play in shaping public opinions. The importance of closely controlling the identity related to social media accounts will continue to be an important part of protecting a company's online reputation. This is not just about controversial political opinions; it is also about guarding against account hijacking and other actions that could lead to the spread of misinformation that is damaging to the company.

In the end, implementing effective security in today's modern business and IT environments involves a mix of tools, processes, and people — just like in the past. But it does all start with who or what is getting access and from where. Hopefully, we can all build on the lessons we learned from our experiences in 2020 to grow the effectiveness of our IAM systems.

Mr. Coviello is a venture partner at Rally Ventures, LLC, a position he has held since May 2015. From February 2011 to February 2015, Mr. Coviello served as executive chairman of RSA Security LLC. Mr. Coviello has served on the boards of directors of Synchrony Financial since ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file