Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


01:00 PM
Arthur Coviello
Arthur Coviello

2020 Changed Identity Forever; What's Next?

For all the chaos the pandemic caused, it also sparked awareness of how important an identity-centric approach is to securing today's organizations.

Nearly overnight, the COVID-19 pandemic left business leaders in 2020 scrambling to support a workforce that had suddenly gone almost entirely remote. Simultaneously, as the number of telecommuters grew, so did cloud spending, which accelerated two of the last decade's leading technology trends. Underpinning it all was the ability to provide secure identity and access management (IAM).

Identity and access management reemerged as a strategic focus during the pandemic because it is a natural outgrowth of cloud adoption, an increasingly remote workforce, and the disappearance of the traditional network perimeter. With many workers operating entirely out of the office, the ability to securely utilize cloud solutions was even more critical than it had been previously — making protecting and proving user identity at the front end paramount.

Related Content:

You've Got Cloud Security All Wrong: Managing Identity in a Cloud World

Special Report: How Data Breaches Affect the Enterprise

New From The Edge: 9 Modern-Day Best Practices for Log Management

But the quarantine also exposed just how central IAM systems are to digital transformation. IAM provides the assurance and trust that users, systems, and applications need for technology initiatives that drive the business. For all the chaos it caused IT operations, the pandemic also sparked more awareness of how important an identity-centric approach is to securing today's organizations.

And there are still identity challenges that need to be solved. The ecosystem of human and non-human worker or "entity" identities that require secure access to corporate networks is growing. Beyond employees, there are third-party users such as partners, vendors, and contractors that need access to data and systems, including privileged access. But this opens up its own set of risks. As an example, look no further than the breach General Electric experienced last year, in which an attack on one of its service providers exposed personal information belonging to then-current and former employees.

Many organizations, unfortunately, are still behind when it comes to the basics of securing identities. In a survey of IT security and identity decision-makers in 2020, 79% of participants told the Identity Defined Security Alliance (IDSA) that they had experienced an identity-related breach during the previous two years. Less than half, however, had fully implemented any of the key technologies and practices necessary to achieve the identity-related security outcomes advocated by IDSA, such as requiring multifactor authentication for privileged access and applying the principle of least privilege.

The technical piece is only one aspect of the challenge, however. In the same IDSA study, many of the surveyed organizations had made organizational changes to the ownership of identity management during the past five years. Most of these changes were made to align the risk and identity functions more effectively. Decisions about access controls, privileged accounts, and the provisioning and deprovisioning of users cannot be made in silos. That's why facilitating collaboration between the identity and risk functions within an organization has to be a top priority.

In a way, it is similar to the conflict that often exists between security and DevOps. I like to joke that developers throw the party, and security ops people wake up with the hangover. Striking the right balance between different parts of IT is a business necessity, yet harmony still eludes many of us. If there is one goal all of IT should have for 2021, it should be to recognize the symbiotic relationship between security and the rest of IT. It is a cliché (but true nonetheless) that security should be an enabler, not a stop sign, and the organizations that best apply that idea will have the operational agility needed to deal with the challenges ahead.

One final thought on the importance of protecting identity: the controversy of the 2020 US presidential election highlighted the role social media can play in shaping public opinions. The importance of closely controlling the identity related to social media accounts will continue to be an important part of protecting a company's online reputation. This is not just about controversial political opinions; it is also about guarding against account hijacking and other actions that could lead to the spread of misinformation that is damaging to the company.

In the end, implementing effective security in today's modern business and IT environments involves a mix of tools, processes, and people — just like in the past. But it does all start with who or what is getting access and from where. Hopefully, we can all build on the lessons we learned from our experiences in 2020 to grow the effectiveness of our IAM systems.

Mr. Coviello is a venture partner at Rally Ventures, LLC, a position he has held since May 2015. From February 2011 to February 2015, Mr. Coviello served as executive chairman of RSA Security LLC. Mr. Coviello has served on the boards of directors of Synchrony Financial since ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-06
The "gitDiff" function in Wayfair git-parse <=1.0.4 has a command injection vulnerability. Clients of the git-parse library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.
PUBLISHED: 2021-05-06
Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race condition, a local user can delete arbitrary files as root. This involves the -oP and -oPX options.
PUBLISHED: 2021-05-06
Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter. This issue potentially exposes both internal and ex...
PUBLISHED: 2021-05-06
Mixme is a library for recursive merging of Javascript objects. In Node.js mixme v0.5.0, an attacker can add or alter properties of an object via 'proto' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the ava...
PUBLISHED: 2021-05-06
Improper input validation of octal strings in Python stdlib ipaddress 3.10 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many programs that rely on Python stdlib ipaddress. IP address octects are left stripped instead of evaluated as valid I...