Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


// // //

2020 Changed Identity Forever; What's Next?

For all the chaos the pandemic caused, it also sparked awareness of how important an identity-centric approach is to securing today's organizations.

Nearly overnight, the COVID-19 pandemic left business leaders in 2020 scrambling to support a workforce that had suddenly gone almost entirely remote. Simultaneously, as the number of telecommuters grew, so did cloud spending, which accelerated two of the last decade's leading technology trends. Underpinning it all was the ability to provide secure identity and access management (IAM).

Identity and access management reemerged as a strategic focus during the pandemic because it is a natural outgrowth of cloud adoption, an increasingly remote workforce, and the disappearance of the traditional network perimeter. With many workers operating entirely out of the office, the ability to securely utilize cloud solutions was even more critical than it had been previously — making protecting and proving user identity at the front end paramount.

Related Content:

You've Got Cloud Security All Wrong: Managing Identity in a Cloud World

Special Report: How Data Breaches Affect the Enterprise

New From The Edge: 9 Modern-Day Best Practices for Log Management

But the quarantine also exposed just how central IAM systems are to digital transformation. IAM provides the assurance and trust that users, systems, and applications need for technology initiatives that drive the business. For all the chaos it caused IT operations, the pandemic also sparked more awareness of how important an identity-centric approach is to securing today's organizations.

And there are still identity challenges that need to be solved. The ecosystem of human and non-human worker or "entity" identities that require secure access to corporate networks is growing. Beyond employees, there are third-party users such as partners, vendors, and contractors that need access to data and systems, including privileged access. But this opens up its own set of risks. As an example, look no further than the breach General Electric experienced last year, in which an attack on one of its service providers exposed personal information belonging to then-current and former employees.

Many organizations, unfortunately, are still behind when it comes to the basics of securing identities. In a survey of IT security and identity decision-makers in 2020, 79% of participants told the Identity Defined Security Alliance (IDSA) that they had experienced an identity-related breach during the previous two years. Less than half, however, had fully implemented any of the key technologies and practices necessary to achieve the identity-related security outcomes advocated by IDSA, such as requiring multifactor authentication for privileged access and applying the principle of least privilege.

The technical piece is only one aspect of the challenge, however. In the same IDSA study, many of the surveyed organizations had made organizational changes to the ownership of identity management during the past five years. Most of these changes were made to align the risk and identity functions more effectively. Decisions about access controls, privileged accounts, and the provisioning and deprovisioning of users cannot be made in silos. That's why facilitating collaboration between the identity and risk functions within an organization has to be a top priority.

In a way, it is similar to the conflict that often exists between security and DevOps. I like to joke that developers throw the party, and security ops people wake up with the hangover. Striking the right balance between different parts of IT is a business necessity, yet harmony still eludes many of us. If there is one goal all of IT should have for 2021, it should be to recognize the symbiotic relationship between security and the rest of IT. It is a cliché (but true nonetheless) that security should be an enabler, not a stop sign, and the organizations that best apply that idea will have the operational agility needed to deal with the challenges ahead.

One final thought on the importance of protecting identity: the controversy of the 2020 US presidential election highlighted the role social media can play in shaping public opinions. The importance of closely controlling the identity related to social media accounts will continue to be an important part of protecting a company's online reputation. This is not just about controversial political opinions; it is also about guarding against account hijacking and other actions that could lead to the spread of misinformation that is damaging to the company.

In the end, implementing effective security in today's modern business and IT environments involves a mix of tools, processes, and people — just like in the past. But it does all start with who or what is getting access and from where. Hopefully, we can all build on the lessons we learned from our experiences in 2020 to grow the effectiveness of our IAM systems.

Mr. Coviello is a venture partner at Rally Ventures, LLC, a position he has held since May 2015. From February 2011 to February 2015, Mr. Coviello served as executive chairman of RSA Security LLC. Mr. Coviello has served on the boards of directors of Synchrony Financial since ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The Promise and Reality of Cloud Security
Cloud security has been part of the cybersecurity conversation for years but has been on the sidelines for most enterprises. The shift to remote work during the COVID-19 pandemic and digital transformation projects have moved cloud infrastructure front-and-center as enterprises address the associated security risks. This report - a compilation of cutting-edge Black Hat research, in-depth Omdia analysis, and comprehensive Dark Reading reporting - explores how cloud security is rapidly evolving.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2023-02-08
An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSystem account.
PUBLISHED: 2023-02-08
A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process.
PUBLISHED: 2023-02-08
thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
PUBLISHED: 2023-02-08
Bosch Security Systems B420 firmware 02.02.0001 employs IP based authorization in its authentication mechanism, allowing attackers to access the device as long as they are on the same network as a legitimate user.
PUBLISHED: 2023-02-08
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The error message...