The identity theft landscape is anything but grayscale. Across sectors as varied as healthcare and motor vehicle departments, hackers have maintained an eclectic approach in their choice of targets. Leveraging cutting-edge generative AI, entities like Scattered Spider are pioneering novel approaches, such as procuring legitimate credentials from access brokers, to breach systems with unprecedented speed. This sophisticated maneuvering challenges the traditional methods by IT administrators and cloaks threat actors in the guise of legitimate users.
In 2022, the Federal Trade Commission fielded an astonishing 1.1 million reports of identity theft, serving as a stark reminder of the imperative for organizations to reassess their Identity and Access Management (IAM) strategies. Organizations must consider embracing forward-thinking security measures to safeguard sensitive data and outmaneuver adversaries to stay ahead of the curve.
Related: I Wish I Knew These Four Things Before Starting My Own Business
#BeIdentitySmart to protect your Online Identity
The Identity Defined Security Alliance (IDSA) marked its fourth annual Identity Management Day campaign last month with the hashtag #BeIdentitySmart. IDSA urged businesses that 84% of organizations have encountered an identity-related breach within the past year, and it is imperative to prioritize being identity-savvy.
The foundational principle of being savvy about identity lies in grasping who should have access to what. According to the 2023 Verizon Data Breach Investigation Report, 74% of all breaches involve human factors such as errors, misuse of privileges, credential theft or social engineering. Therefore, it becomes increasingly critical to avoid granting blanket super admin privileges and instead assign privileges based on specific roles. A unified endpoint management (UEM) strategy ensures centralized oversight of user access and device security. Its role-based access control (RBAC) functionality ensures that only authorized users can access particular data and applications. Simultaneously, its device management tools, such as application blocklisting and web content filtering, prevent employees from accessing malicious websites, thereby reducing the risk of credential theft.
While cyber-attack concerns persist, businesses face escalating regulatory pressures to safeguard customer data. Mandates such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) require firms to employ robust security measures for protecting personal information. Additionally, countries like the United States are moving towards amending legislation, exemplified by the bipartisan American Privacy Rights Act (APRA) bill. To adhere to these regulations, organizations are slowly adopting a converged identity approach, also called the identity fabric approach. By implementing an identity fabric framework, businesses can streamline their authentication and authorization processes for all user types (including general users, privileged accounts and third parties) across the entire infrastructure, aiding regulatory compliance efforts.
In cybersecurity, investing in the right tools is essential, but mastering their operation for swift response is equally critical. According to CrowdStrike, the timeframe for hackers to breach a system and move laterally within an environment has decreased significantly over the years. With breakout times now as brief as two minutes and seven seconds, there’s little room for delay, underscoring the urgency of countering threats.
Related: The Invisible Billion — How Digital Identities are Supporting Developing Nations
User education
In today’s digital landscape, a robust security strategy hinges on one crucial element: empowered users. Identity strength isn’t just about technology; it necessitates a significant cultural shift within organizations.
Security awareness training has traditionally been a one-time event, a hurdle to be cleared during onboarding. However, to be truly “Identity Smart,” organizations must make security education an intrinsic part of their DNA. By seamlessly weaving cybersecurity training into the onboarding process and beyond, employees gain the knowledge they need to recognize and respond effectively to potential threats.
However, fostering a watchful environment goes beyond simply instructing employees. It requires open communication channels where employees feel comfortable reporting suspicious activity without fear of reprisal. This fosters a collaborative security culture where everyone takes ownership. Security ceases to be solely the IT department’s responsibility; it becomes a collective effort.
Related: 3 Major Mistakes Companies Are Making With AI That Is Limiting Their ROI
Future-proofing identity management
Recently, Zoho’s ManageEngine ADSelfService Plus encountered an unprecedented tactic employed by a Chinese hacker group known as Volt Typhoon, which was known for embedding malware to carry out future cyber-attacks. While the exact method of breaching the ManageEngine environment remains unclear, indications strongly suggest a critical authentication bypass flaw. This underscores the necessity of transitioning from traditional security models, like the castle and moat approach, to a zero-trust architecture (ZTA). In a ZTA framework, trust is not assumed for any user or device. Instead, each access attempt undergoes continuous evaluation based on various factors, including context, user behavior and device status, before access is granted.
