Explained: Identity security, the new cyber battleground
By CyberArk
Experts at CyberArk lay out a new approach to security.
His call for the “fundamental shift in mindset” came in the wake of the recent SolarWinds breach, which affected US government agencies and large tech companies including Microsoft, reported CNA.
What does this shift look like for companies’ cybersecurity strategies? Experts at CyberArk share what steps need to be taken.
Zero trust
“Digital transformation and attacks like SolarWinds have put renewed focus on a zero trust model for identity security," says Teck Wee Lim, regional director for ASEAN at CyberArk.
“The Singapore government has recently highlighted the need to adopt the Zero Trust approach, moving security away from the old implied trust approach. With the exponential growth of identities and privileges across the enterprise, breaking the attack chain means privileged credentials must be managed and secured,” he explains.
What exactly is a zero trust approach? It advocates starting with the assumption that organisations may have already been compromised. IT teams need to make sure that every user or device is verified, and they’re given just enough access to do their work.
Organisations also need to balance speed with security. If employees need to remember multiple complex passwords or repeatedly authenticate themselves, it would seriously hamper productivity.
DevOps needs to be looped in too. Developers sometimes write privileged credentials directly into the code of new tech tools, but that can make them more vulnerable. Once attackers gain access to the code, there’s no stopping them from rewiring it to do damage.
Changing cyber battlegrounds
This zero trust approach is even more critical as organisations move to the cloud and work remotely.
Security used to be much simpler. Employees would all be on site or connected through VPN, so organisations just had to secure the perimeters of their networks.
With the cloud, guarding perimeters isn’t enough anymore. Each new app or service introduced by the cloud could be a target for attackers, and needs to be verified.
This rising trend of remote working will also make security tricky. It’s harder to seal off network boundaries when employees need to access it from the outside regularly.
These shifts give attackers a lot more opportunities to steal an employee’s or app’s credentials and enter the system. They can then slowly work their way up to higher levels of access. Without proper monitoring, they will eventually be able to attack the most sensitive data.
We’re already seeing attackers exploiting these risks. The FBI revealed that the number of reported cyber attacks increased by 400 per cent in April 2020, shortly after the pandemic broke out.
4 steps to secure identities
How can organisations achieve a zero trust strategy as networks become increasingly complex and crowded?
The best way is to secure every person or machine accessing a network. There are four steps for good identity security.
First, organisations need to authenticate each user. Different authentication methods such as biometrics and USB tokens can help to weed out malicious actors masquerading as employees.
Second, there needs to be an effective authorisation process. Humans and apps should both be given just the right level of permissions to access data. Once they don’t need the data anymore, their access should be removed.
Third, this entire process has to be seamless. This ensures that staff get the data they need without being stalled by needless, cumbersome security checks. Automation can help in changing levels of access and resetting passwords.
Fourth, IT teams should be able to audit this system and check that everything is in order. They need tools to produce tamper-proof records for each user’s activity. Risk analytics that look out for suspicious behaviour will also be useful.
As cyber space becomes more complex, organisations will need more visibility and agility to defend against threats. A zero trust approach to securing identities can help to pull out all the stops.
Learn more from CyberArk’s latest eBook on how to embrace a Zero Trust approach to securing the expanding number and types of identities.