After hearing that Thoma Bravo had purchased ForgeRock, its third identity company this year, security professionals urged businesses to make identity management a top priority, particularly those with apps or websites directed toward the general public.
According to senior analyst at ESG Global, an IT analyst, research, validation, and strategy firm, Jack Poller identities and user accounts are one of the prime vectors for cyberattacks, especially ransomware, in the workplace.
According to what Poller told VentureBeat, “strong, phishing-resistant authentication” such as multifactor authentication (MFA) or password-less authentication methods can prevent account takeover and other identity-related attacks, thereby reducing the attack surface.
Even though identity optimization is a cyber capability that CISOs acknowledge they need to develop, only 17 per cent of CISOs are doing so, per a PwC report. According to the Identity Theft Resource Center (ITRC), the number of data breaches in 2021 hit an all-time high of 1,862, a 68 per cent increase from 2020.
By reducing the target area, the attackers are less likely to be successful
An IEEE senior member, Kayne McGladrey argues that in order for CISOs to mitigate the dangers posed by unauthorised access to critical infrastructure and information, they must first establish a method for authenticating users and their devices.
“From a control operations standpoint, the two most important capabilities are the ability to validate a user’s behaviour when it deviates from the norm, and the ability to quickly de-provision access when it is no longer needed,” McGladrey told VentureBeat.
An individual who frequently logs in from Washington State on a Windows-powered computer to access a single programme, for instance, is unlikely to need a second authentication factor, as he explained.
However, “when the device changes, perhaps a new Mac computer that isn’t configured correctly, or when their location suddenly changes to Australia, they should be prompted for multifactor authentication as part of identity validation before being allowed to access those data,” McGladrey said.
After an employee has left a company, their identity should be promptly disabled on all systems. Otherwise, as McGladrey noted, organisations run the risk of a threat actor making use of the older access and credentials.
If CISOs follow the principle of least privilege access, employees will only have access to the data they need to do their jobs successfully, and no data beyond that will be accessible to them.
If an attacker compromises an identity, “this reduces the attack surface and the blast radius,” he said.
Poller pointed out that account takeovers in sectors like retail can lead to fraud and theft, which can be devastating for banks. Handle sensitive information with a parallel risk of exposure when identities are compromised, he said, especially in highly regulated sectors like healthcare. Use strong authentication, and manage and control access to customer identities and customer data just as carefully as you do employee identities.
The strong authentication methods and the ability to control authorization and access that these systems provide are invaluable to businesses as they allow them to better manage their entire staff and customer bases, he said.
The IAM and CIAM industries are merging
Single sign-on (SSO), identity governance (IGA), privileged access management (PAM), machine and workload identity management, and other identity security tools are beginning to overlap with identity and access management (IAM) and customer identity and access management (CIAM).
In light of the recent developments at Thoma Bravo, Poller has identified ForgeRock as “one of the major vendors” of identity and access management (IAM) software.
What’s particularly intriguing about Thoma Bravo’s purchase of ForgeRock is the degree to which it intersects with, and is adjacent to, the firm’s other recent investments in identity security, including SailPoint and Ping Identity, which are direct competitors of ForgeRock, and Venafi (machine identities).
He mentioned that Thoma Bravo has a minority stake in Delinea as well.
“The integration of the four solutions could result in a comprehensive identity security platform and a formidable competitor to other identity security platforms such as CyberArk or JumpCloud,” said Poller, although it is not yet clear what Thoma Bravo’s long-term plans are for their identity security investments. https://bestgamingpro.com
