In today’s cybersecurity landscape, identity has emerged as the prime target for threat actors, with compromised credentials involved in 49 percent of breaches. Attackers exploit misconfigurations, use generative AI for social engineering, and purchase stolen credentials, highlighting the need for robust identity security. While Identity and Access Management (IAM) has been crucial, evolving threats demand a more proactive and multifaceted approach that integrates threat intelligence tools and processes to protect identity systems effectively.

Implementing a robust Identity Threat Detection and Response (ITDR) strategy may be the solution. ITDR merges continuous monitoring and response with proactive measures, ensuring a resilient and adaptable security posture. A robust ITDR strategy not only prevents and detects threats but also investigates and coordinates responses to restore integrity after identity infractions.

Continue reading →

In an age where cyber threats are becoming increasingly sophisticated, the management and verification of digital identities are at a critical juncture. As various sectors rapidly evolve, decentralized identity (DCI) systems emerge as a revolutionary approach to managing and verifying user identities. These autonomous systems promise to change how we access and use online services. However, many organizations need help with adopting this promising technology.

A recent survey by Ping Identity, which included responses from 700 IT decision-makers worldwide, highlights these challenges. In the UK, 82 percent of IT decision-makers see value in decentralized identities for their customers and employees, yet only about a third (34.5 percent) currently offer this option. A significant reason for this gap is the need for more clarity about the benefits, with 31 percent of respondents unsure what advantages decentralized IDs would bring.

Continue reading →

Active Directory (AD) was introduced in the late 90's when corporate networking barely had virtualization and remote work, not to mention cloud services.

AD controls authentication and authorization to most of an organization's on-premises applications and data, and through synchronization and federation with Entra ID, Okta or other cloud identity provider (IDP) provides these same controls to cloud applications and resources.

Continue reading →

A new study from the Identity Defined Security Alliance (IDSA) finds that 90 percent of organizations experienced an identity-related incident in the past year and 84 percent suffered a direct business impact as a result.

The survey of over 520 identity and security professionals from organizations with over 1,000 employees finds the most significant impact, seeing a measurable rise this year, is distracting from core business (52 percent).

Continue reading →

According to a new survey, 77 percent of organizations have suffered from instances of cyberattacks or data breaches in the past 12 months due to improper access or over-privileged users.

The study from ConductorOne, based on a survey of 523 US-based IT security leaders at companies with 250 to 10,000 employees, also finds 41 percent of respondents say there had been multiple instances of cyberattacks or data breaches due to the same improper access issues.

Continue reading →

Today, almost every organization and most individuals are using or experimenting with Artificial Intelligence (AI). There are plenty of examples of how it is changing businesses for the better, from marketing and HR to IT teams. What was once computationally impossible, or prohibitively expensive to do, is now within reach with the use of AI.

According to Gartner, approximately 80 percent of enterprises will have used generative AI (GenAI) APIs or models by 2026. As AI drives value for organizations, it is fueling further demand and adoption.

Continue reading →

The average organization has roughly 1,400 permissions for every employee, according to a new report from Veza.

The findings also show that identity teams face a daunting number of groups and roles to manage. With organizations averaging nearly 700 groups for every 1,000 users, it is difficult for admins to choose the least-privilege groups and roles that will meet the needs of any given employee, contractor, or service account.

Continue reading →

As we move away from passwords to other forms of authentication, there's increasing reliance being placed on technologies like biometrics.

But there's growing evidence that this technology could be flawed, with facial recognition exhibiting higher error rates for those with darker skin for example. We spoke to Dr. Mohamed Lazzouni, CTO of Aware, to discuss the ethical issue of bias in biometrics and what needs to be done to prevent it.

Continue reading →

A new report reveals that 67 percent of businesses routinely synchronize most of their users’ passwords from their on-premises directories to their cloud counterparts. This poses substantial security risks by creating a gateway for attackers to hack these environments from on-prem settings.

The report from Silverfort shows that in the rush to the cloud security gaps stemming from legacy infrastructure, misconfigurations, and insecure built-in features create pathways for attackers to access the cloud, significantly weakening a company's resilience to identity threats.

Continue reading →

A new report from IBM X-Force Threat Intelligence highlights an emerging global identity crisis as cybercriminals double down on exploiting user identities to compromise enterprises worldwide.

The 2024 X-Force Threat Intelligence Index report records a 71 percent spike in cyberattacks caused by exploiting identity as using valid accounts has become the path of least resistance for cybercriminals, with billions of compromised credentials accessible on the Dark Web.

Continue reading →

As organizations continue to embrace digital transformation to gain access to the cloud’s many benefits, this means that computing environments are evolving into borderless IT ecosystems. Digital identities are also evolving at pace and identity security is now a crucial aspect of cybersecurity. 

As we continue to digitally transform organizations, so the importance of secure and reliable digital identities has grown. 2024 is poised to usher in a multitude of innovations and trends in this area, ranging from advanced biometrics to the integration of artificial intelligence and machine learning to meet the changing needs of businesses, individuals, and governments.

Continue reading →

Most successful cyberattacks rely on compromised identity or social engineering. Yet this can be a major blindspot for enterprises with basic awareness of the problem lacking and a growing number of personal devices used for work.

We spoke to Jim Taylor, chief product officer of identity platform RSA, -- which recently published a report on the issue -- to learn more about the problem and how it can be addressed.

Continue reading →

Despite moves towards other means of authentication passwords are still widely used, making protecting digital identities a problem.

But identity affects other areas too, such as being able to verify content and devices, things which are likely to come more more into focus as we approach significant elections in the US and UK. Here are some expert views on the identity landscape for 2024.

Continue reading →

When we want to secure something highly valuable, say, a bag of ancient Spanish coins worth millions, we think of locking it behind as many layers as possible. For example, you might put it in a safe deposit box in a bank vault, nestled safely inside the institution that is itself blanketed with redundant physical security controls.

As organizations have become increasingly complex, so too have their associated layers of security around application access. Enterprises have tremendous amounts of applications and data, as well as users and devices with differing levels of permissions trying to access that data. To provide a consistent, IT-vetted method of creating, managing, storing, and authenticating the complexity of application access, we have arrived at Identity Provider (IdP) tools. IdPs are (typically) cloud-hosted services that store unique information used to identify users, organizations, and devices ("digital identities"), authenticate access requests, add/remove users, and provide security around these functions. Popular examples of solutions often used for IdP functionality include Okta, Microsoft Azure AD, and Duo.

Continue reading →

From letting hotels keep copies of our passports to handing over IDs for car hire or air travel, we seldom think twice about the implications of physically sharing our identity documents. By now, we’ve gotten accustomed to exchanging personal information in return for a product or service we value -- but we need to be more vigilant at a time when identity fraud is jumping as much as 37 percent.

Proof of a person’s identity is the key to accessing goods, services, financial accounts, and opportunities -- which makes identity a valuable target, motivating fraudsters to try to gain our trust to trick us into disclosing our personal information so they can impersonate us. They also hack into identity databases that store personal information of millions of consumers. As a result, the frequency of data breaches has increased exponentially. In fact in 2022 alone, identity theft reached a staggering $42 billion in the US.

Continue reading →