Top identity and management challenges in 2023

In the aftermath of high-profile cyber incidents such as the Uber breach and Okta attacks, organizations are doubling their investments in identity and access solutions. While a hacker leveraged encrypted admin privilege to infiltrate the Uber network and leak the stolen data, including email addresses, corporate reports, and IT asset information, to the Dark web, a third-party identity compromise resulted in hundreds of companies getting hit in the Okta attacks. Almost 80% of organizations have experienced identity-based breaches in the last 12 months alone. Identity-related threats are already seeing a surge. With phishing and large-scale social engineering attacks giving way to potentially devastating and sophisticated forms such as business email compromise, deep fakes, and NFT fraud, organizations are on tenterhooks to safeguard their critical assets.

Organizations increasingly rely on novel technologies daily to upscale and drive agility. Unfortunately, growing connectivity is also exposing weak points and potential vulnerabilities within the network and software, which cybercriminals can leverage. The motive of these attacks ranges from financial gain to inducing terror. Therefore, before organizations invest heavily in identity access and management strategies and solutions, it is wise first to get first-hand knowledge of the current IAM landscape. Here are some challenges as listed by our cybersecurity experts:

Remote/Hybrid environments: While 72% of respondents admitted to having been shifted to hybrid mode, 9% say that they have moved to full-time remote work. Sophisticated cloud platforms and tools have further motivated its growth because they allow the workforce to access and resume tasks anytime, anywhere. However, more apps mean more passwords and URLs, increasing exposure to cyber risks. This can be resolved by proper provisioning or de-provisioning through Privileged access management (PAM) and identity governance and administration (IGA). This will enable security heads to assign roles and designate tools and networks with pre-set permissions. Then, once the task is done or the member/stakeholder has left, it is always safe to de-provision the accounts.

Password fatigue and weak authentication protocols: Modern SaaS or industrial control systems face two issues: simplified password requirements and URLs and apps that constantly need password change over specified periods. While the former increases risk exposure, the latter invites users' ire and dissatisfaction by making the user experience cumbersome. The best way to tackle these challenges is to deploy Multi-factor Authentication (MFA) using palm or fingerprint scan, facial scan, and other biometric authenticators, which help strengthen verification systems. Also, the Single-Sign-On (SSO) method can enable organizations to use a single username and password for all their accounts, including on-premises and cloud applications.

Technology gap: An ideal secure organization is one where networks, machinery, tools, and applications seamlessly integrate and function in a streamlined fashion. Many organizations still depend on legacy systems. Siloed operations and disparate functions often become a vantage point for cybercriminals looking to exploit vulnerabilities. It is not always necessary to replace the entire infrastructure top-down and drastically change configurations. The right technology with the best-in-class cloud-based identity and access solutions can provide centralized management through Active Directory or LDAP directory, seamlessly integrating into the infrastructure and networks. This doesn't need additional on-premises appliances or firewall modifications. Any modifications to the cloud can be automatically done within industrial standards through Secure Sockets Layer (SSL).

OT-IoT and Application security threats: 2022 has been a year marked by sophisticated cyber attacks targeting apps, operational technology, and the Internet of Things (IoT)-based systems. The increased number of dependent devices, equipment, and connectivity makes them an easy target for cybercriminals, leading to theft, leakage, or destruction of mission-critical data and assets. Therefore, it would be wise for organizations to learn lessons from the attacks and bridge the underlying gaps with
Virtual Private Networks (VPNs), universal integrated circuit card UICC-based mechanisms, and innovative IAM solutions.

Businesses have realized that digital identity today isn't just about tackling risks and safeguarding against insider threats. Instead, it involves a robust identity security architecture that is easy to use and protects access to goods and services. Security and business leaders are gearing up to embrace a digital identity ecosystem with covert authentication methods that use data from trusted devices combined with metrics. Convergence has been identified as the way forward for identity access and authorization. In a nutshell, instead of different stacks of technology, controls, and protocols for organizations and customers, a unified platform with streamlined capabilities brings consumers, partners, and employees together, authorizing their access under common policy regulations.

Organizations can maximize data and asset security through the combined effort of professionally managed cybersecurity services and effective solutions that track activity, ensure compliance, and monitor application usage. By facilitating the right kind of people to securely access the right type of resources and technologies at the right time, businesses can achieve desired scale and agility while gearing up for a safe and sustainable future.