From application to zero trust: Identity security fundamentals to stay ahead of the threat landscape

Cybercriminals are not new, and often neither are their tactics. Despite this, phishing attacks, which incorporate social engineering in emails and messages to persuade people to perform an action that puts organizations at risk, continue to be highly successful. New technologies, such as GenAI, are improving these tactics further and companies must implement a strategic approach built on a solid foundation of identity security to minimize risks.

The most glaring vulnerability within an organization stems from human error. Mistakes such as using weak passwords, reusing credentials across multiple platforms, or falling victim to phishing attacks, can provide malicious actors with an easy gateway into secure systems. Social engineering exploits the natural human inclination to trust, deceive employees into divulging sensitive information or unwittingly granting access. Despite widespread awareness campaigns, these tactics continue to succeed, highlighting the gap between knowledge and practice, which presents a major risk to organizations.

To overcome these challenges, companies implement stringent security measures such as multi-factor authentication or frequent mandatory password changes, yet users often view these as cumbersome or inconvenient. Consequently, employees may seek shortcuts that undermine the intended security benefits. Balancing security with usability is a continual challenge and organizations must strive to implement measures that are robust yet user-friendly, ensuring compliance without compromising security.

Protecting the organization

Companies have a responsibility to keep customer and employee data secure. While humans will inevitably be a critical factor in the cybersecurity equation, they are influenced by various psychological factors that can compromise identity security. Cognitive biases, such as overconfidence in one's ability to detect phishing attempts or the belief that one is not a target, can lead to risky behaviors. Additionally, stress, fatigue, and distraction can impair judgment and increase the likelihood of errors. Organizations need to consider these psychological factors when designing their security training programs, ensuring they address not only the technical aspects but also the human elements of cybersecurity.

By acknowledging the inherent weaknesses associated with human behavior, organizations can take proactive measures to address them. This starts by fostering a culture of security awareness and responsibility, where every individual understands their role and the potential impact of their actions. Further, companies must put identity security at the core of their security strategy to minimize the potential risk created by vulnerable users. If they rely solely on traditional perimeter defenses to protect the organization’s networks, applications, and data, they will only marginally improve their security posture and continue to have a vulnerable front end. By shifting focus to identity security, risks and the associated blast radius of potential breaches are significantly reduced.

Machine identities are a risk too

It is also important to remember that machines within the organization also have identities and the exponential growth of these machine identities is staggering. From cloud services and IoT devices to microservices and APIs, each requires its own identity for authentication and authorization. This proliferation creates a vast attack surface, with each machine identity representing a potential entry point for cybercriminals. Managing these identities is a complex task. Organizations often lack visibility into the sheer number of machine identities in use, making it difficult to track, secure, and audit them effectively. This complexity can lead to oversights and vulnerabilities that attackers can exploit.

As such, security teams must understand the risks of machine identities as much as they do human or employee identities. The core risk in an environment is identity, once this is compromised, threat actors effectively have the keys to the front door -- they do not need to break in, they can simply log in.

Unlike human identities, which often have well-defined roles and behaviors, machine identities can be more challenging to monitor. Their interactions with systems and data are complex and varied, making it difficult to establish baseline behaviors and detect anomalies. Many organizations lack the tools and processes needed to monitor machine identities effectively. This insufficient visibility can delay the detection of malicious activities, allowing attackers to operate undetected for extended periods. Implementing advanced monitoring solutions that track and analyze machine identity activities is crucial for timely threat detection and response.

Automation and orchestration add new risks

Automation and orchestration are key drivers of efficiency in modern IT environments, but they also introduce risks. Automated processes often rely on machine identities to perform tasks such as provisioning resources, deploying applications, and managing configurations. If these identities are compromised, attackers can manipulate automated workflows to their advantage. Ensuring the security of machine identities involved in automation and orchestration is essential to safeguarding these critical processes.

Effective governance and policy enforcement are vital for managing machine identities, yet many organizations struggle with this. Without clear policies and governance frameworks, it is challenging to ensure consistent and secure handling of machine identities across the organization. This lack of governance can lead to inconsistent practices, such as using different standards for different machine identities or failing to enforce security policies uniformly. Establishing comprehensive governance frameworks and enforcing policies consistently are key steps in mitigating the risks associated with machine identities.

For this reason, Zero Trust, which assumes every connection, device, and user is a potential cybersecurity threat, must start with identity security and remove implicit trust from all employees and machines.

Starting the Zero Trust journey

To implement a Zero Trust approach with identity security at the core, it is necessary to analyze the organization’s current security posture and identify the potential risks. Rather than trying to solve everything, the focus should be on understanding the threats and what the blast radius of a breach would be. Next, is to identify the individuals who follow the right processes and procedures, focusing on role-based access to identify the use cases and security gaps before determining the priorities and building an evidence-based strategy to support it. This can best be achieved with tabletop testing which exposes a lot of gaps in the security fabric.

This information clarifies where to start the process. It is important to note that there is no single tool that will fix all security problems. Companies must take a comprehensive view of the situation to understand the challenges they face and how best to address them.

Ultimately, Zero Trust is a journey that starts with identity security first and foremost. Only once this is done should the infrastructure security and other security aspects come into play.

Image Credit: Thicha Satapitanon / Dreamstime.com

David Morimanno is thought leader at Xalient Group.