On the second Tuesday of April, organizations and professionals across the globe come together to recognize Identity Management Day. This annual event shines a spotlight on the critical role that identity and access management (IAM) plays in securing digital assets, safeguarding privacy, and enabling seamless user experiences.
As cyber threats continue to evolve, and data breaches make headlines with alarming frequency, the need for robust identity management solutions has never been greater. Identity Management Day serves as a reminder of the collective responsibility we all share in fortifying our digital identities and embracing best practices that mitigate risks and protect sensitive information.
On this Identity Management Day 2024, we’ve gathered insights from leading experts in the field. These voices offer valuable perspectives on the current state of identity management, emerging trends, and the future landscape of this ever-evolving domain.
—
Darren Guccione, CEO and Co-Founder at Keeper Security
“The concept of identity management has evolved and shifted to address the precipitous rise of technologically-advanced threats such as deepfakes and AI-powered attacks. Recent research reveals that IT and security leaders feel ill-equipped to defeat both deepfake technology (30%) and AI-powered attacks (35%). As cyber threats continue to proliferate, IT leaders must implement a multi-layered approach to security that addresses the most prevalent existing threats and combats the malicious cyber weapons of the future. Today’s enterprises and midmarket organizations should adopt zero-trust and zero-knowledge cybersecurity software that protects passwords, privileged access, secrets and remote connections to adeptly counter these existing and burgeoning threat vectors. As technology continues to advance and identity becomes more complex than ever, the necessity of having effective cybersecurity solutions remains a constant.”
++
Patrick Harding, Chief Product Architect, Ping Identity
“Identity Management Day is an opportunity to underline how a decentralized approach to identity can positively impact both security and digital experiences. Not only does it eliminate a centralized source of information for hackers to attack, but it leads to greater privacy, trust, and empowers individuals with the control over their identities – something incredibly valuable in a digital-first world. The time is now to secure our workforce, build customer trust, and deliver the seamless and secure digital experiences individuals deserve.”
++
Will LaSala, Field CTO, OneSpan
“In our evolving digital landscape, Identity Management Day serves as a crucial reminder to prioritize robust identity verification (IDV) and user authentication methods to combat identity breaches. Despite the preventative nature of these breaches, they persist as a growing threat to companies, even though there are solutions readily available to thwart them. With developments like digital agreements, which are now fundamental to business and threats still growing, companies must focus on continuous verification to instill trust in all digital interactions. The future of IDV hinges on capturing user intent, and that’s why we must move beyond traditional authentication methods.
Companies must steer away from methods like SMS and static passwords and embrace new, innovative technologies to keep identities safe, particularly as online transactions become an integral part of daily business workflows. FIDO (Fast Identity Online) technology, as an example, strikes a perfect balance between continuous security, usability, and cost, emerging as a key solution for protecting digital identities. By eliminating static passwords, FIDO provides more control to users over identities and ensures secure interactions with enhanced ease of use – addressing the human error element, which is often the weakest link in security. As we navigate the complexities of digital identities, embracing new secure innovations and understanding the intent behind interactions will prove key to fostering digital trust in 2024 and beyond.”
++
Kevin Bocek, Chief Information Officer at Venafi
“Identities are the foundation of our digital lives. Identity Management Day presents a timely reminder of the importance of identity not just for humans, but also machines. Machine identities play a pivotal role in the face of evolving cyber threats and are the groundwork of trust in today’s digital world. Poor management of machine identities has played a major part in some of the biggest security breaches over the years. In today’s modern landscape, where artificial intelligence, machine learning, and automated systems are revolutionizing operations as well as threats, it’s critical to ensure the authenticity and security of these technologies. As we continue to inch closer to a post-quantum world, the protection and authentication of machine identities will only continue to increase in importance.”
++
David Divitt, Senior Director Of Fraud Prevention & Experience, Veriff
“The digital landscape continues to evolve, and while making interactions online easier for consumers it is also speeding up bad actors’ ability to commit fraud. Now, while we can get our identity validated online in a matter of seconds with the power of AI, bad actors are using those same tools to commit fraud just as quickly.
A recent survey showed nearly half (47.8%) of users had encountered some form of online fraud in the past 12 months. Today, over half of consumers (64.1%) would accept a longer sign-up process involving the use of an ID document and a selfie if it means they and their personal information will be kept safe from fraudsters. It’s clear that protecting user identity provides a competitive advantage for any organization.
Relying on legacy or point solutions can expose an organization to bad actors; passwords are vulnerable to data breaches and malware, and two-factor authentication is susceptible to device compromise and social engineering. An effective fraud defense must be strong, dynamic, and multi-faceted. This Identity Management Day I would encourage organizations to reevaluate their fraud measures and put customer protection first. Organizations should seek to adopt technology and processes that are as painless as possible for the end-user, taking a “right-friction” approach to fraud prevention, without compromising safety. A person’s identity is who they are, it’s their most valuable asset. People deserve to have real safety, real protection, and real transparency.”
++
John DeSimone, Chief Executive Officer, Nightwing
“Successful identity management starts with having the proper policies, governance, and technologies in place. Beyond mere management at a component level, organizations need to take proactive measures by putting the crucial elements of identity management at the forefront of their operations. Specifically, the implementation of a Zero Trust roadmap is the most efficient way for organizations to cover their bases in terms of identity management. Those who fail to think ahead and take these types of measures now, will be more susceptible to breaches in the future, allowing for attackers to infiltrate multiple servers, jeopardizing large quantities of company data.”
++
Roman Arutyunov, Co-Founder and SVP of Products, Xage Security
“Compromised identities are the most popular attack vector for cybercriminals. I hope we can’t say the same thing next Identity Management Day. To ensure this, we need to make a big change in how we secure identities for not just IT, but OT domains as well. With critical infrastructure enduring 13 cyberattacks per second last year, prioritizing OT security is no longer a choice but a necessity. These systems control our world’s critical infrastructure, and if accessed by the wrong hands, the impact can be devastating.
OT systems are becoming more interconnected and remotely accessible, amplifying the threat of cyberattacks through compromised identities. That’s why companies must make the leap and implement access control deeply rooted in zero trust principles. It ensures consistent verification of every user and device seeking access to critical systems, irrespective of location or network. As a result of this proactive approach, the identity of individuals and our critical infrastructure are secured and public safety and the daily functioning of society are preserved.”
++
Anudeep Parhar, COO – Digital, Entrust
“Identity is a highly targeted initial attack vector. Google Cloud’s 2023 Threat Horizons Report found that 86% of breaches involve compromised identities. This is only going to accelerate as AI technology becomes increasingly easy to use and access.
We can and should combat AI with advanced AI practices. While identity is being exploited by bad actors, more importantly, identity-centric AI security is the starting point for Zero Trust frameworks and ensures a company’s cyber posture is best positioned to meet today’s threats. Adopting a Zero Trust approach ensures that even if data is exposed, valuable assets cannot be accessed, but it requires constant adaptation and improvement. Because of this, identity is central to Zero Trust, especially as we enter a new, digital, age where our driver’s licenses and even passports live on our devices. Identity-centric AI can provide the context needed to deliver better data security and verify genuine identities whether that be authenticating a user’s computer access, or allowing an employee access to a company’s most valuable data resources.
This Identity Management Day, organizations need to reevaluate their cybersecurity strategies and integrate AI with a focus on identities to better position themselves against today’s expanding threats.”
++
Bala Kumar, Chief Product Officer, Jumio
“The growing accessibility of generative AI has left businesses and individuals at heightened risk of identity theft. With AI-driven tools like FraudGPT, cybercriminals only need seconds to launch sophisticated attacks involving synthetic identities or vocal and facial deepfakes to bypass traditional security measures. Ninety percent of organizations have suffered identity-related breaches, calling for new solutions to combat these threats.
Businesses must adopt stricter biometric verification strategies that incorporate liveness detection and AI-powered analytics to recognize fraud patterns as they emerge before fraudsters have the chance to strike more broadly. Investing in threat intelligence technology, like AI-predictive fraud analytics, is a fraction of the cost of the damages associated with a breach. By implementing a multilayered defense against identity theft, security teams can not only stop fraud, but prevent breaches. Businesses have a responsibility to protect themselves and their customers with robust defenses, or risk paying the price.”
++
Paul Walker, field strategist, Omada
“As organizations grapple with the challenges of securing their digital ecosystems and meeting regulatory compliance requirements, identity governance and administration (IGA) is critical for not just securing identities, but enhancing operational efficiency.
Today, most organizations understand the need for identity governance but trying to figure out what the best solution to pick is just getting harder. How do you sort through the ever-growing list of acronyms and types of offerings to figure out what’s best? For many companies, that’s made the platform approach more appealing; having one vendor provide you with multiple solutions and coverage can seem like the ideal. But the problem is that no one vendor has a platform that provides all the needed elements, which means organizations wind up having to customize integrations or risk having areas under-covered. An alternative is a best-of-breed approach, which lets companies pick the tools they need for each purpose and ensure they avoid vendor lock-in and don’t have to replace all of their existing investments.
A best-of-breed approach can provide a deeper or richer offering compared to a platform, which may have divergent priorities across each identity tool it offers in the platform. It may also offer more relevant connectivity and integrations, which enables more efficiency and allows for better prioritization of an organization’s technical resources.”
++
Almog Apirion, CEO & Co-Founder, Cyolo
“Currently, 73% of enterprises lack a complete inventory of their Operational Technology (OT) assets – leaving the backbone of industrial control and infrastructure vulnerable to cyberattacks. Unsecured OT environments threaten public well-being and the physical safety of workers in the field as they engage with these systems.
It’s been said before, but the reality is that humans remain one of the greatest risks for organizations, and Identity Management Day serves as a crucial reminder that nowadays hackers don’t break in, they log in. Identity is the new perimeter, as organizations increasingly seek comprehensive remote privileged access management (RPAM) strategies that secure systems – online, offline, legacy, and modern – and manage access for both internal and third-party users. This includes enforcing access controls according to the principle of least privilege, which prevents users from accessing anything beyond the resources they need to do their jobs. This helps to mitigate the risks of unauthorized access, limits the potential spread of ransomware and other malware, and even reduces the damage of human errors.
By achieving complete visibility into their infrastructure and enforcing stringent authentication protocols, enterprises can fortify their defenses against evolving cyber threats, safeguarding both physical operations and the safety of their workforce and the public.”
++
Chris Hickman, CSO, Keyfactor
“A significant part of identity management is managing machine identities. Keyfactor’s latest research revealed that most organizations (93%) face challenges with setting their machine identity strategy, and 72% agree that machine identity management is problematic to their organization.
As the number growing number of machine identities continues to challenge organizations of all sizes, businesses must prioritize centralized visibility, control, and management of the machine identities and their supporting infrastructure for a successful identity management strategy. In fact, PKI serves as the backbone for establishing and maintaining digital trust in modern computing environments.”
++
John Mancini, Principal Product Manager at Vectra AI
“Identity is the center of the modern enterprise and the modern hybrid attacks. Attackers continue to abuse identities to spread their attacks either as a starting point or to move laterally within an environment to access sensitive data and spread ransomware. Attackers have commoditized techniques such as phishing-as-a-service and ransomware-as-service, enabling them to replicate successful attacks involving identities at large scales. Despite spending millions of dollars investing in security tools, 90% of organizations have experienced an identity attack.
The challenge for defenders is that attack techniques have evolved to bypass traditional preventative tools. So, while preventative controls like multi-factor authentication (MFA) are important tools for organizations to have in their arsenal to protect identities, they are useless if an attacker bypasses them. The only way to stop an attacker once they have infiltrated your environment is to see what they do and where they go. SOC teams must be able to detect when a user is compromised based on the identity’s behavior within the network and immediately correlate actions across these domains. With more attackers logging in as opposed to hacking in, being able to identify active attackers abusing identities is an essential activity for any SOC team.”
++
Greg Jensen, Threat Research at Zimperium
“Identity is the modern equivalent of the firewall. Identity controls are user-bound with enterprise entitlements (access and permissions) and as such, the user is the prime target for credential theft, and misuse. The driving force behind IAM programs is zero-trust initiatives and requirements, which most security and privacy regulations are centered around.
According to Okta’s report, the #1 technology being used to help secure the user identities is MFA (Multi-Factor Authentication) (at 34% of organizations saying it is #1). 80% of data breaches, leverage a stolen or compromised credential. According to Proofpoint, MFA is under attack by malicious phishing attacks targeting the compromise of user accounts, to gain access to business-critical services.
Mobile devices have emerged as the preferred platform for authenticating access and validity of a user credential, but are also the key target for MFA compromises and other attacks with the goal of either stealing the credential, or bypassing the authentication mechanisms. In short, Identity-driven Zero-Trust architectures are only as strong as their weakest link. Vulnerable devices = untrusted, and untrusted devices = failed zero-trust.”
++
Narayana Pappu, CEO at Zendata
“About a billion people worldwide (30% of the total global workforce) are on corporate networks or access some corporate resources online (payroll, email, messaging, etc.)—a number that’s only going to grow. There are 24 million companies with greater than 10 employees worldwide. Each employee and each device these employees use to access corporate resources is a vector of risk (IP exposure, data breach) – without proper controls and training. Although the number of incidents of account takeover and identity thefts have increased, it is easier than ever for companies to manage end-user identity and implement single sign-on, role-based access, multi-factor authentication, and user lifecycle management. Beyond that, it is also important for companies to think about what information an employee stores on their personal devices and whether the information stored is encrypted properly to minimize risk/liabilities even when there is an identity breach.”
++
Steve Moore, Chief Security Strategist, Co-founder TEN18 Exabeam
“The broad availability of AI is allowing bad actors to create deep fakes and launch smarter, more effective cyber attacks to steal credentials and data. As a result, hacks have become bolder because stolen credentials allow them to mimic typical user activity, making them harder to catch.
In this threat climate, industrywide awareness campaigns like Identity Management Day are so important for keeping the issues of identity and privacy protection at the forefront of security investment and planning. Organizations, customers, partners, and individuals must be reminded about the ever-evolving risks associated with weak passwords and credential-based authentication.
As security professionals, we advocate for establishing cyber hygiene best practices to safeguard personal and professional identities and prevent credential-based cyber attacks. Organizations can also invest in machine learning and AI-based solutions that help detect deep fakes, malicious activities, and immediately flag when a legitimate user account is exhibiting anomalous behavior. When SOC analysts are given greater insights about both the compromised and the malicious user, they’re able to shorten response times and prevent data loss.”
++
John Stringer, Head of Product, Next DLP
“In honor of Identity Management Day, I call on organizations and individuals alike to reflect on their approaches to securing information against the dynamic threat landscape. At Next DLP, we believe that your most valuable data is always at risk, and we urge you to get ahead of threats and protect your data before it is too late.
Now more than ever, IT leaders must guide their teams in understanding the importance of protecting individuals from threats like fraud and identity theft and organizations from data breaches and malicious actors. The surge in SaaS and GenAI tool usage, like ChatGPT, demands immediate action to understand and mitigate data exposure risks. Shadow SaaS and GenAI amplify vulnerabilities, as security teams often lack insight into application usage, credential management, and data access. Implicit trust in employees using corporate or personal credentials with unauthorized applications further endangers corporate accounts and exposes sensitive information. To combat this, cybersecurity leaders must promote investments in access controls and tools that provide a holistic view of SaaS application use for managed and unmanaged devices.
Security is a people problem, and Identity Management Day reminds us that cybersecurity is not just the responsibility of the IT department but a collective effort. By fostering awareness, education, and best practices, we can create a safer digital environment and stronger identity management strategies.”
++
Eric Woodruff, Researcher and Product Technical Specialist, Semperis
“With the ever-expanding ecosystem of mobile workers, cloud services and devices, identity is the only control plane left for keeping the bad guys out – but is also the primary attack surface. While the identity space has evolved over the past few years, many challenges remain, especially as organizations gravitate towards a hybrid identity management environment. Hybrid environments are particularly prone to errors and misconfigurations that leave the door wide open to cyberattacks. In fact, 9 out of 10 attacks exploit Active Directory, the core identity system for most organizations.
As cybercriminals look to exploit weaknesses in identity systems, it has become clear that the biggest challenges facing organizations are lack of education and awareness. Organizations need identity-first security to protect from attackers’ primary entry point. An attack to AD can be detrimental to a business. Identity Management Day serves as an important reminder that securing hybrid identity with comprehensive AD defense is vital to the security and health of an entire organization.”
++
Scott Silver, CEO at Integral Partners, a Xalient Company
“Identity compromise is a major concern that continues to escalate, Identity Management Day aims to create broader awareness for both organisations and individuals around this critical issue.
Last year saw a 17% increase in identity compromise, affecting nearly 250 million victims. Companies must manage and secure their digital identities to protect employees, customers and their data.
With digital identities evolving at a rapid pace, identity security is a crucial aspect of cybersecurity. 2024 is poised to usher in a new range of innovations and trends to protect sensitive data, ranging from advanced biometrics to the integration of artificial intelligence and machine learning. These solutions are more secure than traditional passwords and can help prevent credential compromise. However, companies need to go a step further in protecting sensitive and personal data and would benefit from implementing Zero-Trust strategies to further protect this data and prevent it from falling into the wrong hands.
This Zero-Trust approach has become the foundation of modern cybersecurity, with secure networking and identity security forming the cornerstone of it. Zero-Trust strategies practically apply identity and access management capabilities to continuously assess the risk every time resources are accessed within an environment. Zero-Trust means granting access only for the right reasons, to the right person, for the right amount of time. As such, it provides IT departments with contextual identity information to inform and optimise access policies while enforcing the principle of least privilege. This, in turn, prevents employees, and even threat actors, from being able to access systems and data that are not necessary for their job and thereby enables a stronger security posture where keeping personal and sensitive data secure has no impact on productivity or business agility. If a breach occurs, security teams are immediately notified and able to respond and resolve the issue.
As the threat landscape continues to evolve and cybercriminals have access to a host of new and more powerful technologies to harness their skills, companies need to be a step ahead and implement Zero-Trust strategies to keep the identities of their employees and customers safe and secure.”
++
Hed Kovetz, CEO and Co-founder, Silverfort
“Identity is the last line of defense. Major identity-based breaches such as those against Change Healthcare, Okta, MGM, and U-Haul show how identity has become the most vulnerable element of the enterprise attack surface, and one of the most frequently used attack methods. Addressing this risk will require the C-Suite to treat identity security as a strategic pillar in their cybersecurity strategy, and start handling it in a more unified way. For instance, the way cloud identity and on-prem identity are each secured using isolated measures rather than holistically, creates huge exposures. A recent report found that 67% of organizations sync their on-prem passwords to the cloud, so if their legacy on-prem identity infrastructure gets compromised, the attacker can easily access the cloud too, through the back door.Visibility, whether in the cloud or on-prem, is key to defending against future identity threats, especially in the age of artificial intelligence (AI), where the attack surface is constantly evolving. Moreover, organizations must think beyond traditional multi-factor authentication (MFA) and endpoint security measures and put in place additional identity protection controls. These controls should focus on stopping lateral movement and should protect the organization’s identity security blind-spots, which attackers often try to exploit. By extending security controls across an organization’s entire identity infrastructure, security teams will have the visibility needed to detect when an attacker is trying to enter the network and/or cloud and to spread within those environments, and the tools necessary to stop the breach.Identity Management Day serves as an important reminder for organizations and security leaders to have long-overdue conversations around identity security. Threat actors are only getting more sophisticated. Now is the time for organizations to reevaluate their identity security controls and dedicate more time and resources to better secure their identities.”
##
