By Belsasar Lepe, CEO and co-founder of Cerby
For many years, Enterprise Password Managers (EPMs) were the go-to solution for password management, but their necessity and usefulness have appropriately come under new scrutiny. As IT budgets shifted to business units, business teams implemented more cloud-based applications. EPMs only exist because most cloud-based apps do not support common identity standards.
At Cerby, we conducted research revealing that 61% of applications do not support standards such as single sign-on for authentication, and 94% cannot utilize the System for Cross-Domain Identity Management for authorization (SCIM) (Figure 1).
EPMs exist because only a tiny fraction of applications support single sign-on (SSO) and SCIM (automated onboarding and onboarding of users). At Cerby, we’ve affectionately dubbed applications that fit this description “unmanageable”. We call them unmanageable because attempting to manage them at any scale leads to significant manual labor, negative user experiences, and security risks for organizations.
Figure 1. Security standards of the top 10,000 apps
We know most security breaches arise from stolen credentials due to applications’ lack of support for standards like SSO (Verizon DBIR, 2022). As the risk landscape has shifted and expanded, companies need a more comprehensive approach to provisioning, authentication, identity governance and administration, and privileged access management. Not integrating these capabilities into EPMs exposes organizations to a significant and common security vulnerability.
Vulnerabilities related to EPMs constitute a significant challenge.
The main issue with EPMs is that they only consider the password portion of the identity and access management (IAM) lifecycle. Looking only at the password leads to a fragmented and unpleasant user experience. Users must manage other security-related tasks such as enabling 2FA, changing passwords (400 passwords can be a hassle to update manually), and revoking access to services and applications for former employees and contractors. EPMs also lack visibility into user access and activity, meaning that applications used by a business team often remain a black hole for critical security platforms like SIEMs.
The consequences of the unseen can be severe.
Traditional EPMs are not adequate for the future. CISOs need to gain oversight of unmanageable applications, and they are turning to solutions that are capable of reducing TCO, maximizing productivity, and controlling the risks these applications present. Solutions like Cerby offer a comprehensive approach to ensure unmanageable applications don’t negatively impact their organization’s security.
What will the future of access management look like?
To ensure mission-critical security is not dependent on manual processes, the next phase of access management requires security platforms that can manage in-depth workflows on thousands of applications. Furthermore, it is essential that solutions can extend SSO and SCIM to any application, regardless of whether they support the standards or not.
Employees must be able to employ a single set of credentials, whether cloud-based or locally installed, to access all their applications. A single set of credentials eliminates the need for manual security tasks and upgrades the user experience, making it easier for companies to head down the passwordless authentication route.
I was part of Cerby’s founding team, along with Vidal Gonzalez, after spending years in the technology sector at Google and as a co-founder of Ooyala. We saw the same issue repeatedly, so we determined it was time to make a change. We wanted to create a service to care for unmanageable applications while providing visibility, control, automation, and a user-friendly interface that everyone could understand quickly. We tried to resolve the UX and security issues that EPMs often have.
Cerby’s solution to the issues left unresolved by EPMs is through a simple, secure, and easy-to-use platform. It allows organizations to quickly and securely manage employee passwords while providing administrators with tools to audit and control user access. With Cerby, organizations can rest assured that their passwords are secure and that their workforce can access the correct data with the proper permissions.
Organizations also use Cerby to manage third-party access more efficiently, eliminating the time-consuming process of offboarding and onboarding users. This process can cost companies thousands of hours in lost productivity, leading to security risks if someone retains access after leaving. Cerby also provides an activity log that integrates with SIEM platforms and other security tools for auditing and compliance.
This degree of visibility and control is not achievable with current EPMs. Organizations that utilize Cerby can make the most of their Identity & Access Management (IAM) investments, like Okta, Azure AD, and Ping, to achieve a comprehensive access management solution. Cerby allows for a single control point for all unmanageable applications, minimizing complexity and the cost of managing multiple tools.
The current generation of EPMs can no longer meet modern enterprise security demands. Not meeting enterprise security requirements is primarily due to the proliferation of cloud-based applications which do not support SSO and SCIM identity standards. Robust access management requires more granular control than traditional EPMs can provide. Cerby was developed with this in mind, extending the entire IAM lifecycle to any application. Cerby delivers a single control point for all access management needs. Organizations can save on costs by reducing complexity and eliminating the need for multiple solutions. Eliminating multiple solutions strengthens the organization’s security posture while allowing employees to focus on their core responsibilities and be more productive.
##
ABOUT THE AUTHOR
Belsasar (Bel) is co-founder and CEO of Cerby. He was previously the Head of Product at Impira, where he led the company’s product life cycle, helping drive a 4x increase in revenue. Prior to his role at Impira, Bel was co-founder and CTO at Ooyala where he led a global product, design, and engineering team of 300+ Ooyalans spanning five countries and seven offices. Ooyala achieved two successful exits totaling over $440M.
Bel began his career as an engineer at Google working on Enterprise Collaboration products and studied Computer Science at Stanford University. He is an active advisor and investor in start ups, with a specific focus in Latin America.
