Access management must get stronger in a zero-trust world

Access
management
(AM)
done
right
is
the
fuel
for
successful
digital
transformation.
Identities
and
AM
are
core
to
earning
customers’
trust
—
a
must
for
digital-first
initiatives
to
get
a
strong
start
and
deliver
revenue.

AM
and
identities
must
be
granular,
role-based
and
as
just-in-time
as
possible.
Enterprises
achieving
that
today
are
seeing

zero-trust
security
frameworks
becoming
instrumental
in
digitally-driven
revenue
growth. 

CISOs
tell
VentureBeat
their

cybersecurity
budgets
are
linked
more
closely
than
ever
to
protecting
digital
transformation
revenue
gains.
And
they
see
working
to

grow
digital-first
revenue
channels
as
a
career
growth
opportunity.

Security
and
risk
management
professionals
must
turn
AM
into
cybersecurity
strength,
and
show
that
zero-trust
frameworks
are
adaptive
and
flexible
in
protecting
new
digital
customer
identities.

Zero
trust contributes
to
securing
every
identity
and
validating
that
everyone
using
a
system
is
who
they
say
they
are. Earning
and
growing
customer
trust
in
a
zero-trust
world
starts
with
a
strong
AM
strategy
that
scales
as
a
business
grows. 

Authorization,
adaptive
access
and
getting
directory
and
identity
synchronization
right
also
become
significant
challenges
as
an
organization
gets
larger.

Securing
identities
is
core
to
digital
transformation 

“Adding
security
should
be
a
business
enabler.
It
should
be
something
that
adds
to
your
business
resiliency,
and
it
should
be
something
that
helps
protect
the
productivity
gains
of
digital
transformation,”
said
George
Kurtz,
cofounder
and
CEO
of CrowdStrike,
during
his
company’s

annual
event
last
year.
Boards
of
directors
and
the
CEOs
who
report
to
them
are
starting
to
look
at
zero
trust
not
purely
as
a
risk-reduction
strategy.

CIOs
and
CISOs
tell
VentureBeat
that
they
are
now
including
zero
trust
in
the
first
phases
of
digital
transformation
projects.
And
getting
AM
right
is
essential
for
delivering
excellent
customer
experiences
that
scale
safely
in
a
zero-trust
world. 

“While
CISOs
need
to
continue
working
on
translating
technology
and
technical
risk
into
business
risk
and
…
better
deliver
that
risk
story
to
their
board,
on
the
other
side
of
the
aisle,
we
need
the
board
to
be
able
to
understand
the
true
implication
of
cyber
risk
on
the
ultimate
shareholder
value
and
business
goals,”
said

Lucia
Milica,
global

resident

CISO
at
Proofpoint.

Excel
at
protecting
identities
to
make
your
brand
more
trusted 

It
doesn’t
take
much
to
lose
a
customer’s
trust
forever.
One
thing
most
can’t
look
past
is
being
personally
victimized
by
having
their
identities
compromised
during
a
breach.

Sixty-nine
percent
will
stop
buying
from
brands
that
use
their
data
without
permission.

Sixty-eight

percent
leave
if
their
data-handling
preferences
are
violated,
and

66%
leave
a
brand
forever
if
a
breach
puts
their
identity
data
at
risk.
Gen
Z
is
by
far
the
least
forgiving
of
all
customer
segments,
with

60%
saying
they’ll
never
buy
again
from
a
brand
that
breaches
their
trust.
Over
time,
it
takes
a
series
of
consistent
experiences
to
earn
customers’
trust,
and
just
one
breach
to
lose
it. 

Joe
Burton,
CEO
of
identity
verification
company

Telesign,
has
a
customer-centric
perspective
on
how
access
management
must
be
strengthened
in
a
zero-trust
environment.
In
a
recent
interview,

Burton
told
VentureBeat
that
while
his
company’s
customers’
experiences
vary
significantly
depending
on
their
digital
transformation
goals,
it
is
essential
to
design
cybersecurity and
zero
trust
into
their
workflows.

Enza
Iannopollo,
principal
analyst
at
Forrester,
told
VentureBeat
that
privacy
and
trust
have
never
depended
more
on
each
other,
reinforcing
the
importance
of
getting
AM
right
in
a
zero-trust
world.
As
Iannopollo
wrote
in

a
recent
blog

post,
“Companies
understand
that
trust
will
be
critical
in
the
next
12
months — and
more
so
than
ever.
Companies
must
develop
a
deliberate
strategy
to
ensure
they
gain
and
safeguard
trust
with
their
customers,
employees
and
partners.”

How
access
management
needs
to
become
stronger 

For

64%
of

enterprises,
digital
transformation
is
essential
for
survival.
And
one
in
five

(21%)
say
embedding
digital
technologies
into
their
current
business
model
is
necessary
if
they
are
to
stay
in
business. 

It’s
innovate-or-die
time
for
businesses
that
rely
on
digitally
driven
revenue.
Nine
out
of
10
enterprises
believe
their
business
models
must
evolve
faster
than
they
are
evolving
today,
and

just
11%
believe
their
models
are
economically
viable
through
2023.

With
the
economic
viability
of
many
businesses
on
the
line
even
before
the
economy’s
unpredictable
turbulence
is
factored
in,
it’s
encouraging
to
see
boards
of
directors
looking
at
how
they
can
make
zero-trust
security
frameworks
stronger,
starting
with
identity.
Credit
CISOs
when
they
educate
their
boards
that
cybersecurity
is
a
business
decision
because
it
touches
every
aspect
of
a
business
today.

Gartner
provides
a
helpful

framework
for
taking
a
comprehensive,
strategic
view
of
the
broad
scope
of

identity
access
management
(IAM)
in
large-scale
enterprises.
One
of
its
most
valuable
aspects
is
its
graphical
representation
that
explains
how
IAM-adjacent
technologies
are
related
to
four
core
areas.
Gartner
writes
in
the

Gartner
IAM
Leaders’

Guide

to
Access
Management
(provided
courtesy
of

Ping

Identity)
that
“the
bigger
picture
of
an
IAM
program
scope
includes
four
main
functional
areas:
Administration,
authorization,
assurance,
and
analytics.
The
AM
discipline
provides
authorization,
assurance,
analytics,
and
administrative
capabilities.
It
is
responsible
for
establishing
and
coordinating
runtime
access
decisions
on
target
applications
and
services.”

Gartner’s
structural
diagram
is
helpful
for
enterprises
that
need
to
sync
their
zero-trust
frameworks,
zero-trust
network
access
(ZTNA)
infrastructure
and
tech
stack
decisions
with
their
organization’s
digital
transformation
initiatives.

CISOs
tell
VentureBeat
that
AM
and
its
core
components,
including

multi-factor
authentication
(MFA),
identity
and
access
management
(IAM)
and
privileged
access
management,
are

quick
zero-trust
wins
when
implemented
well.
The
key
to
strengthening
AM
in
a
zero-trust
world
is
tailoring
each
of
the
following
areas
to
best
reduce
the
threat
surfaces
of
an
enterprise’s
core
business
model. 

Strengthen
user
authentication
to
be
continuous

MFA
and
single
sign-on
(SSO)
are
the
two
most
popular
forms
of
identity
management
and
authentication,
dominating
the
SaaS
application
and
platform
landscape.
CISOs
tell
VentureBeat
MFA
is
a
quick
win
on
zero-trust
roadmaps,
as
they
can
point
to
measurable
results
to
defend
budgets.

Making
sure
MFA
and
SSO
techniques
are
designed
into
workflows
for

minimal
disruption
to
workers’
productivity
is
critical.
The
most
effective
implementations
combine
what-you-know
(password
or
PIN
code)
authentication
routines
with
what-you-are
(biometric),
what-you-do
(behavioral
biometric)
or
what-you-have
(token)
factors.
MFA
and
SSO
are
the
baselines
that
every
CISO
VentureBeat
interviewed
about
their
zero-trust
initiatives
is
aiming
at
today
—
or
has
already
accomplished. 

A
crucial
part
of
strengthening
user
authentication
is
auditing
and
tracking
every
access
permission
and
set
of
credentials.
Every
enterprise
is
dealing
with
increased
threats
from
outside
network
traffic,
necessitating
better
continuous
authentication,
a
core
tenet
of
zero
trust.
ZTNA
frameworks
are
being
augmented
with
IAM
and
AM
systems
that
can
verify
every
user’s
identity
as
they
access
any
resource,
and
alert
teams
to
revoke
access
if
suspicious
activity
is
detected.

Capitalize
on
improved
CIEM
from
PAM
platform
vendors

PAM
platform
providers
must
deliver
a
platform
capable
of
discovering
privileged
access
accounts
across
multiple
systems
and
applications
in
a
corporate
infrastructure.
Other
must-haves
are
credential
management
for
privileged
accounts,
credential
valuation
and
control
of
access
to
each
account,
session
management,
monitoring
and
recording.
Those
factors
are
table
stakes
for
a
cloud-based
PAM
platform
that
will
strengthen
AM
in
a
ZTNA
framework.

Cloud-based
PAM
platform
vendors
are
also
stepping
up
their
support
for
cloud
infrastructure
entitlement
management
(CIEM).
Security
teams
and
the
CISOs
running
them
can
get
CIEM
bundling
included
on
a
cloud
PAM
renewal
by
negotiating
a
multiyear
license,
VentureBeat
has
learned.
The
PAM
market
is
projected
to
grow
at
a
compound
annual
growth
rate
of
10.7%
from
2020
to
2024,

reaching
a
market
value
of
$2.9

billion.

“Insurance
underwriters
look
for
PAM
controls
when
pricing
cyber
policies.
They
look
for
ways
the
organization
is
discovering
and
securely
managing
privileged
credentials,
how
they
are
monitoring
privileged
accounts,
and
the
means
they
have
to
isolate
and
audit
privileged
sessions,”
writes

Larry

Chinksi
in
CPO
Magazine.

Scott
Fanning,
senior
director
of
product
management,
cloud
security
at
CrowdStrike,
told
VentureBeat
that
the
company’s
approach
to
CIEM
provides
enterprises
with
the
insights
they
need
to
prevent
identity-based
threats
from
turning
into
breaches
because
of
improperly
configured
cloud
entitlements
across
public
cloud
service
providers.

Scott
told
VentureBeat
that
the
most
important
design
goals
are
to
enforce
least
privileged
access
to
clouds
and
provide
continuous
detection
and
remediation
of
identity
threats.
“We’re
having
more
discussions
about
identity
governance
and
identity
deployment
in
boardrooms,”
Scott
said.

Strengthen
unified
endpoint
management
(UEM)
with
a
consolidation
strategy

IT
and
cybersecurity
teams
are
leaning
on
their
UEM
vendors
to
improve
integration
between
endpoint
security,
endpoint
protection
platforms,
analytics,
and
UEM
platforms.
Leading
UEM
vendors,
including

IBM,

Ivanti,

ManageEngine,

Matrix42,

Microsoft
and

VMWare,
have
made
product,
service
and
selling
improvements
in
response
to
CISOs’
requests
for
a
more
streamlined,
consolidated
tech
stack.

Of
the
many
vendors
competing,

IBM,
Ivanti
and
VMWare
lead
the
UEM
market
with
improvements
in
intelligence
and
automation
over
the
last
year.
Gartner,
in
its

latest
Magic

Quadrant

for
UEM
Tools,
found
that
“security
intelligence
and
automation
remains
a
strength
as
IBM
continues
to
build
upon
rich
integration
with

QRadar
and
other
identity
and
security
tools
to
adjust
policies
to
reduce
risk
dynamically.
In
addition,
recent
development
extends
beyond
security
use
cases
into
endpoint
analytics
and
automation
to
improve
DEX.”

Gartner
praised
Ivanti’s
UEM
solution:
“Ivanti

Neurons
for
Unified
Endpoint

Management
is
the
only
solution
in
this
research
that
provides
active
and
passive
discovery
of
all
devices
on
the
network,
using
multiple
advanced
techniques
to
uncover
and
inventory
unmanaged
devices.
It
also
applies

machine
learning
(ML)
to
the
collected
data
and
produces
actionable
insights
that
can
inform
or
be
used
to
automate
the
remediation
of
anomalies.”

Gartner
continued,
“Ivanti
continues
to
add
intelligence
and
automation
to
improve
discovery,
automation,
self-healing,
patching,
zero-trust
security,
and
DEX
via
the
Ivanti
Neurons
platform.
Ivanti
Neurons
also
bolsters
integration
with
IT
service,
asset,
and
cost
management
tools.”

What’s
on
CISOs’
IAM
roadmaps
for
2023
and
beyond 

Internal
and
external
use
cases
are
creating
a
more
complex
threatscape
for
CISOs
to
manage
in
2023
and
beyond.
Their
roadmaps
reflect
the
challenges
of
managing
multiple
priorities
on
tech
stacks
they
are
trying
to
consolidate
to
gain
speed,
scale
and
improved
visibility.

The
roadmaps
VentureBeat
has
seen
(on
condition
of
anonymity)
are
tailored
to
the
distinct
challenges
of
the
financial
services,
insurance
and
manufacturing
industries.
But
they
share
a
few
common
components.
One
is
the
goal
of
achieving
continuous
authentication
as
quickly
as
possible.
Second,
credential
hygiene
and
rotation
policies
are
standard
across
industries
and
dominate
AM
roadmaps
today.
Third,
every
CISO,
regardless
of
industry,
is
tightening
which
apps
users
can
load
independently,
opting
for
only
an
approved
list
of
verified
apps
and
publishers.

The
most
challenging
internal
use
cases
are
authorization
and
adaptive
access
at
scale;
rolling
out
advanced
user
authentication
methods
corporate-wide;
and
doing
a
more
thorough
job
of
handling
standard
and
nonstandard
application
enablement.

External
use
cases
on
nearly
all
AM
roadmaps
for
2023
to
2025
include
improving
user
self-service
capabilities,
bring-your-own-identity
(BYOI),
and
nonstandard
application
enablement.

The
greater
the
number
of
constituencies
or
groups
a
CISOs’
team
has
to
serve,
the
more
critical
these
areas
of
AM
become.
CISOs
tell
VentureBeat
that
administering
internal
and
external
identities
is
core
to
handling
multiple
types
of
users
inside
and
outside
their
organizations.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts