Netanel Azoulay
31.03.2023
4 Key Takeaways from Gartner IAM Summit
The Gartner Identity and Access Management (IAM) Summit is an annual event that brings together IAM professionals to share their insights, knowledge, and best practices in the rapidly evolving field of IAM. This year, the summit provided a unique opportunity to learn about the latest trends and innovations in IAM, as well as to connect with other professionals and vendors in the field. In this blog post, we will highlight the top four takeaways from the Gartner IAM Summit 2023 and discuss why they are important for organizations looking to improve their overall security strategy.
1# Identity-First Security as the North Star of your Security Strategy
The first takeaway highlights the importance of context-aware policies for identity-first security strategies. Experts predict that by 2026, 70% of identity-first security strategies will fail unless organizations adopt continuous and consistent context-based access policies.
Identity + Context == The new perimeter.
As cyber threats become increasingly sophisticated, it’s essential to adopt an identity-first security mindset. This requires a continuous effort to identify and address vulnerabilities that attackers can exploit. For instance, the SolarWinds attack highlighted the importance of re-authenticating users before allowing them to register a new phone as a multifactor authentication device.
However, implementing context-aware policies presents challenges, including the use of different languages across different security tools. To address this, new standards such as Open Policy Agent (OPPA) and Identity Query Language (IDQL) are emerging, enabling organizations to author policies for one tool and translate them to others.
Fortunately, the industry is moving towards a more comprehensive, mature, and measurable zero-trust program. It’s estimated that by 2026, 10% of large enterprises will have such a program in place, up from less than 1% today. Nevertheless, achieving identity-first security is an ongoing effort, and continuous reassessment of security measures is crucial.
Adopting an identity-first security mindset, continuously assessing vulnerabilities, and adopting context-aware policies are critical in today’s cyber landscape. With the emergence of new standards like OPPA and IDQL, maintaining consistent and continuous security policies across different tools and applications will become easier. As more organizations embrace zero-trust programs, we can expect a more secure digital future.
2# Take A Pragmatic Approach when Implementing Zero Trust Architecture
The concept of Zero Trust Architecture (ZTA) has become increasingly important in today’s rapidly evolving security landscape, especially in a world where cloud and remote work are the norm. ZTA represents a new paradigm for cybersecurity, replacing implicit trust with continuously assessed explicit risk/trust levels based on identity and context. This approach is supported by security infrastructure that adapts to risk-optimize the organization’s security posture.
Identity and context have become the new perimeter in ZTA. Therefore, organizations should prioritize identity verification before granting access to any resources. Zero trust means zero implicit trust, and in a world of cloud and remote work, organizations need to ask themselves, what do they really control? Key tenets of ZTA include “never trust, always verify,” assuming compromise, encrypting all communications, using user/entity identity to establish trust, and extending risk-appropriate/least privileged access.
Segmentation is one of the most critical components of ZTA, as it isolates entities and environments to prevent the lateral spread of threats, reducing the attack surface and limiting the potential impact of security incidents. Furthermore, the cloud is a catalyst for ZT initiatives, enabling organizations to leverage the benefits of cloud-native apps and implement Zero Trust Network Access (ZTNA) for end-user access to apps.
To enable ZTA, the Gartner IAM Summit 2023 recommends ten initiatives that organizations should consider. These initiatives include getting the identity foundation right, implementing conditional access for all with multi-factor authentication (MFA), segmenting by default, encrypting all data, and monitoring everything to identify anomalies and excessive risk.
However, implementing a ZT security architecture can be complex and challenging, especially for starting organizations. That’s why it’s essential to take a pragmatic approach and focus on the following key steps:
- Start with a comprehensive & heterogeneous inventory: Before implementing a ZTA, you must understand ALL assets you are trying to protect. Create an inventory of all the identities on your digital surface, including devices, applications, data, and more, and classify them by their sensitivity and importance.
- Contextualize and visualize: map your entire digital estate with a deep contextual analysis to identify the relations and dependencies between all entities.
- Identify your protect surface and risk tolerance: Determine what level of risk your organization is willing to tolerate. This will guide your decisions about the security controls you must implement and where to focus your resources.
- Segment your digital estate: One of the critical principles of ZTA is to limit access to sensitive resources. You need to segment and enforce strict access controls. Create micro-perimeters around sensitive resources and only allow authorized users to access them.
- Implement multi-factor authentication: To enhance security further, consider implementing multi-factor authentication (MFA) for all user accounts. MFA adds an extra layer of protection by requiring users to provide additional authentication factors beyond just a password.
- Continuously monitor and update: Implementing a ZTA is not a one-time task. You must constantly monitor, revalidate, and adapt your security controls to new threats and vulnerabilities.
By implementing these initiatives, organizations can significantly enhance their security posture and better protect their assets against cyber threats.
In a nutshell, ZTA is an essential strategy for organizations looking to secure their assets in today’s cloud-first world. By adopting a ZTA approach and implementing the right tools and initiatives, organizations can stay ahead of emerging threats and ensure that their security posture remains robust and resilient. It is crucial to note that ZTA replaces the traditional model where authentication happens first and then connection. Instead, ZTA replaces it with a model where authentication happens first, and then connection. This new model emphasizes the importance of identity verification and context in securing an organization’s assets.
3# The Future is Coming Fast. Start Building the Cybersecurity Mesh Architecture.
Architecture.
Gartner, a leading research and advisory firm, has recently introduced a new approach to cybersecurity called the Cybersecurity Mesh Architecture (CSMA) is a relatively newly introduced cybersecurity paradigm by Gartner. This innovative strategy is designed to revolutionize the traditional defense-in-depth approach that many organizations have relied on for years. Rather than being a single product, the Cybersecurity Mesh Architecture is a set of interconnected and integrated products that work together to provide a clear visual map of an organization’s digital assets and help identify potential threats.
The Cybersecurity Mesh Architecture is built around four layers:
- Security intelligence
- Identity fabric
- Policy, posture, and playbook management
- Operations dashboard
These layers work together to provide comprehensive protection across an organization’s entire digital estate. The goal of this new approach is to shift from the traditional best-of-breed strategy to a more integrated one, where vendors collaborate to provide better security solutions.
One of the key aspects of the Cybersecurity Mesh Architecture is its emphasis on anomaly detection and response. This is essential for all devices, networks, data, and cloud services. The security model should rank the behavior profile of every entity across the entire digital estate, and all security products should be configured from a unified console. An operational dashboard is also necessary to provide real-time visualization of potential attacks, with entities changing colors from yellow to red, and showing predictions in real-time.
To achieve this level of security, Gartner recommends that companies hire a data scientist for their security team. Data science is an essential part of the strategy, and it allows organizations to leverage technologies such as AI, AR/VR, natural language interaction, voice recognition, swarm computing, and autonomous computing. Additionally, the Tetrix Model, which involves 3D visualization, is critical to the future of the Cybersecurity Mesh Architecture.
In summary, the Cybersecurity Mesh Architecture is a paradigm shift in how organizations approach cybersecurity. It requires vendors and organizations to work together, integrate their products, and share data and a common language. By doing so, organizations can better protect their digital assets and reduce the risk of cyber threats. The Cybersecurity Mesh Architecture is an essential strategy for any organization looking to stay ahead of emerging threats and ensure that their security posture remains robust and resilient.
4# Avoid the Next Breach with ITDR
ITDR, or Identity Threat Detection and Response, is an important discipline that helps organizations detect and respond to threats within their identity fabric. In today’s complex and ever-evolving cybersecurity landscape, ITDR provides a critical layer of defense against identity-based threats, which can have serious consequences for organizations.
Traditional Identity and Access Management (IAM) solutions are often unable to detect identity-based threats due to their limited scope and depth. Similarly, Security Operations Centers (SOCs) tend to focus on network security and overlook identity-based threats. This gap can leave organizations vulnerable to identity-based attacks, which account for a significant percentage of cyber attacks.
ITDR aims to bridge this gap by providing a comprehensive approach to detecting and responding to identity-based threats. This approach involves a combination of tools, threat intelligence, processes, knowledge base, and best practices, all geared towards identifying and mitigating identity threats.
One of the key benefits of ITDR is its ability to detect threats that may have been missed by traditional prevention tools such as IGA, CIEM, MFA, and PAM. While these tools can be effective in preventing some types of attacks, they are not foolproof and cannot prevent all attacks. ITDR focuses on detecting threats based on tactics, techniques, and procedures (TTP) as well as user behavior analysis.
When an identity breach is detected, ITDR involves a rapid and effective response to contain the threat and minimize damage. This response is based on a threat playbook that outlines a list of actions to take in the event of an identity breach. These actions may include traffic isolation, disabling provisioning and identity synchronization jobs, step-up authentication, and account quarantine. The incident report is also crucial to alert the SOC of the identity breach and perform necessary actions.
Data science and machine learning are also key components of ITDR, enabling organizations to analyze large volumes of data to detect and respond to identity-based threats in real-time. Gartner recommends that every organization should have a data scientist on their security team to enable effective data analysis.
In conclusion, ITDR is a critical component of a comprehensive cybersecurity strategy, providing a vital layer of defense against identity-based threats. By contextualizing tools, threat intelligence, processes, knowledge base, and best practices, ITDR helps organizations detect and respond to identity-based threats quickly and effectively, ultimately protecting their digital assets and reputation.
Thanks for emphasizing the relationship between Zero Trust and identity-first security