February 18, 2016 By Jason Keenaghan 3 min read

Digital transformation: What does it mean for you and your business? The old way of engaging with clients, business partners and even employees is rapidly changing. The new engagement model is focused on collaboration and is increasingly delivered via a mobile channel. Clients demand a first-class user experience; when those expectations cannot be met, low switching costs often result in direct impacts to business results. Even for internal users, the consumerization of IT is driving the same high level of expectations at work.

Digital Evolution Leads to Security Concerns

As organizations adopt technologies like cloud, APIs and the Internet of Things (IoT) to assist them in this digital transformation, security remains a top concern for CISOs and IT professionals. However, one message has come across loud and clear: Business progress will not be derailed by the concerns of security and IT organizations. These groups need to get on board and enable this progress or they risk being left behind or, even worse, completely run over.

Identity and access management (IAM) — that oft-neglected part of your IT environment — holds the key to not only delivering an optimal end user experience in support of your digital transformation, but also to its becoming your first security control. In the digital world, the traditional network perimeter we formerly relied on is no longer sufficient.

Individuals, applications and “things” alike are accessing critical data and resources. Each of these has an identity. It is necessary to have a clear understanding of those identities, what they should have access to, whether their actions are consistent with normal behaviors and what risks they represent to your organization.

Protecting Against Insider Threats

Solutions such as identity governance, analytics and privileged user management are critical components in this digital world for protecting against the myriad of insider threats. First, there is a need to rapidly detect malicious insider activity. This usually requires some form of baselining normal user behavior and then applying intelligence to determine and alert on anomalous behavior.

Identity context is critical to effective insider threat detection. What resources does an identity have access to? Is this normal or expected based on the individual’s role? What is the level of risk associated with a given identity?

The second aspect of an insider threat is being able to actively mitigate the risk associated with insider activity. This may involve implementing tools and processes to control access to shared or privileged credentials in order to protect your crown jewels.

In the world of mobile, that same need to protect critical business assets exists. However, in this world, organizations typically exert less control over the devices individuals use to access those resources. Even where the use of an enterprise mobility management solution might provide greater device-level control, there are still many more variables and risk factors associated with the mobile channel.

Therefore, it becomes necessary for organizations to implement a more dynamic and risk-driven approach to user security. Contextually aware access policies make it possible to deliver increased security without negatively impacting the end user experience.

Read the IBM research report: Battling Security Threats From Within Your Organization

Adding Context to Identity Management

So what do we mean by context in security? This includes information about the device, the user, the environment, the resource being accessed and past behavior.

With a rich set of context, you can implement policies that provide the right level of identity assurance you require to mitigate the risk associated with certain activities. Does it seem odd that one of your employees is suddenly attempting to access an application from a device they have never used before? Perhaps it would be prudent to invoke a stronger form of authentication?

Digital businesses must rapidly adapt to changing market conditions. For all the benefits that IAM can provide in support of these goals, legacy environments that have not been upgraded to provide the latest technological capabilities can become a blocker rather than a business enabler.

To this end, many organizations are turning to cloud-delivered IAM solutions to provide faster time to value, scalability and reduced operational costs. Cloud IAM capabilities may come in multiple forms, from a set of APIs that allow for tightly bound application integration to self-service multitenant software-as-a-service (SaaS) solutions and finally to fully managed, cloud-hosted IAM environments.

More from Identity & Access

Access control is going mobile — Is this the way forward?

2 min read - Last year, the highest volume of cyberattacks (30%) started in the same way: a cyber criminal using valid credentials to gain access. Even more concerning, the X-Force Threat Intelligence Index 2024 found that this method of attack increased by 71% from 2022. Researchers also discovered a 266% increase in infostealers to obtain credentials to use in an attack. Family members of privileged users are also sometimes victims.“These shifts suggest that threat actors have revalued credentials as a reliable and preferred…

Passwords, passkeys and familiarity bias

5 min read - As passkey (passwordless authentication) adoption proceeds, misconceptions abound. There appears to be a widespread impression that passkeys may be more convenient and less secure than passwords. The reality is that they are both more secure and more convenient — possibly a first in cybersecurity.Most of us could be forgiven for not realizing passwordless authentication is more secure than passwords. Thinking back to the first couple of use cases I was exposed to — a phone operating system (OS) and a…

Obtaining security clearance: Hurdles and requirements

3 min read - As security moves closer to the top of the operational priority list for private and public organizations, needing to obtain a security clearance for jobs is more commonplace. Security clearance is a prerequisite for a wide range of roles, especially those related to national security and defense.Obtaining that clearance, however, is far from simple. The process often involves scrutinizing one’s background, financial history and even personal character. Let’s briefly explore some of the hurdles, expectations and requirements of obtaining a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today