The importance of machine identities and non-person entities (or non-human identities) in the enterprise is often overlooked. Machine identities govern the confidentiality and integrity of information [flow] between machines. To ensure their unique identities, machines use keys and certificates, similar to people’s use of usernames and passwords (source Venafi). Automation is being used to drive…
Archives
-
Best Practice: Enabling Visibility as Part of Cloud Infrastructure Entitlements Management (CIEM)
Today’s modern enterprises rely heavily on cloud infrastructure, and permissions are essentially the backbone of access to cloud based resources. To effectively manage entitlements – access to your organization’s resources such as sensitive data and mission critical assets – the core proficiencies you need are: access to an inventory of all your cloud identities and…
-
DevSecOps TWG: Protecting Identities in the DevOps Pipeline
DevOps and DevSecOps, these are the two words that most of the IT Enterprises seem to be fixated on in the last several years. While DevOps aims to shorten the software development life cycle and continuous delivery of applications, DevSecOps embeds Security into the DevOps life cycle. DevOps deals with the process and tools and DevSecOps…
-
Beyond Best Practices TWG Brings New Insights and Also… Sharks?
As we celebrate the first-ever Identity Management Day, I had a chance to reflect on the Beyond Best Practices Technical Working Group’s contributions over the past year, and one word came to mind: Creativity. It’s the one skill that underpins nearly every successful identity management team. Whether it’s finding a way to glue together the Active…
-
Identity Management Day: What Sharks and Your Identity Program Have in Common
Legend has it that in 1988 the idea for Shark Week was hatched over a round of drinks and documented on the back of a napkin as an awesome (and fun) way to capture more viewers. Seems like it worked: Discovery Channel viewers doubled after the very first Shark Week. Fast forward to 2021, and…
-
The Unique Challenges of Customer Identity and Access Management
As the world faced quarantines, stay at home orders and shuttered businesses, even normally reluctant consumers were forced to go online to grocery shop, order take-out and stay connected to friends and family. This focus on transacting daily tasks on-line placed a major spotlight on an emerging subset of identity security, customer identity and access…
-
IAM Best Practices Blog Series: Why it is Critical to Establish an IAM Governance Committee
In previous IAM Best Practices blogs my fellow customer advisory board members dove into identity ownership, ensuring identity uniqueness, where to start with provisioning and de-provisioning, discovery of assets for privileged access and establishing processes for incorporating IAM into new applications. In this blog post, I will explain why it is critical to establish a governance committee as part of identity and access…
-
Zero Trust Myth Series: Going Beyond the Network
First impressions die hard. When the concept of Zero Trust was first introduced, the focus was on segmenting, isolating, and controlling network traffic. Today, however, those ideas represent only one fraction of a Zero Trust strategy. On my list of Zero Trust myths, the second fallacy I noted was the idea that Zero Trust focuses solely on…
-
Optiv: Integrating IAM and Cyber Security Tools for a Zero Trust Approach
Over the past few years traditional security techniques, like perimeter-based security, have not managed to prevent security breaches. Breaches continue to rise despite bigger and better network security devices. So what has caused some of these breaches? Specifically, employee negligence or loss, insider threats, hacking and data mobility across devices are all leading causes. However,…
