Join IDSA
Join IDSA

Archives

  1. From AAA to Assurance: How the UK Telecoms Security Act Is Shaping Identity-Based Network Control

    October 31st, 2025 by Paul Hunter | Posted in News, Perspective, Research, Security Outcomes |

    Tags: , , , , , , , ,

    Introduction As CISOs, we often face regulations that seem far removed from the practical realities of running identity and access infrastructure. The UK’s Telecommunications Security Act (TSA) and its accompanying Code of Practice mark a significant shift in that dynamic. Identity and privileged access management are no longer back-office hygiene tasks; they are front-line compliance…

  2. Identity and Access Management and Identity Governance Explained

    October 22nd, 2025 by Paul Hunter | Posted in Best Practices, Perspective, Security Outcomes |

    Tags: , , , , , , , , ,

    Mitigating identity-related access risks is critical as organizations face evolving threats daily. As businesses shift to multi-cloud and hybrid environments, identity sprawl such as shadow IT and unmanaged SaaS apps has become a top attack vector. Identity and access management (IAM) and identity governance and administration (IGA) must now secure identities beyond corporate perimeters, spanning AWS, Azure, Google Cloud, and SaaS platforms…

  3. Red Hat’s GitLab Breach and the Cost of Embedded Credentials

    October 14th, 2025 by Paul Hunter | Posted in Best Practices, Perspective, Research, Security Outcomes |

    Tags: , , ,

    Open-source software giant Red Hat has confirmed that one of its GitLab instances, dedicated to consulting engagements, was breached. The attackers, a group calling itself “Crimson Collective,” claim to have taken nearly 28,000 private repositories and roughly 800 Customer Engagement Reports (CERs). CERs often contain detailed records of client environments – network diagrams, configuration data,…

  4. Break Glass Accounts – Risk or Required

    October 1st, 2025 by Paul Hunter | Posted in Best Practices, Perspective, Research |

    Tags: , , , , , , , , , , , , , ,

    We have all seen the sign, “In case of fire, break glass, and pull alarm.” While this necessary mitigating control for fire safety is explicitly known and present in almost every building, an analogy translates into the cybersecurity landscape as “break glass accounts.” In fact, few risk-mitigating controls stir as much debate among CISOs as…

  5. Identity Blind Spots on the Network Layer

    September 25th, 2025 by Paul Hunter | Posted in Perspective, Research, Security Outcomes |

    Tags: , , , , , , , , , , , ,

    Webinar Title: Zero Trust Falls Short Without Network Identity: Lessons from Salt Typhoon Date: October 1, 2025 Registration: Save your spot here Abstract Identity for users, applications, servers, and cloud has matured. Network devices are often the exception. Shared device accounts, SSH key sprawl, limited per-command authorization, and weak session evidence create a gap that…

  6. Salt Typhoon: How Network Admin Paths Became Attack Paths

    September 23rd, 2025 by Paul Hunter | Posted in News, Perspective, Security Outcomes |

    Tags: , , , , , , , , ,

    Webinar Title: Zero Trust Falls Short Without Network Identity: Lessons from Salt Typhoon Date: October 1, 2025 Registration: Save your spot here Abstract Salt Typhoon highlights how valid credentials and built in tools can turn network administration into an attacker highway. This post walks a likely attack chain in plain language and shows where identity…

  7. How Convergent Identity-Based Security Reduces Risk, Increases Efficiency

    August 26th, 2025 by Paul Hunter | Posted in Best Practices, News, Perspective, Research |

    Tags: , , , , ,

    This blog was originally published by Bravura Security here.   In an era where 80% of data breaches involve compromised credentials and privilege escalation, traditional identity and access management (IAM) and privileged access management solutions (PAM) solutions are falling behind. While organizations have invested millions in layered implementations rooted in traditional enterprise approaches, these solutions…

  8. 2025’s Identity Security Storm: AI, IoT and Emerging Threats

    August 20th, 2025 by Paul Hunter | Posted in Best Practices, News, Perspective, Research, Security Outcomes |

    Tags: , , , , , , ,

    This blog was originally published by Bravura Security here. A stark reality faces modern enterprises: 94% of cyber attacks now specifically target identity systems, not traditional network defenses. As threats rapidly evolve, organizations struggling with fragmented identity and access management (IAM), privileged and access management (PAM), and password management architectures face increasing risk from sophisticated…

  9. How to Prevent $4M Breaches with Unified IAM and PAM Defense

    August 5th, 2025 by Paul Hunter | Posted in Best Practices, How To Advice, Perspective |

    Tags: , ,

    The identity security landscape has reached a critical tipping point. As AI-powered attack tools become readily available, attackers target identity credentials and privileged access with unprecedented sophistication and scale. Traditional fragmented security approaches are crumbling under the weight of automated threats that can simultaneously exploit both identity and privilege vulnerabilities.  According to EMA Research, the…

  10. 5 Things I learned delivering Zero Trust at Adobe and Cisco

    July 3rd, 2025 by Paul Hunter | Posted in Perspective |

    This blog was originally published by 909Cyber here.   Between 2017 and 2022 I was fortunate to be the leader responsible for the strategy and execution of Zero Trust initiatives at Adobe and Cisco. In my role of running enterprise Security for both companies (of course not at the same time). As the executive leading…

Next Entries »
Background

READY TO MAKE AN IMPACT?

Let's work together to help everyone become more secure.
Join the IDSA