Introduction As CISOs, we often face regulations that seem far removed from the practical realities of running identity and access infrastructure. The UK’s Telecommunications Security Act (TSA) and its accompanying Code of Practice mark a significant shift in that dynamic. Identity and privileged access management are no longer back-office hygiene tasks; they are front-line compliance…
Tag Archives: identity security
-
Self Assessment: Modern Access Management Maturity
To conclude this 5 part series on the importance of comprehensive and deliberate NHI governance, we are pleased to share this self assessment framework to help organizations understand where they are in their access management maturity journey. In case you missed it, here’s what we’ve covered so far: 1. Outnumbered and underprotected: the hidden risk…
-
New IAM Cybersecurity and PAM Tools Strategies for Higher Education
In the classroom, universities and colleges are looking towards the future with their curricula, stretching young minds around evolving concepts and advancements. The irony? Behind the scenes, these same institutions are often unprepared for the changes that developing technology brings to their campuses and networks. Recent digital disruptions, such as AI, have exposed the systems…
-
Close the NHI Governance Gap
We’ve spent the better part of the last decade tightening our grip on workforce authentication. SSO is widespread. MFA is table stakes. Access reviews, offboarding workflows, and role-based policies are now standard practice. It took time and iteration, but we got there. Now it’s time to apply that same rigor to machine identities. The service…
-
Start Governing NHIs by Managing Access, Not Credentials
This is part 3 in our series on non-human identity (NHI) governance. In this post, we focus on one of the most persistent risks in production infrastructure: static credentials and standing privilege. Static credentials are still at large in most environments and many enable dangerously over-permissioned and under-governed access to sensitive systems and data. API…
-
Beyond Humans: Governing Machine Identity Access at Scale
In organizations today, every identity—human or machine—is a potential pivot point in an attack. Most progress in identity security has focused on authenticating people: SSO, MFA, admin lockdowns, automated provisioning. Important steps, but they only address half the identities accessing your systems. The other half—machines like CI/CD pipelines, service accounts, automation tools, AI agents, and…
-
5 Reasons Disconnected Apps Are An Enterprise Risk You Can No Longer Ignore
Companies of every size depend on Identity and Access Management (IAM), Identity Governance and Administration (IGA), and Privileged Access Management (PAM) to secure logins, enforce policies, and meet compliance requirements. These platforms are the backbone of modern identity security. But there’s a problem: they can only secure what they connect to. The apps that don’t…
-
Do Your CI/CD Pipelines Need Identities? Yes.
If one principal can do anything, one mistake can undo everything. I’ve read too many incident reviews where the “automation user” turned out to be the attacker’s best friend. One token. All the doors. Code, artifacts, production. We built CI/CD to go fast. We accidentally made it the fastest path to a breach. Just like…
