![\"5](\"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/10\/iam-insight-jam.jpg\")
<\/p>\n<\/p>\n
As part of the first-ever IAM Insight Jam, we’re having identity and access management experts share their expertise, knowledge, and more in guest blog posts! For this post, we had five cybersecurity leaders from privileged access management provider Centrify<\/a> share their opinions on modern privileged access.<\/p>\n Here’s what they had to say!<\/p>\n In an era where we see an increasing amount of data breaches making headlines, clearly something is broken. Organizations either do not know the top threats they are facing, or they are ill-prepared to protect themselves from cyber-attacks. We asked five of our leaders to each draw from their expertise to share one truth about modern privileged access.<\/p>\n Dr. Torsten George, Cybersecurity Evangelist<\/em><\/strong><\/p>\n The word \u201chacker\u201d is almost obsolete. Nowadays they simply look for the easiest way into a corporate network using weak, default, stolen, or otherwise compromised passwords.<\/p>\n We know that 74% of data breaches involve privileged access abuse<\/a>. Those \u201ckeys to the kingdom\u201d are what the cyber-attackers are after, so they can access critical systems for profitable data to sell on the Dark Web. So what do they do?<\/p>\n First, they get into the corporate network. That was easy. All it takes is one person using a weak password or, worse, giving it over to the attacker via a phishing scheme.<\/p>\n Second, they hunker down and fan out. It\u2019s easy to be patient when you look like a legitimate user. They scan the network, move laterally, and hunt for privileged accounts and their credentials. They take their time doing this, so they do not raise alerts, but in many instances, this can take just a few days, if not hours.<\/p>\n Finally, they elevate their privilege, access a sensitive host, or worse, compromise a high-value target like a domain controller. Then they extract the data and cover their tracks.<\/p>\n This is the new reality of \u201chacking.\u201d<\/p>\n Tony Goulding, Sr. Director \u2013 Technical Marketing<\/em><\/strong><\/p>\n As they move workloads to the cloud, many organizations are under the impression that the security of these workloads and data will be covered by Infrastructure-as-a-Service (IaaS) providers. Well, it doesn\u2019t quite work that way.<\/p>\n Image credit: Centrify<\/p><\/div>\n Yes, the cloud service provider \u2014 like AWS, Microsoft Azure, and Google Cloud Platform \u2014 is typically going to embed a certain amount of security for the core infrastructure and services. But the reality is that cloud security is a shared responsibility between the organization and the IaaS provider. Securing operating systems, platforms, and data remains the responsibility of the customer, and so does securing access to those cloud workloads.<\/p>\n Most IaaS providers will also include some Identity & Access Management (IAM) tools to control access to workloads in their environment. But this stops at the virtual machine level. I.e., it doesn\u2019t extend to the instance operating system to help control login and privilege elevation. It also introduces another silo of identities for the customer to manage.<\/p>\n Even if you find a balancing act, that line will change over time. If your organization is using a hybrid or multi-cloud strategy, those standalone access management tools won\u2019t be of much use to you on other cloud platforms.<\/p>\n Your best option is to accept the shared responsibility model and invest in a modern, cloud-ready Privileged Access Management<\/a> solution that can span across all of your resources, whether they are on-premises, in public clouds, or any mix in between.<\/p>\n David McNeely, Chief Strategy Officer<\/em><\/strong><\/p>\n Everyone knows that DevOps is all about agility \u2013 go fast, keep obstacles out of the way, let developers innovate.<\/p>\n By now, however, most people know that no matter how fast you\u2019re trying to get out of the way for innovation, you can\u2019t leave security behind. It has to be built into the DevOps process<\/a>. That not only means securing hundreds or even thousands of containers and microservices, but also securing the tools used by cloud ops such as Chef, Puppet, and Ansible as well as your IaaS provider. That\u2019s what puts the \u201cSec\u201d in DevSecOps.<\/p>\n The mistake we most often see is that people think these solutions are more contained than they are, and don\u2019t bring forward best practices because of the assumption they have more boundaries than they actually do.<\/p>\n Each of these potential exposure points can be exploited by cyber-attackers. All it takes is one unsecured credential to a container and bad actors are in, and potentially have the ability to get out of the DevOps environment and into more sensitive areas of the corporate network. They need to be treated no differently than any other credential and properly controlled with privileged access.<\/p>\n Jeremy Stieglitz, VP Product Management<\/em><\/strong><\/p>\n We\u2019re coming up on 20 years of tools that help administrators vault shared accounts, and in some ways, it has become the de facto 80% of Privileged Access Management is to vault away shared accounts.<\/p>\n We\u2019re also seeing the stresses, strains, and breakings of that security approach to privilege. Workloads that get started and stopped within an hour. Sessions that need to be securely managed from a jump host (or bastion host). Resources that require credential tiering and alternative accounts. These are all scenarios that would be better served with an identity-centric approach to least privilege \u2013 Zero Trust Privilege.<\/p>\n Sometimes people end up in an 80\/20 situation because it\u2019s easier, but it doesn\u2019t set you up for success going forward. For any direction you want to go \u2013 multi-cloud, DevOps and automation, secure remote access \u2013 identity-centric least privilege gives you the flexibility, accountability, and policy and risk control for the future.<\/p>\n Dean Thompson, Sr. VP \u2013 Customer Experience<\/em><\/strong><\/p>\n When we talk to customers, we generally get the sense that they understand the urgency and the challenges ahead of them when it comes to enterprise security. How could they not? It seems like there is a data breach reported in the news every day.<\/p>\n But do they really know the actual risks or the expanding breadth of the threatscape before them, or do they know how difficult it can be to get executive buy-in to secure the perimeter-less enterprise?<\/p>\n When I speak to our customers, I hear any range of understanding about threats, where the actual risks lie, how to address them, and how much it\u2019s going to cost. And that\u2019s fine \u2013 it opens the door for conversation, and opportunities to educate, and hopefully to help guide them down the path to a stronger security posture.<\/p>\n We have the ability to not only educate our customers about the need for Privileged Access Management of their most critical systems but also about taking a Zero Trust approach to cybersecurity generally.<\/p>\n Thanks to the leaders from Centrify<\/a> for their time and expertise! You can see more insights like this in the IAM Insight Jam by following the #IAMInsightJam Hashtag on Twitter and LinkedIn. Also, check out our updated Privileged Access Management<\/a> and Identity Management Buyer’s Guides<\/a>.<\/p>\n As part of the first-ever IAM Insight Jam, we’re having identity and access management experts share their expertise, knowledge, and more in guest blog posts! For this post, we had five cybersecurity leaders from privileged access management provider Centrify share their opinions on modern privileged access. Here’s what they had to say! 5 Truths About […]<\/p>\n","protected":false},"author":41,"featured_media":4604,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5,6,1],"tags":[1299,142,125,24,1300,16,76,1298,124,123,90,25],"acf":[],"yoast_head":"\n\t\t\t![\"Download](\"https:\/\/solutionsreview.com\/identity-management\/files\/2020\/01\/PAM_BG_SB_800.gif\" "\\"\\"")
<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\n5 Truths About Modern Privileged Access from Centrify Leaders<\/strong><\/h2>\n
1. Cyber-Attackers No Longer \u201cHack\u201d In \u2013 They Log In<\/strong><\/h3>\n
2. Cloud Security is a SHARED Responsibility
\n<\/strong><\/h3>\n![\"Modern](\"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/12\/Centrify-Iamge.jpg\")
3. DevSecOps and MSA: Built-In Security as You Run
\n<\/strong><\/h3>\n4. The 80\/20 Rule is Backwards in PAM\u00a0<\/strong><\/h3>\n
5. Customers Know the Challenges They\u2019re Facing\u2026or Not?
\n<\/strong><\/h3>\nHow to Learn More<\/strong><\/h3>\n
Widget not in any sidebars
<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"