{"id":6058,"date":"2022-09-07T09:41:30","date_gmt":"2022-09-07T13:41:30","guid":{"rendered":"https:\/\/solutionsreview.com\/identity-management\/?p=6058"},"modified":"2022-09-07T09:42:17","modified_gmt":"2022-09-07T13:42:17","slug":"compromised-identities-and-the-importance-of-a-zero-trust-strategy","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/identity-management\/compromised-identities-and-the-importance-of-a-zero-trust-strategy\/","title":{"rendered":"Compromised Identities and The Importance of a Zero Trust Strategy"},"content":{"rendered":"

\"Compromised<\/p>\n

As part of Solutions Review\u2019s Premium Content Series\u2014a collection of contributed columns written by industry experts in maturing software categories\u2014 Joseph Carson of Delinea<\/a> breaks down the threat of compromised identities and the importance of implementing a zero trust strategy.<\/strong><\/em><\/p>\n

\"PremiumAlmost everything we encounter each day is computerized in some way, increasing our risks of a cyber-attack. Connecting to the internet, whether it\u2019s through an enterprise computer system, an app on a phone, or performing a typical transaction in a store, opens the possibility of a malicious hacker stealing data.<\/p>\n

Cyber-crime is a big business, and in response, cybersecurity is becoming an increasing focus of governments and organizations on a global scale. Without it, organizations are at risk of significant financial and reputational damage. Unfortunately, one of the greatest risks comes from within. Insiders play a massive role in the protection of organizations of all sizes and types. Looking back on some of the most high-profile attacks of the last year revealed a common thread– compromised identities.<\/p>\n


Widget not in any sidebars
<\/p>\n

The Risk from Inside Your Company<\/strong><\/h3>\n

When a massive security breach makes headlines, it often involves bad actors from foreign countries or a \u201cperfect storm\u201d of technological failures and malicious hackers acting opportunistically. These stories make it seem like \u201cit wouldn\u2019t happen to me.\u201d But it can, and it most likely already has. The high-profile SolarWinds breach is just one example. At first, the breach seems to be the result of calculated moves from sophisticated foreign actors. Upon deeper investigation, however, it appears to have started with compromised credentials and routine software updates. The hack was orchestrated in a specific manner. The victims had to download a compromised software update and deployed it. Then, the compromised network needed to connect to the internet to allow the malicious hackers to communicate with and control the servers.<\/p>\n

SolarWinds isn\u2019t an outlier. The Colonial Pipeline attack was rooted in stolen credentials from an inactive account. All it took was one stolen password, and the malicious hackers disrupted fuel supplies to the U.S Southeast, crippling key conduits delivering fuel from Gulf Coast refineries to major East Coast markets. With Colonial Pipeline, multi-factor authentication could\u2019ve reduced the risks or made the security incident more difficult. If the attacker had to verify their identity using multi-factor authentication, it would have been more challenging to move through the network so easily and cause so much damage. Basic cybersecurity was not enforced in these instances, but the common denominator is still people. And people are at the core of all businesses of all sizes and industries. Any of them have the potential to become a risk. Attackers are always looking for ways to abuse our trust, and we must explore ways that continuously verifies and validates trust at all times.<\/p>\n

These are the primary types of insider risks and errors:<\/p>\n

    \n
  • Human Error:<\/strong> Human error is a major factor in breaches. Lost devices, confidential data sent via an insecure network, misaddressed emails, and other minor mistakes can end up costing a business in financial and reputational damage.<\/li>\n
  • Leak Passwords and Malicious Intent:<\/strong> Human error is one thing, since the employees aren\u2019t actively trying to destroy the system. Malicious insiders are a different story \u2013 they leak passwords with the intent to harm or damage the company by selling data or intelligence. However, malicious insiders tend to be low, but the impact is high.<\/li>\n
  • Stolen Identities:<\/strong> Cybercriminals often steal identities to gain access. This may be done by compromising an employee account through phishing attacks or malware or possibly with stolen credentials. In either case, attackers can increase privileges within a system, leading them to the information they\u2019re after.<\/li>\n<\/ul>\n

    The scariest part of insider risks is that the activity comes from trusted sources within trusted accounts or systems, so it may not be immediately detected by procedures or technologies. Attackers can also erase any evidence of their activities to complicate forensic investigations. If this sounds like the \u201cperfect crime,\u201d it is. Restrictive security policies may be effective at preventing some cyber-crime, but they leave vulnerability with compromised identities and inhibit productivity and innovation.<\/p>\n

    Implementing a Zero Trust Strategy<\/strong><\/h3>\n

    Implementing stringent protocols and technologies to address cybersecurity is a good start, but broader initiatives like a zero-trust architecture are essential to balance security with a positive user experience. A zero trust strategy must also include a zero friction security approach to get more employees to use security.<\/p>\n

    Instead of assuming everything is trusted within a company network, the zero trust model assumes a breach and verifies each request as though it came from an untrusted source, no matter where it originated or the application or data it accesses. \u201cNever trust, always verify\u201d is the guiding adage. The zero trust model requires that all users within the network be authenticated, authorized, and validated before gaining access to data or applications. Microsegmentation and least privilege access minimize lateral movement in the network, and analytics are used to detect and respond to threats in real-time.<\/p>\n

    It relies on seven guiding principles:<\/p>\n

      \n
    • Evolving perimeter:<\/strong> Managing and defending a perimeter isn\u2019t the old metaphor of a castle wall anymore. Cloud networks and remote workforces have made this traditional model impractical, and zero trust is a strategy to integrate security throughout the network. Mitigating risk can still take place at the perimeter level, however.<\/li>\n
    • Verification and authentication:<\/strong> All users should be authenticated and verified based on available information, including location, user identity, service or workload, and more.<\/li>\n
    • Principle of least privileged access:<\/strong> user access is limited with privileged access, which is just-in-time and just-enough. Users are only given the minimum access they need to perform a task and only for the time they need to complete it. Once it\u2019s finished, privilege is revoked.<\/li>\n
    • Assume a breach:<\/strong> Zero trust minimizes a breach’s \u201cblast radius\u201d and segments access to limit damage. Analytics can be used to gain visibility, detect threats, and improve defenses.<\/li>\n
    • Zero inherent trust:<\/strong> As the name implies, zero trust architecture assumes nefarious intent until otherwise proven. All service and application requests must be verified at tall network levels.<\/li>\n
    • Workforce, workplace, workload:<\/strong> Workforce means establishing trust levels of users or devices to determine access privileges. Workplace means implementing trust-based access control on networks. Workload means preventing unauthorized access within the segmented networks, no matter where they\u2019re hosted.<\/li>\n
    • Continuous trust verification:<\/strong> Zero trust requires users to establish trust by verifying their identity using various means, including device location and multi-factor authentication. It enforces the least privileged access to networks and applications.<\/li>\n<\/ul>\n

      Zero trust encompasses several defense areas, including:<\/p>\n

        \n
      • Identities:<\/strong> Each identity is verified and secured with authentication and authorization.<\/li>\n
      • Endpoints:<\/strong> Before access is granted, compliance and health status must be verified.<\/li>\n
      • Apps:<\/strong> Appropriate in-app permissions, gated access based on analytics, and monitored and controlled user actions limit app vulnerabilities.<\/li>\n
      • Data:<\/strong> Data-driven protection takes priority over perimeter-based protection with restricted access and encryption along with a strong backup strategy.<\/li>\n
      • Infrastructure:<\/strong> Risky activities are automatically blocked and flagged, and least privileged access principles limit compromised identities.<\/li>\n
      • Network:<\/strong> No devices are trusted for simply being on the internal network. Access is limited, communications are encrypted, and micro-segmentation prevents lateral movements through the network.<\/li>\n<\/ul>\n

        Protect Yourself from Internal Risks<\/strong><\/h3>\n

        Zero trust isn\u2019t new, but it\u2019s more relevant than ever. Businesses are collecting more and more data stored in the cloud, workforces are distributed across the globe, and the traditional network perimeter isn\u2019t good enough. Cyber-criminals know the fast track to sensitive data is through compromised identities, and the best way to protect these assets is with least privileged access and the principles of a zero trust model.<\/p>\n


        Widget not in any sidebars
        <\/p>\n","protected":false},"excerpt":{"rendered":"

        As part of Solutions Review\u2019s Premium Content Series\u2014a collection of contributed columns written by industry experts in maturing software categories\u2014 Joseph Carson of Delinea breaks down the threat of compromised identities and the importance of implementing a zero trust strategy. Almost everything we encounter each day is computerized in some way, increasing our risks of […]<\/p>\n","protected":false},"author":151,"featured_media":6060,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5,1],"tags":[1773,1990,1991,16,11,1598,1242,1349,1103,1104,1992],"acf":[],"yoast_head":"\nCompromised Identities and The Importance of a Zero Trust Strategy<\/title>\n<meta name=\"description\" content=\"Joseph Carson of Delinea breaks down the threat of compromised identities and the importance of implementing a zero trust strategy.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/identity-management\/compromised-identities-and-the-importance-of-a-zero-trust-strategy\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Joseph Carson\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/compromised-identities-and-the-importance-of-a-zero-trust-strategy\/\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/compromised-identities-and-the-importance-of-a-zero-trust-strategy\/\",\"name\":\"Compromised Identities and The Importance of a Zero Trust Strategy\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/compromised-identities-and-the-importance-of-a-zero-trust-strategy\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/compromised-identities-and-the-importance-of-a-zero-trust-strategy\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2022\/09\/Compromised-Identities-and-The-Importance-of-a-Zero-Trust-Strategy.jpg\",\"datePublished\":\"2022-09-07T13:41:30+00:00\",\"dateModified\":\"2022-09-07T13:42:17+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/a0e8fd9af257a7e2782b7739e6b81e12\"},\"description\":\"Joseph Carson of Delinea breaks down the threat of compromised identities and the importance of implementing a zero trust strategy.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/compromised-identities-and-the-importance-of-a-zero-trust-strategy\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/identity-management\/compromised-identities-and-the-importance-of-a-zero-trust-strategy\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/compromised-identities-and-the-importance-of-a-zero-trust-strategy\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2022\/09\/Compromised-Identities-and-The-Importance-of-a-Zero-Trust-Strategy.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2022\/09\/Compromised-Identities-and-The-Importance-of-a-Zero-Trust-Strategy.jpg\",\"width\":800,\"height\":400,\"caption\":\"Compromised Identities\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/compromised-identities-and-the-importance-of-a-zero-trust-strategy\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/identity-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Compromised Identities and The Importance of a Zero Trust Strategy\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/\",\"name\":\"Best Identity Access Management (IAM) Software, Tools, Vendors, Solutions, & Services\",\"description\":\"Identity Access Management (IAM) News, Best Practices and Buyer's Guide\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/identity-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/a0e8fd9af257a7e2782b7739e6b81e12\",\"name\":\"Joseph Carson\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/82c6207057da9ba34f719ec881854fc3?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/82c6207057da9ba34f719ec881854fc3?s=96&d=mm&r=g\",\"caption\":\"Joseph Carson\"},\"description\":\"Joseph Carson is a cybersecurity professional with more than 25 years\u2019 experience in enterprise security and infrastructure. Currently, Carson is the Chief Security Scientist & Advisory CISO at Delinea. He is an active member of the cybersecurity community and a Certified Information Systems Security Professional (CISSP). Carson is also a cybersecurity adviser to several governments, critical infrastructure organizations, and financial and transportation industries, and speaks at conferences globally.\",\"sameAs\":[\"https:\/\/delinea.com\/\",\"https:\/\/www.linkedin.com\/in\/josephcarson\/\"],\"url\":\"https:\/\/solutionsreview.com\/identity-management\/author\/jcarson\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Compromised Identities and The Importance of a Zero Trust Strategy","description":"Joseph Carson of Delinea breaks down the threat of compromised identities and the importance of implementing a zero trust strategy.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/identity-management\/compromised-identities-and-the-importance-of-a-zero-trust-strategy\/","twitter_misc":{"Written by":"Joseph Carson","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/identity-management\/compromised-identities-and-the-importance-of-a-zero-trust-strategy\/","url":"https:\/\/solutionsreview.com\/identity-management\/compromised-identities-and-the-importance-of-a-zero-trust-strategy\/","name":"Compromised Identities and The Importance of a Zero Trust Strategy","isPartOf":{"@id":"https:\/\/solutionsreview.com\/identity-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/identity-management\/compromised-identities-and-the-importance-of-a-zero-trust-strategy\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/identity-management\/compromised-identities-and-the-importance-of-a-zero-trust-strategy\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2022\/09\/Compromised-Identities-and-The-Importance-of-a-Zero-Trust-Strategy.jpg","datePublished":"2022-09-07T13:41:30+00:00","dateModified":"2022-09-07T13:42:17+00:00","author":{"@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/a0e8fd9af257a7e2782b7739e6b81e12"},"description":"Joseph Carson of Delinea breaks down the threat of compromised identities and the importance of implementing a zero trust strategy.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/identity-management\/compromised-identities-and-the-importance-of-a-zero-trust-strategy\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/identity-management\/compromised-identities-and-the-importance-of-a-zero-trust-strategy\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/identity-management\/compromised-identities-and-the-importance-of-a-zero-trust-strategy\/#primaryimage","url":"https:\/\/solutionsreview.com\/identity-management\/files\/2022\/09\/Compromised-Identities-and-The-Importance-of-a-Zero-Trust-Strategy.jpg","contentUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2022\/09\/Compromised-Identities-and-The-Importance-of-a-Zero-Trust-Strategy.jpg","width":800,"height":400,"caption":"Compromised Identities"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/identity-management\/compromised-identities-and-the-importance-of-a-zero-trust-strategy\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/identity-management\/"},{"@type":"ListItem","position":2,"name":"Compromised Identities and The Importance of a Zero Trust Strategy"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/identity-management\/#website","url":"https:\/\/solutionsreview.com\/identity-management\/","name":"Best Identity Access Management (IAM) Software, Tools, Vendors, Solutions, & Services","description":"Identity Access Management (IAM) News, Best Practices and Buyer's Guide","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/identity-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/a0e8fd9af257a7e2782b7739e6b81e12","name":"Joseph Carson","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/82c6207057da9ba34f719ec881854fc3?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/82c6207057da9ba34f719ec881854fc3?s=96&d=mm&r=g","caption":"Joseph Carson"},"description":"Joseph Carson is a cybersecurity professional with more than 25 years\u2019 experience in enterprise security and infrastructure. Currently, Carson is the Chief Security Scientist & Advisory CISO at Delinea. He is an active member of the cybersecurity community and a Certified Information Systems Security Professional (CISSP). Carson is also a cybersecurity adviser to several governments, critical infrastructure organizations, and financial and transportation industries, and speaks at conferences globally.","sameAs":["https:\/\/delinea.com\/","https:\/\/www.linkedin.com\/in\/josephcarson\/"],"url":"https:\/\/solutionsreview.com\/identity-management\/author\/jcarson\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts\/6058"}],"collection":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/users\/151"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/comments?post=6058"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts\/6058\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/media\/6060"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/media?parent=6058"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/categories?post=6058"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/tags?post=6058"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}