\u00a0<\/em><\/span><\/p>\nOur identity is highly valuable to cybercriminals, especially within the digital context. Identity crime is not new to the 21st century, but in an increasingly global world connected via remote devices and software, the risk of identity threats is high and even higher depending on whose identity cyber-criminals target. If they can impersonate an employee with access to proprietary or financial information, the consequences can be significant. According to our data, 95 percent of organizations are impacted by critical misconfigurations of the systems used to manage digital identities.<\/span>\u00a0<\/span><\/p>\nDigital identity systems are designed to address three fundamental questions. The first question is foundational: “Who are you?” This establishes the individuality of a person in the digital space. The second question seeks verification: “Are you who you claim to be?” This is where one proves the authenticity of their claimed identity. <\/span><\/p>\nThe third question pertains to permissions: “What are your authorizations, or what are you eligible for with this identity?” This is about presenting one’s identity to a system to gain access or services, akin to what we implement at SecureWorks under the umbrella of access management. Hundreds of thousands of identities spanning multiple systems across disparate geographies make identity a complex web to unravel\u2014which is precisely what threat actors are counting on.<\/span>\u00a0<\/span><\/p>\nIn the last three years alone, we’ve observed a 688 percent surge in stolen credentials available for sale in one of the largest underground marketing places. A few weeks ago, our researchers observed a cyber-criminal selling Remote Desktop Protocol access to 5 US-based corporations. Their revenue ranged from $5 – $225M, and the access for sale includes rights for four users and one admin. The starting price is $2,000, and the buyout price is $4,000. That’s a small layout for a potentially huge payout. <\/span>\u00a0<\/span><\/p>\nReframing the Problem<\/span>\u00a0<\/strong><\/h3>\nI’m not here to fearmonger. It’s important to understand the risk in order to proactively defend against it. Throughout my career, I’ve led with the three following pillars that provide the strategic backbone for identity protection and response:<\/span>\u00a0<\/span><\/p>\n1. Easy to use and abuse-resistant:<\/span>\u00a0<\/strong><\/h4>\nSecurity leaders often face the challenge of implementing identity verification processes that are easy for their stakeholders to use while also being robust enough that threat actors can’t easily circumvent. If the identity technology is too difficult to use and causes friction, users will resort to less secure methods of authentication. \u00a0<\/span>\u00a0<\/span><\/p>\nMulti-factor authentication (MFA) is now the norm in most organizations. Technologies like passkeys and authentication apps from Microsoft and Google exemplify advancements beyond traditional one-time passwords, offering better phishing-resistant authentication methods. The FIDO Alliance represents a collaborative effort to create passwordless authentication standards. FIDO2 is the latest iteration, allowing users to use familiar devices to authenticate seamlessly to online services across mobile and desktop platforms. <\/span>\u00a0<\/span><\/p>\n2. Monitor, detect,\u00a0and respond:<\/span><\/strong>\u00a0<\/span>\u00a0<\/span><\/h4>\nControls like MFA are a great start, but they aren’t enough. When so much relies on identity, leaders must also proactively monitor, detect, and respond quickly to identity-based threats. Identity threat detection and response (ITDR) solutions are quickly becoming critical security controls, providing comprehensive monitoring capabilities and enabling organizations to detect and address any misuse of identity systems swiftly.<\/span><\/p>\nDo we have identities for sale on the dark web? Has an identity been compromised? Are there suspicious attributes about an identity interaction that deviate from what we normally see with a given user? A good ITDR solution is one that proactively monitors for identity breaches in their system and on the dark web, alerts users to potential identity threats, and has automated robust response capabilities that include actions such as reauthentication, account suspension, or account termination, depending on the severity of the threat. Transparency into where your identities ‘live’ and where they might be vulnerable is critical to managing identity risk.<\/span>\u00a0<\/span><\/p>\n3. Good hygiene:<\/span><\/strong>\u00a0<\/span>\u00a0<\/span><\/h4>\nYou’ve got the right tech in place, now you must be disciplined. It always comes back to security fundamentals and keeping your house clean. This involves managing the lifecycle and authorizations of digital identities, ensuring identities aren’t granted excessive permissions, remain active, and are appropriate for their intended purpose. Having a constant pulse on your overall security posture as it relates to identity is critical.<\/span><\/p>\nIdentities give threat actors the access they need to orchestrate a cyber-attack. The pace of technological change and the continued integration of world economies, governments, and businesses means that identity will only become more prevalent and complicated. You must have an identity strategy to protect your organization. If identity is the fuel that feeds adversarial activity, let’s proactively seek to cut off their supply. Don’t give cyber-criminals the keys to your kingdom.<\/span><\/p>\n
\n\n","protected":false},"excerpt":{"rendered":"
Ken Deitz, the Chief Security Officer\/Chief Information Security Officer at SecureWorks, explains how CISOs can help their organizations solve the identity puzzle. This article originally appeared in\u00a0Insight Jam, an enterprise IT community that enables human conversation on AI. My favorite definition of “Identity” comes from the World Bank:\u00a0“Identity refers to the combination of characteristics or […]<\/p>\n","protected":false},"author":1165,"featured_media":7194,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[2305,182,2306,2307],"acf":[],"yoast_head":"\n
How CISOs Can Solve the Identity Puzzle<\/title>\n<meta name=\"description\" content=\"Ken Deitz from SecureWorks has shared his thoughts on how CISOs can help their organizations solve the identity puzzle.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/identity-management\/how-cisos-can-solve-the-identity-puzzle\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ken Deitz\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/how-cisos-can-solve-the-identity-puzzle\/\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/how-cisos-can-solve-the-identity-puzzle\/\",\"name\":\"How CISOs Can Solve the Identity Puzzle\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/how-cisos-can-solve-the-identity-puzzle\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/how-cisos-can-solve-the-identity-puzzle\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2024\/10\/CISOs-Can-Solve-the-Identity-Puzzle.jpg\",\"datePublished\":\"2024-10-11T18:31:00+00:00\",\"dateModified\":\"2024-10-29T15:22:00+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/c25c602cd1c725713a8fe3aa71896988\"},\"description\":\"Ken Deitz from SecureWorks has shared his thoughts on how CISOs can help their organizations solve the identity puzzle.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/how-cisos-can-solve-the-identity-puzzle\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/identity-management\/how-cisos-can-solve-the-identity-puzzle\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/how-cisos-can-solve-the-identity-puzzle\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2024\/10\/CISOs-Can-Solve-the-Identity-Puzzle.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2024\/10\/CISOs-Can-Solve-the-Identity-Puzzle.jpg\",\"width\":800,\"height\":400,\"caption\":\"How CISOs Can Solve the Identity Puzzle\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/how-cisos-can-solve-the-identity-puzzle\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/identity-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How CISOs Can Solve the Identity Puzzle\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/\",\"name\":\"Best Identity Access Management (IAM) Software, Tools, Vendors, Solutions, & Services\",\"description\":\"Identity Access Management (IAM) News, Best Practices and Buyer's Guide\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/identity-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/c25c602cd1c725713a8fe3aa71896988\",\"name\":\"Ken Deitz\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2024\/10\/ken-deitz.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2024\/10\/ken-deitz.jpg\",\"caption\":\"Ken Deitz\"},\"description\":\"Ken leads the global corporate and product security teams at Secureworks. He joined the company in 2011, and focused on creating and leading the Corporate Incident Response Team (CIRT). In 2013, he transitioned to leading the Corporate Threat Intelligence Team, and in early 2016 became the CSO\/CISO. Prior to joining Secureworks he was the Branch Chief for the newly created U.S. Cyber Command.\",\"sameAs\":[\"http:\/\/www.secureworks.com\/\",\"https:\/\/www.linkedin.com\/in\/ken-deitz\/\"],\"url\":\"https:\/\/solutionsreview.com\/identity-management\/author\/kdeitz\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How CISOs Can Solve the Identity Puzzle","description":"Ken Deitz from SecureWorks has shared his thoughts on how CISOs can help their organizations solve the identity puzzle.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/identity-management\/how-cisos-can-solve-the-identity-puzzle\/","twitter_misc":{"Written by":"Ken Deitz","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/identity-management\/how-cisos-can-solve-the-identity-puzzle\/","url":"https:\/\/solutionsreview.com\/identity-management\/how-cisos-can-solve-the-identity-puzzle\/","name":"How CISOs Can Solve the Identity Puzzle","isPartOf":{"@id":"https:\/\/solutionsreview.com\/identity-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/identity-management\/how-cisos-can-solve-the-identity-puzzle\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/identity-management\/how-cisos-can-solve-the-identity-puzzle\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2024\/10\/CISOs-Can-Solve-the-Identity-Puzzle.jpg","datePublished":"2024-10-11T18:31:00+00:00","dateModified":"2024-10-29T15:22:00+00:00","author":{"@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/c25c602cd1c725713a8fe3aa71896988"},"description":"Ken Deitz from SecureWorks has shared his thoughts on how CISOs can help their organizations solve the identity puzzle.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/identity-management\/how-cisos-can-solve-the-identity-puzzle\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/identity-management\/how-cisos-can-solve-the-identity-puzzle\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/identity-management\/how-cisos-can-solve-the-identity-puzzle\/#primaryimage","url":"https:\/\/solutionsreview.com\/identity-management\/files\/2024\/10\/CISOs-Can-Solve-the-Identity-Puzzle.jpg","contentUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2024\/10\/CISOs-Can-Solve-the-Identity-Puzzle.jpg","width":800,"height":400,"caption":"How CISOs Can Solve the Identity Puzzle"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/identity-management\/how-cisos-can-solve-the-identity-puzzle\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/identity-management\/"},{"@type":"ListItem","position":2,"name":"How CISOs Can Solve the Identity Puzzle"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/identity-management\/#website","url":"https:\/\/solutionsreview.com\/identity-management\/","name":"Best Identity Access Management (IAM) Software, Tools, Vendors, Solutions, & Services","description":"Identity Access Management (IAM) News, Best Practices and Buyer's Guide","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/identity-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/c25c602cd1c725713a8fe3aa71896988","name":"Ken Deitz","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/image\/","url":"https:\/\/solutionsreview.com\/identity-management\/files\/2024\/10\/ken-deitz.jpg","contentUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2024\/10\/ken-deitz.jpg","caption":"Ken Deitz"},"description":"Ken leads the global corporate and product security teams at Secureworks. He joined the company in 2011, and focused on creating and leading the Corporate Incident Response Team (CIRT). In 2013, he transitioned to leading the Corporate Threat Intelligence Team, and in early 2016 became the CSO\/CISO. Prior to joining Secureworks he was the Branch Chief for the newly created U.S. Cyber Command.","sameAs":["http:\/\/www.secureworks.com\/","https:\/\/www.linkedin.com\/in\/ken-deitz\/"],"url":"https:\/\/solutionsreview.com\/identity-management\/author\/kdeitz\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts\/7132"}],"collection":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/users\/1165"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/comments?post=7132"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts\/7132\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/media\/7194"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/media?parent=7132"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/categories?post=7132"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/tags?post=7132"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"How](\"https:\/\/solutionsreview.com\/identity-management\/files\/2024\/10\/CISOs-Can-Solve-the-Identity-Puzzle-768x384.jpg\")
<\/p>\n![\"Insight](\"https:\/\/solutionsreview.com\/identity-management\/files\/2023\/10\/insightjam_logo.jpg\"){kind=logo}
<\/a>My favorite definition of “Identity” comes from the World Bank:<\/span>