Industry Trends Shaping Identity Security

[MUSIC PLAYING] I'm Darren Thompson. I'm the Vice President of Product Marketing for One Identity. There are a few trends that are really influencing the way we think about identity. The first one is the evolving threat landscape, and in particular, an expanded attack surface. We've thought about attack surfaces now for years as security professionals, but there are some fundamental changes happening in that area fueled by things like social media that we need to pay particular attention to as identity professionals. Secondly, cyber insurance is now real. We have the ability not just to mitigate or ignore our risks, but we can also share or transfer those risks as well. There is an entire industry to support us there. So that influences the way we should think about identity as well. And then thirdly, authentication. So getting rid of the password, making the user experience frictionless from an identity perspective, whilst at the same time making sure that users are authenticating in a relevant manner in the context of who they are, where they are, and what they're doing. So let's dig a bit deeper into cyber insurance. On the one hand, it could be a good thing for all organizations, the ability to not just mitigate our risks, but share or transfer those risks is an important part of a risk management strategy. The problem is that the cyber insurance industry has been going through a hard time recently. Ransomware has been fueling many, many claims. That means the policy prices are going up, and the limits on cyber insurance policies are coming down. We talked to many organizations that speak to their cyber insurer and they're struggling to get their cyber insurance policy. In many occasions, identity is at the center of that. An organization needs to prove their maturity in identity and access management in order to get a cyber insurance policy. So let's dive into the evolving attack surface. Traditional security models correctly used to think about things like servers and networks. Now we need to think about domains such as social media, AI, cloud computing, and software supply chains. If we're not embracing the concept of attacks in those areas and the attack surfaces therein, then we do not have complete security posture, coverage, and security strategy. Identity is the one theme that really runs as a thread throughout these topics, and so it's very, very important that we put identity at the center of our security strategy and start to think very seriously about these evolving attack surfaces. Let's talk about advanced authentication. This is a term that has been coined by One Identity, and it's really the coming together of two concepts. On the one hand, we ideally would like passwordless authentication. We really need to eliminate passwords. They still represent the Achilles heel of security strategy. But passwordless has been around for a long time and has been very, very difficult to implement. Additionally, password lists for every user may not be appropriate or relevant. So we've put password lists and what we call strong authentication together with context-aware risk-based authentication. We call that adaptive. The concept here is we apply multifactor authentication policy based on a user's context. Context could include who I am, where I am, the applications that I'm using, the device that I happen to be using, and other domain areas. We put these two things together, and that's advanced authentication. We believe that identity as a security domain is incredibly important and should be put at the center of all security strategy. If we think about just about every breach in history, it starts with the theft of a credential. The criminal, first of all, gets a credential, they then use that credential to stage their attack. It's the protection of the identities and credentials in a business that can really lower risk in a very fundamental way. When we talk to experts in the security industry, including the underwriters and actuarial scientists that study the topic of cyber catastrophe, what we find is that identity management principles such as MFA, such as the protection of Active Directory are some of the most important security topics that a CSO and their team can focus on. Despite this, the topic is not always at the top of the agenda of those teams. We believe it needs to be raised as an important topic in the context of the security strategy, and an appropriate amount of funding should be given to this area. [MUSIC PLAYING]