Identity Security Posture Management

Identity has become a major target for cyberattacks. Cloud services, web applications, and remote and mobile working have significantly complicated identity security by multiplying the number of credentials used and creating new exposures. In many organizations, workers and third parties – plus machines, workloads, and service accounts — use multiple identities to connect to corporate assets and sensitive data. Other identity risk factors include poor password practices and easy access to stolen credentials by threat actors.

A 2024 survey by the Identity Defined Security Alliance showed that 90 percent of respondents experienced an identity-related incident in the last 12 months.

To help minimize their identity attack surface and strengthen the security of their identity infrastructure, organizations are adopting identity security posture management (ISPM). ISPM is not a single tool, but rather a framework that typically integrates access control and authentication, identity governance, analytics, and monitoring. ISPM is used for proactive assessment and monitoring to detect vulnerabilities and misconfigurations in the identity security stack, such as making sure access rights and permissions conform to security policies. It also provides real-time visibility into all user identities and related access across the organization.

The primary security risks that ISPM addresses are identity misconfigurations and “unknowns” such as shadow access and dormant or orphan accounts. Unknowns are risks that are missed – and therefore not monitored – by existing identity controls.

ISPM is the newest version of security posture management, joining cloud- and data-focused solutions.

What security challenges does ISPM address?

As traditional network perimeters disappear under the influence of cloud, mobility, and virtualization, protecting digital identities has become critically important to an organization’s overall security posture. However, successful identity defense requires overcoming several challenges:

• Existing and new identity threats: A top objective of ISPM is preventing identity theft, but cybercriminals continue to deploy cutting-edge tactics and technologies that give rise to new threats. One advanced technology being deployed by threat actors is artificial intelligence. For instance, AI powers deepfake technology, which combines machine learning and media manipulation to allow threat actors to create highly realistic synthetic content. They use these deepfakes to trick users into revealing credentials and other sensitive data. AI also can power password cracking efforts by analyzing massive data sets to identify patterns and predict passwords.A more mundane challenge to identity security is poor password hygiene. Studies show that the majority of users fail to follow password best practices. They use weak passwords or repeat the same passwords to protect their online accounts.

• Vulnerabilities and risks: An organization’s security posture can be negatively affected by a range of identity vulnerabilities and risk factors. As mentioned above, two of the most critical are identity misconfigurations, discussed in the next bullet, and identity blind spots. Unfortunately, identity and access management (IAM) systems do not offer sufficient capabilities to address these issues because they do not collect the required data.Other common identity risks and weaknesses include:
  • • forgotten and overlooked service accounts, which are a type of machine identity
    • insiders who misuse their access privileges to compromise the organization’s security
    • reliance on Microsoft Entra ID (formerly Azure Active Directory), which is a legacy technology that is inherently vulnerable to attacks
    • synchronization of on-premises user accounts with cloud identity providers, creating a way to exploit cloud resources through the on-premises connection.

Certain situations can also create identity security risks. A merger or acquisition introduces many new elements that can disrupt established processes, and may carry a sense of urgency that can lead to shortcuts in security procedures and best practices. Heavy use of external third parties like partners, contractors, and outsourcers can increase the burden of monitoring adherence to access management procedures, opening the door to errors and suboptimal oversight.

• Identity misconfigurations: An identity misconfiguration can result from administrative error or so-called “configuration drift,” which is a gradual shift in identity and access controls due to ad hoc changes or updates. Misconfigurations typically occur when changes do not follow a proper change management process or undergo risk assessment. A common example is misconfigured IAM policies. Without effective change management, user accounts can slowly accumulate excessive or unneeded privileges that provide an attack vector.

Other misconfigurations can allow users – or threat actors – to bypass privileged access management (PAM) controls and zero trust network access (ZTNA) systems, weakening their security capabilities.

• Complexity: Many organizations rely on a combination of on-premises and public or private cloud services, which requires them to manage user accounts across multiple platforms. Access by third parties, such as partners and vendors, as well as by machines and Internet of Things devices, adds more layers of complexity. Each of these identities has its own set of privileges, access permissions, and data. And the number of digital accounts is growing exponentially.

• Compliance: Helping organizations comply with evolving regulations and industry standards is an important focus for ISPM solutions. Examples of regulatory requirements for identity-related protection are the European Digital Identity (EUDI) Regulation and the U.S. Improving Digital Identity Act of 2023. Because identity is the starting point for controlling data access, ISPM also helps address privacy regulations such as Europe’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

• Changes in attack surface: An organization’s identity attack surface can expand or contract based on new hires, reassignments, resignations, mergers and acquisitions, and changes in partners and contractors. Another factor is the SaaS “churn rate,” which results when subscriptions for these applications are added, cancelled, or even duplicated. It is challenging to monitor and protect identities associated with SaaS applications and prevent exploits based on risks such as zombie accounts and dangling access.

• Visibility: Strong security depends on good visibility into all digital identities and access rights across the organization. Identities include those of active and inactive users, external and unmanaged users, and non-human users such as machines and IoT devices.

Because it is not a single solution, ISPM requires a portfolio of identity security components that are integrated and operate as a system. When creating and implementing an ISPM solution, look for these capabilities and technologies:

Identity governance and administration

This framework sets up policies and processes for creating, modifying, managing, and deleting digital identities and associated access rights.

Identity discovery and visibility

Because of the broad scope and complexity of an identity fabric, an ISPM solution should enable you to discover and inventory the access rights and activities of all human users, machine accounts, and services across public and private clouds and hybrid environments.

Monitoring and analytics

Once you have an understanding of your identity landscape, ISPM should help you monitor and analyze activity to pinpoint anomalies and suspicious activity. Armed with this knowledge, you can adjust policies and controls to strengthen overall security posture.

Identity and access management

This capability encompasses policies, processes, and technologies such as multi-factor authentication, single sign-on (SSO), and password management to tightly control access to resources in today’s distributed environments

Privileged account management

An ISPM solution should enable you to manage and monitor privileged accounts to control user behavior that poses a security risk, apply the principle of least privilege, and prevent or remediate privilege-based cyberattacks.

SaaS protection

A robust ISPM solution should protect SaaS applications against data breaches, insider threats, and third-party access risks.

Cloud infrastructure entitlement management (CIEM)

CIEM is a security solution that mitigates the risk of data breaches in cloud environments, which contain vast quantities of sensitive data, by helping to avoid excessive access permissions and entitlements. This problem continues to grow as more organizations move assets to the cloud, expanding the number of human and non-human identities that need to be managed, monitored, and controlled.

Key functions of a CIEM solution include providing entitlement discovery and visibility, optimizing cloud permissions and entitlements according to the principle of least privilege, detecting identity anomalies, automating risk management, and supporting compliance.

This solution uses AI and machine learning to automate entitlement monitoring, threat detection, and remediation efforts across cloud environments.