Identity has emerged as the new battleground for cybersecurity in today’s rapidly evolving digital landscape as threat actors are increasingly leveraging identity to compromise enterprises. They are exploiting weaknesses in identity management to gain unauthorized access to data and systems, highlighting the critical importance of securing digital identities.

Unlike traditional cyber-attacks that focus on breaching network perimeters, identity-based attacks allow threat actors to simply log in using stolen credentials – a shift that makes it imperative for organizations to rethink their security strategy. Enterprises must, therefore, embrace a Zero Trust mindset of “never trust, always verify and enforce least privilege”.

Importance of digital identity

In many cases, attackers don’t have to exploit a vulnerability or hack their way into a network as they can simply log in with valid credentials. Identity-driven attacks can be extremely hard to detect as traditional security tools may find it difficult to detect and differentiate between an authentic user and a hacker pretending to be the user.

In fact, more than 26% of all Cisco Talos Incident Response engagements in 2023 involved adversaries using compromised credentials on valid accounts. This underscores a critical weakness in conventional security models, where blind trust between authentication and access solutions creates exploitable gaps.

Additionally, users often have multiple digital identities and accounts, which significantly increases the number of entry points for attackers as well as the potential for lateral movement between identities. Too often, legacy permissions are not removed, and security teams lack crucial context about historical identity behaviour, actions across systems, and current risk levels necessary for making trusted access decisions.

Despite Multi Factor Authentication (MFA) remaining a critical first line of defence against identity-based attacks, malicious actors are using new and creative ways to steal credentials. What organizations need is a definitive way to analyze disparate telemetry data to ensure users are authentic and machine actions are performed only by authorized personnel.

Organizations are beginning to understand the importance of identity protection. As per data from Cisco’s 2024 Cybersecurity Readiness Index, about 36% of companies globally ranked identity protection as their organization’s top cybersecurity challenge, up from 24% the year prior.

Redefining Security Boundaries – Enhancing Visibility and Threat Response with Identity Intelligence

Identity is the new security perimeter. At its core, identity intelligence fundamentally focuses on understanding and managing identity-related information within an organization. This encompasses not just who has access and what they can access, but also the timing, location, and manner of interactions between systems and data. Utilizing identity intelligence enables organizations to gain a clear understanding of potential vulnerabilities and threats by analyzing identity behaviours and access patterns.

However, without proper visibility, threat detection, and response, identity infrastructure provides ample opportunity for attackers to enter critical systems. Enterprises must also look at making AI pervasive across their security infrastructure to help their security teams make informed decisions, augment their tool capabilities and automate complex tasks – at machine scale.

Identity security is a critical component of modern cybersecurity. It includes but is not limited to:

Identity visibility
You can’t protect what you can’t see. Organizations need to understand their identity ecosystem by centralizing and organizing their identity data. This means collecting relevant data from identity sources and then distilling it down into usable and actionable insights.

Identity posture management & protection

Once visibility is in place, organizations need to assess their current environment for areas that require attentions (i.e. improve MFA adoption or reduce excess privileges). From there, it’s easier to put in place proper protections like broad coverage of strong MFA and effective access policy that leverages location, device, and risk data.

Identity threat detection & response

With posture and protections in place, it is important evaluate the identity ecosystem continuously for potential threats (i.e. anomalous administrator activity). By incorporating useful techniques like ML and AI, risk prioritization and threat detection can be accelerated and enhanced. Once risk is detected, organizations should focus on implementing effective response mechanisms – these might be automated in some use cases or require more extensive playbooks in others.

To combat the rising number of identity-based attacks, organizations must adopt comprehensive identity security strategies that includes implementing robust MFA, regular monitoring and audit of access to critical systems, leveraging behavioral analytics, securing credential storage and conducting regular training sessions to educate employees about the importance of safeguarding their credentials.

Way forward

As security leaders chart the course for a cybersecure future, identity intelligence should be at the forefront of their strategy. Using an integrated system can help enforce policies and meet compliance requirements efficiently as well as respond to incidents more quickly, strengthening overall security.

With comprehensive visibility into the identity infrastructure, the organization can identify user access patterns and protect user identities. Upon detection of any anomalies in real time, security teams can restrict access rights or even terminate sessions entirely, thereby minimizing the impact of any compromised identity.

By understanding the tactics used by threat actors and implementing robust identity security measures, organizations can defend against identity-based attacks and maintain the integrity of their digital operations. The battle for identity security is ongoing, and vigilance, coupled with advanced security practices, is essential to safeguard against these evolving threats. Now is the time to act decisively, integrate smarter identity solutions, and lead the charge towards a resilient, cybersecure future.

The author is Samir Kumar Mishra, Director, Security Business, Cisco India & SAARC.

Disclaimer: The views expressed are solely of the author and ETCISO does not necessarily subscribe to it. ETCISO shall not be responsible for any damage caused to any person/organization directly or indirectly.