When it comes to your zero trust strategy, a modern approach to IGA is key

By Rod Simmons, vice president of product strategy, Omada

The traditional perimeter approach to security was being dramatically altered long before COVID-19. However, the massive shift to a largely remote workforce ushered in as a result of the pandemic accelerated the need for a new approach. Securing access to a range of on-premises and cloud-based applications requires a transformation of identity and access management initiatives. The misguided trust we once had for users inside the corporate perimeter is gone. Attackers only need to be right once; we need to be perfect every time. With the majority of employees now accessing corporate assets from different locations and devices, the process is complicated further.

As a result, the governance of identities is now a key and strategic aspect of cybersecurity programs – and it’s essential to implementing the zero trust model many organizations are now using.

The breakdown of perimeters necessitates a modern IGA solution

It used to be that organizations focused on the perimeter when it came to security – it’s the “castle and moat” idea. Problem is once inside attackers move with ease like any insider, the castle is only secured from the outside. When employees worked mainly within an office accessing mostly on-premise corporate resources, identity was not the key to security.

It has been over two decades that we saw cracks in the traditional perimeter approach we could no longer ignore. The frequency, size, and scope data breaches put information security front and center. It is rare you speak to someone that has not lost their information in a data breach. Most governance problems that organizations face today are a result of these breaches and sometimes security failures by organizations.

Now add to that organizations have adopted cloud services, and a massive increase remote work, the traditional perimeters has broken down. As the landscape has evolved we are faced with new operational and governance challenges. In fact, in a new survey conducted by the analysts at Enterprise Strategy Group, respondents reported that 52% of business-critical apps are now cloud-based rather than on-premises.

What is the point of security? To ensure integrity and availability of data? To protect data from unauthorized access? To help you prevent, detect, and respond to threats? To ensure authorized users get the necessary access?

It is all of the above. Keep it simple. Security allows you to protect resources and ensure only the right people can access. Sadly, security is not always simple. We have different types of users from employee, contractor, vendors, partners, and others. Access to any tier of user be restricted based on time of day, location, device, authentication method or a host of other criteria. No matter how you approach it, resources and identities are the two key elements

What an identity governance and administration(IGA) solution is supposed to do, essentially, is know what access these various individuals should have inside your organization. A modern IGA automates security access in a fast, efficient, consistent and accurate way – and at scale. And using a cloud-based IGA solution brings faster time-to-value to organizations and makes IGA more readily available to smaller organizations that would not otherwise be able to afford it.

But not all IGA solutions are created equal, and many organizations have historically struggled with implementation. Organizations need to rethink the perimeter in the context of identity and the cloud for a modern approach to identity governance. If not, there can be serious consequences. For instance, 31% of respondents to the aforementioned ESG survey reported that their organization lost data due to an identity-related cybersecurity incident in the past 12 months.

Implementing zero trust

Zero trust is a security model based on the principle of maintaining strict access controls and not trusting anyone by default, even those already inside the network perimeter. Consequently, it’s an approach that is set to “deny” and that sees everything and everyone as a threat. The secure access model shifts from the starting point of trusting but verifying to not trusting and verifying continually. The model does this by actively governing permissions and continuous monitoring.

This model aligns with the capabilities that are core to identity governance and administration (IGA). These include the ability to regularly review permissions, require approval workflows, implement segregation of duties and tightly scope user roles, in addition to continuous monitoring and the use of strong forms of authentication. It places identity at the center because all the verification is about the “who” aspect of security.

The zero trust and identity connection

A modern approach to identity governance and administration provides critical identity information and business context, which helps with building out a zero trust model – if you want to make effective decisions in a zero trust model, you have to have a better and/or deeper understanding about your users and the context (or contexts) that they operate in.

More and more organizations are taking advantage of what identity governance can do to help successfully implement zero trust. In fact, ESG noted that 81% of respondents report identity governance to be a key part of zero trust implementation efforts. And 84% said they expect their organization’s identity and access management spending to increase over the next 12 months.

Zero trust is not merely a matter for the IT department – it’s a benefit for the entire organization. That’s why key stakeholders must be involved in the process. They must understand the critical benefit this model offers, as well as the possible consequences if nothing changes.

A more secure future

The increase in remote work has led to a greater need for cloud-based identity and access management. Consequently, the governance of identities and their associated permissions has become one of the top five biggest cybersecurity priorities for most organizations. Adopting a full-featured, cloud-native IGA system is key to a zero trust strategy and to strengthening a company’s cybersecurity posture.

About the Author

As VP of Product Strategy at Omada, Rod Simmons provides vision for where the IGA market is going and how Omada and remain a leadership position. Rod works closely with the product teams and CTO to define Omada’s vision and objectives to achieve the goals

As a 20 year industry veteran, he has a passion for innovation and software design, He has extensive experience in leading and designing cutting -edge products and technologies.  Prior to Omada Rod spent time at Stealthbits, BeyondTrust, and Quest Software. During his tenures he has held roles of VP or Product Strategy, Director of product management and Director of Solution Architects respectively.

Rod can be reached on twitter at @RodSimmons, on LinkedIn at https://www.linkedin.com/in/rodlsimmons/ and at our company website http://www.omada.net