Identity Management Day: Cybercriminals No Longer Hack in, They Log In
Identity Management Day is a way to educate about the importance of securing identity and access credentials
When the police arrive at the scene of a break-in, one of the first things they’ll do is isolate the crime scene and assess its condition. They’re trained to document every single detail: the arrangement of furniture, any strange odors, even the temperature in the home. They also pay special attention to the points of entry: Are the doors intact? Have locks visibly been tampered with? All of these details clue them into the identity and motive of the perpetrator.
Nearly 30% of burglaries are carried out using opened or unlocked entrances. Warning homeowners of the dangers associated with keeping their doors and windows unlocked seems obvious, but clearly not unwarranted. It would be even more obvious to say people should avoid leaving keys to their home laying on their front porch, but this is exactly what is happening online, when hackers use privileged credentials to let themselves into cloud environments. Hackers are no longer breaking in a back window, they’re walking straight through the front door with the keys in their hands.
In the last year, 90% of cyberattacks on cloud environments leveraged compromised privileged credentials. This alarming trend illustrates just how easy it is for cybercriminals to access critical systems and sensitive data through improperly managed credentials.
2021: A Critical Year for Security
After overcoming so many obstacles in 2020 in the face of remote work onset by the global pandemic, this year presents an opportunity to learn from the shifting threatscape to better protect businesses and consumers alike. This is one of the main reasons we wanted to set aside a day dedicated entirely to educating business leaders, IT decision-makers and consumers on the importance of keeping the symbolic doors locked on their credentials.
The inaugural Identity Management Day, which takes place Tuesday, April 13, will not only reinforce the need for good cyber-hygiene but also will use technology solutions available to vault, authenticate, manage and secure privileged identities and access. It will educate the industry and all collective shareholders on the importance of identity management and key components including governance, identity-centric security best practices, processes and technology, with a special focus on the dangers of not properly securing identities and access credentials.
Credential-based Attacks Are Making Headlines
We believe there is no better time to raise awareness of identity management than right now, as several large-scale identity-based breaches are making the news. One such example is the spear-phishing campaign targeting Twitter in July 2020. The hackers were able to convince several Twitter employees to hand over their login credentials to hackers, which were used to breach internal systems that allowed them to tweet from Joe Biden, Barack Obama and Elon Musk’s verified accounts as well as receive over $115,000 in bitcoin transfers.
In another instance, this one affecting Nintendo, hackers used a custom account-checker tool to run a credential stuffing campaign that managed to combine crimeware and older breached data to locate accounts that had existing vulnerable logins. This incident highlights how important it is to avoid reusing passwords.
Furthermore, in early 2020, hackers obtained login credentials assigned to two Marriott employees that allowed them to access email addresses, mailing addresses, loyalty rewards numbers and other personally identifiable information.
Practical Ways to Secure Identity Management
The vast majority of breaches are indeed preventable through a zero trust approach. Modern privileged access management (PAM) solutions are based on zero trust principles that enable them to minimize shared accounts and allow human and machine identities to log in as themselves. These tools automate privileged access controls, reduce administrative risk and strengthen compliance postures to protect the keys to the kingdom.
Companies can learn more about ways to prevent identity-based attacks by participating in the inaugural Identity Management Day. Ways to get involved include registering to become an Identity Management Champion, entering the inaugural Identity Management Awards, joining the conversation on social media using #IDMgmtDay and #BeIdentitySmart, posting blogs on identity security and sending links to [email protected] for further amplification on social media and potentially the IDSA/NCSA websites.
Brad Shewmake is chairman of Identity Management Day.
- ThycoticCentrify Secret Server Further Enhances Industry-Recognized Usability with Automated and Simplified Secrets Management
- Thycotic Recognized as a 2021 Gartner Peer Insights™ Customers’ Choice for Privileged Access Management
- ThycoticCentrify Expands Centralized Service Account Lifecycle Governance to Multi-Cloud Environments
