• About us
  • Disclaimer
  • Privacy Policy
Tuesday, July 5, 2022
  • Login
  • Register
W-SE (Web - SEcurity)
  • Tech today
  • Security
    • Malware
    • Top list
  • Vulnerabilities
  • How To?
    • All
    • gaming
    • Smart phone
    • smart tv
    • software
    Software help business

    Reasons to Buy the Right Business Hardware

    Network Management Security

    How to Invest in NFT Art?

    Ideal Internet Speed for Online Gaming

    Ideal Internet Speed for Online Gaming

    AceThinker Online Video Editor and Pro

    AceThinker Online Video Editor and Pro

    DGE 1001

    Splashtop Cost

    Cyber Security Degree In Pennsylvania

    How to Secure Your PC Before Going Online Shopping

    Trending Tags

    • Web Security
    • Data Security
    • Network Security
    • Cybersecurity
  • About us
  • Disclaimer
  • Privacy Policy
  • Contact
No Result
View All Result
  • Tech today
  • Security
    • Malware
    • Top list
  • Vulnerabilities
  • How To?
    • All
    • gaming
    • Smart phone
    • smart tv
    • software
    Software help business

    Reasons to Buy the Right Business Hardware

    Network Management Security

    How to Invest in NFT Art?

    Ideal Internet Speed for Online Gaming

    Ideal Internet Speed for Online Gaming

    AceThinker Online Video Editor and Pro

    AceThinker Online Video Editor and Pro

    DGE 1001

    Splashtop Cost

    Cyber Security Degree In Pennsylvania

    How to Secure Your PC Before Going Online Shopping

    Trending Tags

    • Web Security
    • Data Security
    • Network Security
    • Cybersecurity
  • About us
  • Disclaimer
  • Privacy Policy
  • Contact
No Result
View All Result
W-SE (Web - SEcurity)
No Result
View All Result
Home Security

New Blindspot in Cybersecurity

Melina Richardson by Melina Richardson
in Security, Tech today
A A

The main tool used for access control and authentication has been since the advent of machines, usernames, and passwords. However, as post mortem review shows in most data breaches, compromised identities have become the main attack point for today’s cyber adversaries. Nonetheless, a recent Identity Defined Security Alliance (IDSA) study shows that credential-based data breaches are both omnipresent (94% of survey respondents encountered an identity-related attack) and highly preventable (99%).

Nevertheless, many businesses still lack essential security controls related to identity and the few forward-thinking companies that have started applying proper access controls typically focus on human users. Faced with reality, that flies. The sheer number of non-human identities greatly outweighs human users with digital transformation initiatives that span DevOps, cloud computing, the Internet of Things ( IoT), etc. So, what does this mean for the future of passwords and how do companies handle their sensitive resources in managing access?

For decades, users used static passwords to sign in to different accounts and services. The typical password remains unchanged from the moment it is formed, unless it is enforced by legislation, personal preferences or in response to a data breach. This makes it extremely vulnerable to threat actors, since a static password has a low likelihood of checking a user ‘s legitimacy and can be a compromised credential obtained on the Dark Net since easily as that.

A stolen password can provide unrestricted access to the compromised account, the ability to move laterally within the network and disrupt business processes or exfiltrate sensitive information once in the hands of a cyber-attacker. The effect is much greater if the account is held by a privileged person who owns the “keys to the throne.” However if an enterprise has strengthened its security posture by introducing multi-factor authentication (MFA), this additional defensive layer does not resolve non-human identity threats.

Go Over Static Passwords

Today, identities not only include individuals but also workloads, resources and computers. In fact, in many organisations, non-human identities represent the majority of “users.” Computer identities are often synonymous with privileged accounts, which usually have a much greater presence within modern IT infrastructures than traditional human privileged accounts. This is particularly true in DevOps and cloud environments where automation of tasks plays a dominant role.

These often pose a blind spot, as when creating security checks, system, IoT, service account, and client identities are not always considered. In addition to underestimating the importance of non-human identities in the sense of a data breach, many companies are rapidly realizing that the conventional static password model, which often includes manual and time-consuming modifications, is not appropriate in fast-moving multi-cloud and hybrid environments, where access needs are often transient and changes are frequent.

Authentication ‘s Future: Ephemeral Tokens

Rather of depending on a static password model , companies should switch to a fluid approach to passwording. These ephemeral, certificate-based access credentials tackle major security issues that plague static passwords in increasingly digitalised IT environments without compromising usability and agility.

When introducing ephemeral certificate-based authorization, the target systems are accessed without the need for permanent access credentials, creating a “zero standing privilege” position that requires authentication , authorization, and encryption of all access to the services. The ephemeral certificate is issued by the Certificate Authority ( CA) for each session (whether for a person or machine) which serves as the trusted third party and is based on industry standards such as the temporary X.509 certificate. Regarding security purposes, it encodes the user identity and has a short lifetime, avoiding the risk of man-in-the-middle attacks.

Ultimately, the CA manages access to the target system based on rules-based user roles (including roles assigned to workloads, programs, and machines). The rules for specific roles are generated in accordance with the security and access requirements. The CA then gets the rules from the traditional enterprise directory for each role ( e.g., Microsoft Active Directory) and uses them to decide proper authentication. This strategy softens the setting up of access for each individual user and enables seamless updates to user groups.

Summarizing

Identity integration with security is still ongoing, with less than half of organizations having completely adopted key identity-related access controls according to the IDSA research report. To make things worse we simply can no longer trust static passwords. In addition, they are unfit for today’s machine identity dominated IT environments that are built for agility and rapid change. A simpler solution is to incorporate a dynamic password model, which minimizes the likelihood of identity-related breaches when paired with a least privilege solution.

ShareTweetShare
Previous Post

7 Tools Should Every blogger Have

Next Post

How Can You Create Incredible YouTube Outros for Your Videos?

Melina Richardson

Melina Richardson

Melina Richardson is a Cyber Security Enthusiast, Security Blogger, Technical Editor, Certified Ethical Hacker, Author at Cybers Guards & w-se. Previously, he worked as a security news reporter.

Next Post
YouTube

How Can You Create Incredible YouTube Outros for Your Videos?

Please login to join discussion
  • Trending
  • Comments
  • Latest
inurl technology

Latest Carding Dorks List for Sql Injection 2022

March 16, 2022
connect monitor to laptop two screens

How To Connect A Monitor To A Laptop And Use Both Screens?

February 10, 2021
how to connect two monitors to my laptop

How Do I Connect 2 Monitors To My Lenovo Laptop?

January 22, 2021
Gb Whatsapp An Unexpected Error

Gb Whatsapp An Unexpected Error

November 7, 2021
Windows Flaw

If Older Battleye software is used, Windows 10 1903 Blocked

0
Mac Os

New unpatched macOS bypass gatekeeper published online

0
Siemens Medical Products

Wormable Windows Flaw Affected Siemens Medical Products

0
Cloud Computing

5 Tips of the Personal Data Protection in the Cloud

0
Software help business

Reasons to Buy the Right Business Hardware

June 30, 2022
Business Intelligence

How Containerization Can Help with Your Automation Strategy

June 27, 2022
Private Browsing Do's And Don'ts

Private Browsing Do’s And Don’ts

June 27, 2022
The Safest Mobile Payment Options Available

The Safest Mobile Payment Options Available

June 27, 2022

Quick Links

Learnopedia
Tech Write For US
Technology Write For US
Casino Write For Us
Mr.Perfect Reviews
Cyber Security Career

Recent News

Software help business

Reasons to Buy the Right Business Hardware

June 30, 2022
Business Intelligence

How Containerization Can Help with Your Automation Strategy

June 27, 2022
Private Browsing Do's And Don'ts

Private Browsing Do’s And Don’ts

June 27, 2022
The Safest Mobile Payment Options Available

The Safest Mobile Payment Options Available

June 27, 2022
W-SE (Web – SEcurity)

W-SE regularly updates cyber attacks, hacking and events that provide IT security professionals with information throughout the world. Also offering news in W-SE. We spent two years living and sharing guidance and insights with IT experts, detailed analyzes and news.

We also train people with product reviews in different form of content.

Browse by Category

  • computer
  • Fraud & Identity
  • gaming
  • How To?
  • laptop
  • Malware
  • Microsoft
  • Mobile
  • photography
  • Privacy
  • Reviews
  • Security
  • Security Degree
  • Smart phone
  • smart tv
  • Social
  • software
  • Tech
  • Tech today
  • Top list
  • Uncategorized
  • Virus & Threats
  • Vulnerabilities
  • Website
  • What is?

Recent News

Software help business

Reasons to Buy the Right Business Hardware

June 30, 2022
Business Intelligence

How Containerization Can Help with Your Automation Strategy

June 27, 2022
  • About us
  • Contact
  • Disclaimer
  • Home
  • Privacy Policy
  • Resources
  • Support Forum
  • Tech Blog
  • Technology Write For Us
  • W-SE (Web Security)

© 2020 w-se.com - Powered by Fix Hacked Website, Cyber Special , SSL Authority Reviews Powered by Mr.Perfect Reviews.

No Result
View All Result
  • Tech today
  • Security
    • Malware
    • Top list
  • Vulnerabilities
  • How To?
  • About us
  • Disclaimer
  • Privacy Policy
  • Contact

© 2020 w-se.com - Powered by Fix Hacked Website, Cyber Special , SSL Authority Reviews Powered by Mr.Perfect Reviews.

Welcome Back!

Login to your account below

Forgotten Password? Sign Up

Create New Account!

Fill the forms below to register

All fields are required. Log In

Retrieve your password

Please enter your username or email address to reset your password.

Log In