Cloud Security
,
Governance & Risk Management
,
Identity & Access Management
3 Key Strategies for Security Leaders for Managing On-Premises and Cloud Identities
Much like the rapid rise of stars in an expanding universe, machine identities – each with a unique credential, token or application – are driving global digital modernization and multiplying at an unprecedented rate, now outnumbering human identities by at least 45:1.
See Also: Student-Powered SOCs: Safeguarding Public Sector Digital Infrastructure
Each machine identity can generate potential vulnerabilities that require a proactive and holistic approach to machine identity management.
Decoding the Complexities of Machine Identities
The rising volume and complexity of machine identities can make them difficult to manage.
On-premises systems typically use static credentials for machine identities. While rotating these credentials is crucial, doing so can be a daunting task since machine identities are integral to application functions and inter-application communications. Any disruption can lead to negative business impact, revenue loss or strained customer relationships. As an organization expands, knowledge of machine identity dependencies and the impact of credential rotation can often become unclear or even get lost.
Organizations are widely adopting hybrid and multi-cloud environments that deliver many advantages. But two of the more common benefits also contribute to making machine identity management in the cloud far more complex.
One such advantage is the ability to select from multiple cloud architecture solutions. Depending on an organization’s business needs or deployment model, it can use cloud layers consisting of physical infrastructure, network infrastructure, computing resources, storage, databases and applications. Different machine identities exist at different layers, serve different purposes and are governed by different, sometimes disconnected mechanisms.
Another common advantage of cloud services is having the ability to use temporary solutions such as Kubernetes, which are designed to exist as long as necessary. While this helps deliver scalability, flexibility and cost efficiency, machine identities are automatically created and decommissioned in near real time. Without the ability to continuously monitor cloud operations, tracking these identities can be overwhelming for IT teams.
As computing resources multiply and migrate to the cloud, organizations increasingly struggle to gain visibility into their machine identities. It is not uncommon for thousands of identities to exist across on-premises as well as public, private and hybrid cloud environments.
Limited visibility into highly fragmented machine identities makes them difficult to manage and secure. According to CyberArk’s 2024 Identity Security Threat Landscape Report – a global survey of 2,400 security decision-makers across 18 countries – 93% of organizations experienced two or more identity-related breaches in 2023. Machine identities are a frequent target, with previous CyberArk research indicating that two-thirds of organizations have access to sensitive data.
A ransomware attack on a popular file transfer system last year exposed the sensitive information of approximately 60 million individuals and impacted more than 2,000 public and private sector organizations. The consequences of such a breach often disrupt businesses, costing millions of dollars to mitigate it, with the likelihood of regulatory and legal sanctions as well as reputational damage being typically high. Even if an organization opts to pay ransom, there is no guarantee of system integrity or data security.
Proactively Managing Machine Identities
As with many elements of cybersecurity, improving machine identity management requires taking proactive measures. Here are the three key strategies CISOs and security leaders should implement today:
- Conduct a holistic inventory of machine identities: Assess each environment, including physical on-premises systems as well as cloud devices, applications and services, production and operational technologies, and artificial intelligence and machine learning models. This step is crucial to assess the challenges in identifying high-risk machine identities.
- Leverage cloud entitlement management tools: To address the challenges associated with managing fragmented machine identities, CyberArk Secrets Hub and CyberArk Cloud Visibility can help standardize and automate operational processes. These tools provide better visibility into identities that require access and determine whether the request is legitimate.
- Invest in cross-platform governance: Organizations should identify and secure their machine identities across multiple on-premises and cloud environments, including those from different cloud service providers. The right governance tool can help organizations meet the unique needs of each platform, while also making it easier to maintain a unified approach to machine identity management.
CyberArk is an identity management company that focuses on securing on-premises and cloud environments by automating the life cycle of digital identities and enforcing least privilege access. PwC collaborates with CyberArk to provide an array of professional services that help a wide range of organizations solve problems faster and maximize value. Together, CyberArk and PwC help organizations manage machine identities across on-premises and cloud environments, while also strengthening their defenses against rising cyberthreats.