Cloud Security
,
Governance & Risk Management
,
Identity & Access Management
Tailoring Machine Identity Management to Specific Industry Needs
Just as a professional race car struggles on muddy terrain and a monster truck can be considered impractical in city traffic, a one-size-fits-all security approach to machine identity management cannot address the unique challenges of different industries. Instead, security strategies should be tailored to meet each industry’s specific needs.
See Also: Student-Powered SOCs: Safeguarding Public Sector Digital Infrastructure
In Part 1 of this blog, we explored strategies for managing on-premises and cloud-based identities. In Part 2, we discussed AI-driven security tools for managing identities used in automated workflows. Part 3 dives into the unique requirements of three key industries – finance, healthcare and manufacturing – to demonstrate how tailored solutions can effectively meet each industry’s specific needs, including access control, continuous monitoring and compliance requirements.
Managing Identities in Finance, Healthcare and Manufacturing Industries
The finance, healthcare and manufacturing industries face unique challenges in managing machine identities due to their regulatory and operational requirements. The financial sector must comply with regulations such as the Payment Card Industry Data Security Standard, or PCI DSS, and the Sarbanes-Oxley Act, SOX. Healthcare is governed by the Health Insurance Portability and Accountability Act, HIPAA, and often adheres to PCI DSS as well. The manufacturing industry must balance the demands of information technology and operational technology environments. Understanding the nuances of each industry is imperative to help protect assets and ensure compliance.
Achieving Regulatory Compliance in Financial Services
PCI DSS and SOX put the onus on financial institutions to enforce rigorous access controls and frequently rotate certificates and credentials. Beyond regulations, deploying advanced monitoring tools can help financial institutions detect and respond to anomalies, ultimately safeguarding their reputations. For example, in November 2023, a security incident affected a major U.S. bank’s insurance software partner. Although the bank’s systems remained secure, the breach exposed personal information of 57,000 customers – enough for some customers to take their business elsewhere.
Financial institutions such as Germany’s DZ Bank benefit from a modern identity security strategy based on least privilege access. Managing privileged accounts, implementing application-based secrets retrieval and applying industry best practices for identity security enable compliance while providing better visibility into access management operations.
Uncovering the Challenges of Healthcare Legacy Systems
Healthcare organizations rely on integral systems that were never designed with modern security needs in mind. Due to the high cost of such medical equipment, their lifespans may extend to 10 years or more. As this equipment directly impacts patient care, upgrading each machine requires thorough testing and scheduled downtime – typically no easy feat for many providers.
Such equipment may include everything from client-server installations of imaging applications to ICU monitoring devices running unsupported older versions of Windows.
Additional security layers such as segmented networks, continuous monitoring and zero trust architecture are often necessary when legacy applications cannot be integrated with modern security tools.
HIPAA mandates strict controls to protect patient information when accessed by human and machine identities. Unauthorized access to patient records – sometimes malicious but often unintentional – is common in many healthcare breaches. Increased reliance on external applications can present another challenge, as healthcare data management and analytics vendors are typically attractive targets for hackers.
Many healthcare providers host applications, appliances and other medical devices managed by third-party vendors. But it is often unclear which vendor representative will require access in the event of an issue or when a configuration update is required. This creates a security challenge: how to grant vendor access to an application while maintaining security, privacy and regulatory compliance.
Organizations such as New York-based insurer Healthfirst recognize the value of access management and identity protection to control their expanding perimeter. These controls, coupled with multifactor authentication and end-user education, have enabled Healthfirst to develop a federated identity strategy that is projected to cut costs, improve efficiency and replace multiple security tools along with their associated licensing fees.
IT vs. OT in Manufacturing
Like healthcare, the manufacturing industry depends on machine identities tied to legacy software. In this case, OT systems automate assembly, monitor safety and drive manufacturing processes.
Many security tools designed for IT often do not work in OT environments. There can also be high sensitivity to downtime because any impact on an OT environment can halt production and generate losses totaling millions of dollars per hour. Controls such as air gapping, which isolates secure and unsecure networks, can help compensate for the security shortcomings of legacy OT environments. Another approach manufacturers are taking involves integrating IT and OT in a single security framework, which is often key to modernization initiatives.
Enterprise manufacturing companies increasingly seek to bring efficiency to account management. With identities in far-flung locations – or on the move, in the case of delivery drivers – organizations such as Coca-Cola Europacific and Transgourmet France are strengthening privileged access management and focusing on repeatable practices that additional business units can easily adopt.
Success Factors
Many organizations clearly benefit from machine identity management solutions that account for the unique challenges and regulatory requirements of their specific industries. Additional industry-leading practices include:
- Prioritizing machine identities that pose the highest risk to mission-critical operations, such as those with access to sensitive data or those embedded in clinical infrastructure, such as hospital heart monitors;
- Clearly defining and assigning ownership of machine identities to specific individuals or teams, such as managers of a manufacturing plant, to increase accountability and management of machine identities;
- Maintaining an inventory of machine identities, including their usage and dependencies, to help accelerate the implementation of control and management;
- Fostering a security-conscious culture so that employees can stay updated on evolving threats and developments in identity management and security. This can be essential for anyone who routinely accesses customer’s financial or medical data.
CyberArk is an identity management company that focuses on securing on-premises and cloud environments by automating the life cycle of digital identities and enforcing least privilege access. PwC collaborates with CyberArk to provide an array of professional services that help a wide range of organizations solve problems faster and maximize value. Together, CyberArk and PwC help organizations manage machine identities across on-premises and cloud environments, while also strengthening their defenses against rising cyberthreats.
Visit CyberArk’s website to learn more about how you can boost your organization’s identity security.