Identity management and zero trust: Where to get started

The past year has taught us all a few things, from how much we value our health to what we take for granted regarding IT.

The impact of the last year should be obvious, but the Verizon 2021 Data Breach Investigations Report laid it out clearly. During the past year, privilege abuse was the biggest cause of data breaches by far, and phishing, ransomware and use of stolen credentials all went up.

David Smith and Bernard Wilson, the US Secret Service agents quoted in the report appendix also pointed to lack of identity management as an ingredient for data breaches in more companies: “Organizations that neglected to implement multi-factor authentication, along with virtual private networks (VPN), represented a significant percentage of victims targeted during the pandemic. The zero-trust model for access quickly became a fundamental security requirement rather than a future ideal.”

So, after a tough year where security teams moved heaven and earth to keep their companies both productive and secure, it’s time to take stock. While some new identity management program implementations will be effective for the longer term, others will find gaps and assumptions that could lead to unnecessary risk. Reviewing your approach now should help you spot any areas where you can continue to improve and move toward a zero-trust security model.

Core identity and authentication

Zero trust starts with who you are authenticating and what they should have access to – otherwise called identity trust. Based on the directory which is your single source of truth and core identity provider, or IdP, this is what stores and authenticates the identities your users use to log in to their devices, applications, files servers, and more (depending on your configuration).

Traditionally, many organizations use a directory as their single source of truth, such as Microsoft Active Directory (AD) or an implementation of OpenLDAP. However, these approaches tend to be aimed towards larger organizations and require on-premises servers, networks, and hardware.

Today, the move to remote working has put more emphasis on cloud directory services that can support both cloud applications and the range of…