Identity and Access Management Solutions: The Top Cybersecurity Control for Q1 2023

“Your identity is your most valuable possession. Protect it,” the superhero Elastigirl cautioned her “super” daughter in the hit film, The Incredibles. This statement is just as true in the digital world as it is on the big screen. Hackers leverage weaknesses in identity management to break into organizations and expand access, as illustrated by recent high-profile data breaches such as the LastPass, Slack and CircleCI attacks. Based on these key weaknesses, we have selected Identity and access management solutions (IAM) as our spotlight cybersecurity control for Q1 2023.

Effective identity and access management is vital for businesses that want to secure their networks, protect sensitive data, and comply with regulations. That’s why IAM solutions are also on our list of the Top Cybersecurity Controls for 2023.

“When we hack into networks, step one is stealing a user’s credentials,” said Tom Pohl, LMG’s penetration testing team manager. “Step two is seeing what they can access, elevating privileges, and using that to gain more access.” Hackers are all too happy to take over service account and device identities, too, which often facilitate fast, widespread compromise.

IAM solutions can protect against attacks by controlling access to resources, monitoring activity, and providing security for digital identities. Read on to learn about how IAM solutions work, how they thwart hackers, and recommendations for leveraging IAM.

IAM Solutions: What They Do and How They Work

Identity and access management solutions provide a centralized system for managing and securing user access to sensitive information and systems. They typically include a variety of features, such as:

• Identity Management: This component of IAM solutions is responsible for creating, managing, and maintaining user identities. It also controls who has access to what resources and ensures that only authorized users can access sensitive data and systems.
• Authentication: This ensures that users are who they claim to be by verifying their identities through various methods, such as usernames and passwords, biometrics, or multi-factor authentication (MFA).
• Access Management: This controls access to resources by validating users’ identities, managing authorization, and granting or denying access.
• Auditing and reporting: This tracks and records user activity, enabling businesses to monitor and review access to sensitive information and systems.

The recent hack of LastPass, a widely used password vault solution, is an example of a breach that could have been prevented with an effective IAM solution. LastPass recently notified their users that an unauthorized party gained access to a third-party cloud-based storage service, which LastPass uses to store archived backups of their production data. The unknown threat actor accessed the cloud storage using information obtained from an incident in August of 2022. The hacker was able to use stolen credentials and keys to access and decrypt storage volumes within the cloud-based storage service, stealing information such as customer account information, company names, email addresses, telephone numbers, and IP addresses. They also copied a backup of customer vault data from an encrypted storage container. (According to LastPass, the vault data remains secured with 256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user’s master password.)

An identity and access management solution could have potentially prevented the hackers from accessing sensitive information and resources in this recent LastPass attack. By implementing strict access controls and authentication protocols, an IAM solution could have ensured that only authorized personnel were able to access the cloud-based storage environment where the backups were stored. Additionally, an IAM solution could have required multi-factor authentication, which would have added an extra layer of security to the access process, making it more difficult for the hackers to obtain credentials and keys. Furthermore, an IAM solution could have also provided a way to monitor and audit access to the storage environment, allowing for the detection of any suspicious activity.

How Identity and Access Management Solutions Can Thwart Hackers

One of the main ways that IAM solutions can thwart hackers is by effectively controlling access to resources. By only granting access to authorized users and monitoring access attempts, IAM solutions can help organizations identify and stop attackers.

IAM solutions can also help organizations protect against the common methods hackers use to steal access credentials. For example, IAM solutions can help protect against phishing attacks by facilitating passwordless authentication and centralized identity management, reducing opportunities for attackers to trick users into revealing their credentials.

Misuse of service tokens is another attack trend that can be thwarted by effective IAM implementation. Service tokens are used to authenticate and authorize access to resources, such as cloud services or APIs. By controlling access to service tokens, IAM solutions can help organizations prevent hackers from using them to gain unauthorized access to resources. IAM solutions also provide real-time monitoring and alerting, which can quickly identify and respond to suspicious activity. This helps to detect and prevent breaches before they can cause serious damage.

For example, in the recent hack of technology provider CircleCI, hackers abused a user’s identity by using malware to steal an engineer’s MFA-backed session cookie, allowing the hackers to log in as the user without having to authenticate via MFA again. The malware was able to execute session cookie theft, enabling the hacker to impersonate the targeted employee in a remote location and then escalate access to a subset of CircleCI’s production systems. Using the engineer’s privileges, the hacker began stealing data from some of the company’s databases and stores, including customer’s environment variables, tokens, and keys. The hacker also stole encryption keys by dumping them from running processes, potentially allowing the threat actor to decrypt the encrypted, stolen data.

An IAM solution could have potentially stopped the hackers in the CircleCI hack by implementing multiple layers of security controls. Some examples of these controls include:

• Multi-factor authentication (MFA): By requiring a second form of authentication beyond a password, an IAM solution could have prevented the hackers from using the stolen session cookie to access the company’s systems.
• Role-based access control (RBAC): An IAM solution could have been used to restrict access to sensitive information and resources to only those who need it, limiting the scope of damage if a user’s identity is compromised.
• Automated token rotation: An IAM solution could have been configured to automatically rotate tokens and secrets, limiting the amount of time that a hacker has access to them.
• Regular security audits and monitoring: IAM solutions can facilitate audits and detection of anomalous activity, such as unauthorized access attempts, which can mitigate security breaches.

It’s important to note that while an IAM solution can help to mitigate the risk of a security incident, it’s not a silver bullet and it’s not a guarantee of full protection. Ultimately, a comprehensive security strategy that includes regular security audits, employee training, and incident response planning is necessary to protect against cyber threats.

Recommendations for Effectively Leveraging IAM

So, how can businesses effectively leverage IAM to protect against cyberattacks? Here are a few recommendations:

• Identify critical assets. Identify the data assets and IT resources that are most critical to your operations so that you can ensure they are properly protected.
• Implement strong authentication mechanisms, such as MFA, to make it more difficult for hackers to steal account credentials or tokens.
• Deploy effective access controls that ensure users are only able to access the information and systems they need to perform their jobs.
• Regularly review and update access controls to ensure they align with current business needs.
• Monitor and analyze logs for suspicious activity and investigate any incidents. (Watch our logging and monitoring video for tips.)
• Maintain incident response programs to quickly respond to and recover from any security incidents.

Identity and access management (IAM) is essential for every organization’s cybersecurity program. IAM solutions provide a way for organizations to control who has access to their systems, data, and applications, and to ensure that only authorized individuals are able to access them. By effectively leveraging IAM, businesses can safeguard themselves against cyber threats and achieve “super” cybersecurity.

Contact us If you need help with cybersecurity services, including penetration testing, advisory services, solution implementation or training. Our expert team is happy to help!