Security Boulevard

The Evolution of Identity and Access Management (IAM)
madhav
Thu, 09/05/2024 - 05:03

The evolution of Identity and Access Management (IAM) has been a fascinating journey, shaped by technological advancements, security challenges, and evolving business needs. In the early days, IAM wasn’t even called IAM, and organizations implemented basic user authentication mechanisms to control access to their systems. As technology advanced and businesses became more reliant on digital systems, the need for more comprehensive IAM solutions became apparent. The development of IAM continued as organizations sought to manage the growing complexity of user identities and access rights across multiple systems and applications.

The progress of IAM has resulted in the inclusion of functionalities like single sign-on, multi-factor authentication, adaptive access controls, and identity governance. Additionally, IAM solutions now integrate with diverse systems and applications, offering organizations the flexibility to manage user identities and access rights across hybrid IT environments.

Furthermore, IAM has become an integral component of cybersecurity strategies, addressing compliance requirements and providing enhanced visibility and control over user access to critical resources. Overall, the evolution of IAM has been driven by the need to adapt to the complexities of modern IT ecosystems while ensuring robust security and seamless user experience.

Understanding the critical stages in developing IAM is crucial to appreciate its transformative impact on modern cybersecurity and access control practices.

Traditional IAM

The early stages of IAM predominantly focused on basic user authentication and authorization processes. Users were typically provided simple username and password credentials to access systems and applications. However, as cyber threats became more sophisticated, it became evident that traditional IAM methods were insufficient to ensure robust security measures.

Single Sign-On (SSO)

As organizations increasingly rely on multiple applications and systems, the demand for a more seamless and efficient IAM solution became apparent. This led to the emergence of Single Sign-On (SSO) capabilities, which enabled users to access multiple systems and applications using a single set of credentials. SSO greatly improved user experience and simplified access management for IT teams.

Role-Based Access Control (RBAC)

RBAC marked a significant advancement in IAM by introducing a more granular approach to access management. This model allowed organizations to define specific roles and allocate appropriate permissions to users based on their respective roles. By adhering to the principle of least privilege, RBAC enhanced security by limiting unnecessary access rights.

Identity Governance and Administration (IGA)

With the increasing complexity of managing identities and access rights across large enterprises, Identity Governance and Administration (IGA) solutions emerged to address these challenges. IGA platforms offered features for identity lifecycle management, role management, access certifications, and policy enforcement. This empowered organizations to streamline their IAM processes and maintain compliance with regulatory standards.

Adaptive Authentication and Zero Trust

The evolving nature of digital infrastructure, particularly the prevalence of cloud-based services and mobile devices, called for a paradigm shift in IAM. Adaptive authentication and Zero Trust principles were introduced to verify user identities and assess the security posture of devices and applications in real-time. This dynamic approach enabled organizations to adopt a more agile and risk-aware strategy for access management.

Identity as a Service (IDaaS)

As organizations embraced cloud technologies, Identity as a Service (IDaaS) solutions emerged as a scalable and flexible IAM option. IDaaS offerings provided capabilities such as identity federation, multi-factor authentication, and centralized identity management across diverse IT environments, bridging on-premises and cloud-based applications.

The Emergence of CIAM

Customer Identity and Access Management (CIAM) has evolved significantly within the Identity and Access Management (IAM) space. Initially, IAM focused primarily on managing internal users within an organization. However, as businesses began to shift their focus towards improving customer experiences, the need for a specialized approach to managing external identities became evident. This led to the emergence of CIAM solutions tailored specifically for managing customer identities, providing a seamless and secure experience across various digital channels.

Unlike traditional IAM, CIAM places a strong emphasis on user experience, social login, self-service registration, and consent management to meet the unique needs of customers. As a result, CIAM has become a crucial component of the broader IAM landscape, addressing the distinct requirements of customer-facing applications and services while complementing traditional IAM solutions geared towards employee identities and enterprise security.

Today, CIAM platforms are expected to provide a 360-degree view of the customer, support omni-channel engagement, and ensure compliance with data privacy regulations such as GDPR and CCPA. The future of CIAM is likely to revolve around enhanced personalization, advanced security features, and greater interoperability with emerging technologies like artificial intelligence and blockchain.

Continuous Authentication and Beyond

Looking ahead, the future of IAM is poised to encompass continuous authentication methods that leverage cutting-edge technologies such as biometrics, behavioral analytics, and AI-driven risk assessments. Additionally, the concept of Identity Fabric is gaining attention, aiming to integrate IAM, security, and customer experience within a unified platform, reflecting the increasing convergence of these domains.

The evolution of IAM has been an ongoing response to the dynamic interplay between technology, security threats, and organizational requirements. As businesses continue to navigate the complexities of digital transformation, IAM will remain at the forefront of ensuring robust, adaptive, and user-centric access management while staying resilient in the face of evolving cybersecurity challenges.

This evolution will involve a stronger focus on identity governance, risk-based authentication, and continuous monitoring to proactively mitigate security threats. Additionally, IAM for the workforce is expected to integrate more seamlessly with business processes, enabling a frictionless user experience while maintaining stringent security protocols.

Identity & Access Management Access Control Cloud Security

Guido Gerrits | Field Channel Director, EMEA
More About This Author > Schema

basic

The post The Evolution of Identity and Access Management (IAM) appeared first on Security Boulevard.

In the world of SaaS ITDR, the journey taken matters. There are solutions that began from an ITDR perspective. They built threat-hunting capabilities to parse through any data set, look for anomalies, and flag any activity that looks suspicious.  It’s a reasonable approach taken by security organizations that lack a deep understanding of SaaS applications […]

The post A Powerful Approach to SaaS ITDR – Avoiding False Positives on Improbable Travel appeared first on Adaptive Shield.

The post A Powerful Approach to SaaS ITDR – Avoiding False Positives on Improbable Travel appeared first on Security Boulevard.

Torrance, Calif., Sept. 4, 2024, CyberNewsWire — AI SPERA, a leading Cyber Threat Intelligence (CTI) company, has achieved PCI DSS v4.0 certification for its flagship search engine solution, Criminal IP.

This accomplishment builds on last year’s attainment of PCI … (more…)

The post News alert: AI SPERA attains PCI DSS certification for its search engine solution ‘Criminal IP’ first appeared on The Last Watchdog.

The post News alert: AI SPERA attains PCI DSS certification for its search engine solution ‘Criminal IP’ appeared first on Security Boulevard.

Cary, NC, Sept. 4, 2024, CyberNewsWire — In a proactive response to the rapidly evolving landscape of cyber threats, INE Security, a global leader in cybersecurity and network training, today unveiled a crucial initiative aimed at fortifying corporate defenses … (more…)

The post News alert: INE Security releases a strategies guide for cyber threat preparedness, response capabilities first appeared on The Last Watchdog.

The post News alert: INE Security releases a strategies guide for cyber threat preparedness, response capabilities appeared first on Security Boulevard.

Singapore, Sept. 4, 2024, CyberNewsWire — Blackwired, the leading cyber observatory for disruptive cybersecurity technologies, has announced the launch of ThirdWatch?, a groundbreaking solution to identify direct threats facing an organization and its Third Parties.

ThirdWatch? is a subject-directed … (more…)

The post News alert: Blackwired launches ‘ThirdWatch?’ — an advanced third-party risk management platform first appeared on The Last Watchdog.

The post News alert: Blackwired launches ‘ThirdWatch?’ — an advanced third-party risk management platform appeared first on Security Boulevard.

The White House is urging internet network providers to take steps outlined in its roadmap to better secure the Border Gateway Protocol, a set of rule that are not widely known but are crucial to routing traffic around the internet.

The post White House Wants to Tighten Internet Routing Security appeared first on Security Boulevard.

Authors/Presenters:Daniel Moghimi

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – Downfall: Exploiting Speculative Data Gathering appeared first on Security Boulevard.

As AWS continues to evolve, new services and permissions are frequently introduced to enhance functionality and security. This blog provides a comprehensive recap of new sensitive permissions and services added in August 2024. Our intention in sharing this is to flag the most important releases to keep your eye on and update your permissions and […]

The post August Recap: New AWS Sensitive Permissions and Services appeared first on Security Boulevard.

 

The decentralized finance (DeFi) and
cryptocurrency industries are being targeted by North Korean social engineering
schemes in highly personalized and convincing ways.

 

Here is an example that the FBI is showcasing:

1.      
A
person from your dream company, using the name of an old colleague, contacts
you on social media, mentioning a conference you both recently attended and
discussing shared interests.

2.      
He
asks if you're job hunting and reveals his company needs your skills, offering
a significant pay raise.  He arranges an
interview with his CTO and during the interview, the CTO gives you a
“pre-employment” test that involves troubleshooting code from some GitHub
repositories you do not recognize.

3.      
You
clone the repositories, execute the code, find the bugs, and pass the test with
flying colors.

 

Congrats - you have fallen for a well-disguised
social engineering scheme conducted by North Korean cyber actors. One of those
GitHub repositories was malicious and landed a malware dropper on your machine
which installed a key logger and acquired your credentials to access your
company’s network.

 

The North Korean attackers gain access and moving
laterally, eventually getting access to the seed phrases and security
signatures for your company’s cryptocurrency assets.  Shortly thereafter all the company’s crypto
assets disappear and everything you and your colleagues worked for is gone.

 

The threat is real.

 

Check out the full FBI public warning here: https://www.ic3.gov/Media/Y2024/PSA240903

The post FBI Warns of North Korea Attacks Against the Crypto Industry appeared first on Security Boulevard.

Disinformation is hardly new, yet its impact is undeniably amplified in the digital age. AI-enabled bots are amplifying the noise.

The post How Bots and AI Are Fueling Disinformation appeared first on Security Boulevard.

via the inimitable Daniel Stori at Turnoff.US!

Permalink

The post Daniel Stori’s Turnoff.US: ‘pid 1’ appeared first on Security Boulevard.

Regulation and Compliance Updates Every IT Professional Needs to Know Keeping up with IT compliance is a challenging task, especiallyRead More

The post Regulation and Compliance Updates Every IT Professional Needs to Know appeared first on Kaseya.

The post Regulation and Compliance Updates Every IT Professional Needs to Know appeared first on Security Boulevard.

Threat Intelligence Report

Date: September 4, 2024

Prepared by: David Brunsdon, Threat Intelligence - Security Engineer, HYAS

• Malware, short for malicious software, refers to any software designed to harm, exploit or otherwise compromise the functionality and security of computers, networks and devices.
• Common types of malware include viruses, Trojans, ransomware, spyware and adware, each with distinct characteristics and effects that pose significant risks to individuals and organizations.
• HYAS Insight tracks four malware “families”: Urelas, Sality, LockBit and StealC. Here’s a look at how each variety works and how they all pose unique threats.

The critically acclaimed film “The Hurt Locker” follows an elite U.S. Army task force as they dispose of explosives in the Iraq War. Bomb defusing makes for the most suspenseful moments, but several other scenes depict strategically controlled detonations.

When safely disarming a threat is too risky or impractical, bomb squads all over the world practice controlled detonation. There’s a significant advantage to this tactic: bomb technicians can analyze the device’s remnants to gather forensic evidence, understand its construction and maybe even identify its origin.

Although civilian cybersecurity experts don’t usually work with live explosives, they do detonate malware (malicious software such as viruses, ransomware and spyware). How? They execute a suspicious file or program on purpose. Like a bomb squad, they do this in a controlled and isolated environment, both for security and to observe and understand how it works.

Inside the Detonation: Tracking and Monitoring

Malware detonation is a critical method cybersecurity teams (like the experts at HYAS) use to identify and analyze malicious software without risking the integrity of actual systems. We do this by isolating and monitoring the file(s) as they execute, typically on a virtual machine (VM), but sometimes on a bare metal server with no connection to existing network infrastructure (aka an “air-gapped” machine).

Usually, the HYAS team spins up a new VM for each malware sample and tracks all telemetry, including log data and network communication, such as connections to command-and-control (C2) servers. We monitor the malware’s actions, like file creation and process initiation. That information is mapped to the MITRE ATT&CK framework, and with the rest of the detonation data, is added to our dynamic data lake. This data powers the platform’s applications and provides the latest intelligence on domains, IP addresses and other details about the threat.

We also share the intelligence with industry peers through our free daily malware feed.

HYAS’ main challenge is sandbox evasion. This is the phenomenon in which malware tries to detect if it’s being analyzed and alters its behavior accordingly. It’s an ongoing battle between detection and evasion.

Recently, we used HYAS Insight, our leading advanced threat intelligence and investigation platform, to track four major malware “families.” Here’s a breakdown of the key characteristics of each.

Urelas

Urelas is a Trojan primarily designed for data theft and espionage. Originally made to hack participants in online card games — poker players in particular — it targets Windows operating systems and is characterized by its advanced evasion techniques, making it difficult to detect and analyze.

Urelas malware infiltrates systems through phishing emails containing malicious attachments or links and deploys a range of tactics, including taking screenshots of users’ screens and monitoring their keystrokes. Once a hacker has gained access to a system with Urelas, it’s capable of downloading additional malware — which is where the big threats come in.

Sality

Sality is a sophisticated and persistent family of malware known primarily for its file-infecting capabilities. Originating in the early 2000s, Sality targets Windows operating systems and spreads rapidly by infecting executable files by attaching its malicious code to them, enabling it to execute whenever these files are run. This self-replication allows the malware to propagate across networks, removable drives, and shared folders.

The result: Sality effectively turns every infected file into a new vector for spreading malware. Peer-to-peer technology like BitTorrent functions in a similar manner but without harmful results.

One of Sality’s key features is its polymorphic engine, which alters its code with each malware sample, making it excellent at avoiding signature-based detection. Sality malware can also disable security software, modify system settings, and block access to security-related websites, further entrenching itself within the network it targets.

StealC

StealC is a sophisticated malware primarily designed for data theft and credential harvesting. It infiltrates systems through phishing attacks or malicious downloads. Once inside, it stealthily collects sensitive information, such as login credentials, financial data and personal details, often targeting browsers and email clients.

StealC employs advanced evasion techniques to avoid detection by antivirus software, including encryption and anti-analysis methods. The stolen data is then transmitted to a remote server controlled by the attackers. Due to its effectiveness and stealth, StealC poses a significant threat to individuals and organizations alike.

LockBit

LockBit is a notorious ransomware strain that targets organizations by encrypting their data and demanding a ransom for decryption. Known for its rapid encryption speed and advanced evasion techniques, LockBit spreads through phishing emails, exploiting vulnerabilities and remote desktop protocol (RDP) attacks. It employs a double extortion tactic, threatening to publish stolen data if the ransom is not paid.

LockBit’s operators offer a Ransomware-as-a-Service (RaaS) model, allowing affiliates to use the malware for a share of the profits. Its effectiveness and aggressive tactics make LockBit a major threat in the cybersecurity landscape.

Real Threat Intelligence for Real Life

The rapidly expanding threat landscape posed by sophisticated malware families like Urelas, Sality, LockBit and StealC underscores the importance of advanced detection and response capabilities.

Our HYAS Insight threat intelligence platform stands out as uniquely suited to targeting these threats due to its comprehensive approach. By leveraging advanced threat intelligence and real-time tracking, HYAS enables proactive identification and mitigation of malware attacks. Its integration with the MITRE ATT&CK framework facilitates precise mapping of malware behaviors, empowering organizations to strengthen their defenses and stay one step ahead in the ongoing battle against cyber threats.

Want more threat intel on a weekly basis?

Follow HYAS on LinkedIn
Follow HYAS on X

Read recent HYAS threat reports:

HYAS Investigates Threat Actors Hidden In Gaming Services

Caught in the Act: StealC, the Cyber Thief in C 

HYAS Protects Against Polyfill.io Supply Chain Attack with DNS Safeguards

StealC & Vidar Malware Campaign Identified

Sign up for the (free!) HYAS Insight Intel Feed

Disclaimer: This Threat Intelligence Report is provided “as is” and for informational purposes only. HYAS disclaims all warranties, express or implied, regarding the report’s completeness, accuracy, or reliability. You are solely responsible for exercising your own due diligence when accessing and using this Report's information. The analyses expressed in this Report reflect our current understanding of available information based on our independent research using the HYAS Insight platform. The Report’s inclusion of any companies, organizations, or ASNs does not imply any wrongdoing on their part; it is simply an indication of where digital threat activities have been observed. HYAS reserves the right to update the Report as additional information is made known to us.

Learn More About HYAS Insight

An efficient and expedient investigation is the best way to protect your enterprise. HYAS Insight provides threat and fraud response teams with unparalleled visibility into everything you need to know about the attack.This includes the origin, current infrastructure being used and any infrastructure.

Read how the HYAS Threat Intelligence team uncovered and mitigated a Russian-based cyber attack targeting financial organizations worldwide.

More from HYAS Labs

Polymorphic Malware Is No Longer Theoretical: BlackMamba PoC.

Polymporphic, Intelligent and Fully Autonomous Malware: EyeSpy PoC.

The post The Malware Chronicles: Urelas, Sality, LockBit and StealC Examined appeared first on Security Boulevard.

Authors/Presenters:Lesly-Ann Daniel, Marton Bognar, Job Noorman, Sébastien Bardin, Tamara Rezk, Sophia Antipolis; Frank Piessens

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access.
Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – ProSpeCT: Provably Secure Speculation for the Constant-Time Policy appeared first on Security Boulevard.

USB MFA SCA😱: Infineon hardware and software blamed for timing side-channel attack on popular auth tokens.

The post Yikes, YubiKey Vulnerable — ‘EUCLEAK’ FIDO FAIL? appeared first on Security Boulevard.

CISA’s Secure by Demand guidance provides a list of questions that enterprise software buyers should ask software producers to evaluate their security practices prior to, during and after procurement. It’s a good idea in principle as every organization needs to be asking the questions presented in “Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem.” 

The post Secure by Demand: Going Beyond Questionnaires and SBOMs appeared first on Security Boulevard.

This article was originally published in IT Business Net on 8/27/24 by Charlie Sander, CEO at ManagedMethods. The cybersecurity landscape has become more and more complex over the years, especially for schools because they are now relying on various types of digital platforms for teaching, learning, and administrative tasks. There is a mountain of different ...

The post In The News | Layered Cybersecurity Approaches: Why Schools Need to Prioritize Them appeared first on ManagedMethods Cybersecurity, Safety & Compliance for K-12.

The post In The News | Layered Cybersecurity Approaches: Why Schools Need to Prioritize Them appeared first on Security Boulevard.

False positives are one of the most significant yet often overlooked challenges. When a security alert signals a potential threat that turns out to be benign, security teams are left scrambling to investigate a non-issue. While it may seem like a minor inconvenience, the cumulative effect of false positives can be overwhelming. Not only do […]

The post The True Cost of False Positives: Impact on Security Teams and Business Operations  appeared first on VERITI.

The post The True Cost of False Positives: Impact on Security Teams and Business Operations  appeared first on Security Boulevard.

A recent discovery has exposed critical vulnerabilities in the Dovecot mail server, potentially allowing attackers to exploit the IMAP implementation and disrupt service. These vulnerabilities, identified as CVE-2024-23184 and CVE-2024-23185, can lead to denial-of-service (DoS) attacks by overwhelming the server with excessive address headers or very large headers. Dovecot is a popular open-source IMAP and […]

The post Debian Patches Two Dovecot Vulnerabilities appeared first on TuxCare.

The post Debian Patches Two Dovecot Vulnerabilities appeared first on Security Boulevard.

Linux kernel updates often include performance improvements and hardware compatibility. Regular kernel updates are crucial for patching vulnerabilities and protecting your system from cyberattacks. Live patching eliminates the need to reboot the system, avoiding service interruptions. Freshen up with something new and improved – if it’s as simple as applying a software update…. well, why […]

The post Bad Reasons to Update Your Linux Kernel appeared first on TuxCare.

The post Bad Reasons to Update Your Linux Kernel appeared first on Security Boulevard.