The concept of identity security is straightforward and follows a standard workflow that can be understood and secured. First, a user logs into their employee desktop and is authenticated as an individual who should have access to this network segment. This is the authentication stage.

They have appropriate permissions assigned so they can navigate to the required assets (such as an application or file servers) and are authorized as someone who should have access to this application. This is the authorization stage.

As they move across the network to carry out their day-to-day duties, all of this movement is logged, and all access information is captured and analyzed for auditing purposes. Anything outside of normal behavior is flagged. Splunk UEBA has good features here.

• Stage of Authentication: You must accurately authenticate every human and non-human identity. After an identity is authenticated to confirm who it is, it only gets a free one for some to access the system with impunity. 

• Stage of Re-Authentication: Identities should be re-authenticated if the system detects suspicious behavior or before completing tasks and accessing data that is deemed to be highly sensitive. If we have an identity that acts outside of normal baseline behavior, they must re-authenticate.

• Stage of Authorization: Then we need to move to authorization. We need to authorize the user to ensure they’re allowed access to the asset only when required and only with the permissions they need to do their job. So we have authorized each identity on the network with the proper permissions so they can access what they need and not more. 

• Stage of Access: Then, we look into Access: Provide structured access to authorized assets for that identity. How can appropriate access be given to the person/user/device/bot/script/account and nothing else? Follow the practices of zero-trust identity management and least privilege. Ideally, access is granted to microsegments instead of significant VLANs based on traditional zone-based networking.

• Stage of Audit: All identity activity must be audited or accounted for. Auditing allows insight and evidence that Identity Security policies are working as intended. How do you monitor identity activities? How do you reconstruct and analyze an identity’s actions? An auditing capability ensures visibility into an identity’s activities, provides context for the identity’s usage and behavior, and enables analytics that identify risk and provide insights to make smarter decisions about access.

Example Product: What is Cisco Cyber Vision?

Cisco Cyber Vision is a state-of-the-art security solution designed to bridge the gap between IT and OT networks. It provides real-time visibility into your network, enabling you to monitor and protect your industrial assets effectively. By integrating seamlessly with existing Cisco infrastructure, Cyber Vision offers a unified approach to network security, making it easier to manage and mitigate potential threats.

### Key Features of Cisco Cyber Vision

#### Real-Time Network Visibility

One of the standout features of Cisco Cyber Vision is its ability to provide real-time visibility into your network. This means you can see all devices, communications, and activities within your OT environment. By having a clear, up-to-date view of your network, you can quickly identify any anomalies or suspicious activities that may indicate a security threat.

#### Threat Detection and Mitigation

Cisco Cyber Vision uses advanced algorithms and machine learning to detect potential threats. It continuously monitors network traffic and behaviors, comparing them against known threat patterns. When a threat is detected, Cyber Vision can automatically initiate mitigation actions, such as isolating affected devices or blocking malicious traffic, to prevent further damage.

#### Seamless Integration with Cisco Products

Another significant advantage of Cisco Cyber Vision is its seamless integration with other Cisco security products. Whether you’re using Cisco Firepower, ASA, or other security solutions, Cyber Vision enhances your overall security posture by providing additional layers of protection and insights. This integration ensures that all aspects of your network are covered, offering a more robust defense against cyber threats.

### Benefits of Implementing Cisco Cyber Vision

#### Enhanced Security Posture

By providing comprehensive visibility and advanced threat detection capabilities, Cisco Cyber Vision significantly enhances your network’s security posture. This means fewer vulnerabilities, faster response times to incidents, and overall, a more secure and resilient network environment.

#### Simplified Network Management

Managing network security can be a complex and time-consuming task, especially in industrial environments. Cisco Cyber Vision simplifies this process by offering a centralized platform for monitoring and managing security across your entire network. This not only saves time but also reduces the likelihood of human error, ensuring a more efficient and effective security strategy.

#### Compliance and Reporting

Many industries are subject to strict regulatory requirements regarding network security. Cisco Cyber Vision helps you stay compliant by providing detailed reports and audit trails. This makes it easier to demonstrate compliance with industry standards and regulations, giving you peace of mind and helping you avoid potential fines or penalties.

### How to Get Started with Cisco Cyber Vision

Implementing Cisco Cyber Vision in your network is a straightforward process. Start by assessing your current network infrastructure and identifying any gaps or vulnerabilities. Next, work with a Cisco partner or consultant to design and deploy a Cyber Vision solution tailored to your specific needs. Finally, continuously monitor and update your security measures to ensure ongoing protection against emerging threats.

Example Technology: Scanning Networks

The Importance of Network Scanning

Network scanning systematically examines a network to identify its vulnerabilities, open ports, and active devices. Network administrators can gain valuable insights into their security posture using specialized tools and techniques. Understanding the fundamentals of network scanning is crucial for effectively securing network infrastructures.

There are several network scanning techniques, each serving a specific purpose. Port scanning, for example, involves probing network ports to identify potential entry points for attackers. Vulnerability scanning, on the other hand, focuses on identifying known vulnerabilities within network devices and applications. Organizations can adopt a comprehensive approach to network security by exploring these different types of network scanning.

Starting Zero Trust Identity Management

Now, we have an identity as the new perimeter compounded by identity being the latest target. Any identity is a target. Looking at the modern enterprise landscape, it’s easy to see why. Every employee has multiple identities and uses several devices.

What makes this worse is that security teams’ primary issue is that identity-driven attacks are hard to detect. For example, how do you know if a bad actor or a sys admin uses the privilege controls? As a result, security teams must find a reliable way to monitor suspicious user behavior to determine the signs of compromised identities.

We now have identity sprawl, which may be acceptable if only one of those identities has user access. However, it doesn’t, and it most likely has privileged access. All these widen the attack surface by creating additional human and machine identities that can gain privileged access under certain conditions, establishing new pathways for bad actors.

We must adopt a different approach to secure our identities regardless of where they may be. Here, we can look for a zero-trust identity management approach based on identity security. Next, I’d like to discuss your common challenges when adopting identity security.

Challenge 1: Zero trust identity management and privilege credential compromise

Current environments may result in anonymous access to privileged accounts and sensitive information. Unsurprisingly, 80% of breaches start with compromised privilege credentials. If left unsecured, attackers can compromise these valuable secrets and credentials to gain possession of privileged accounts and perform advanced attacks or use them to exfiltrate data.

Challenge 2: Zero trust identity management and exploiting privileged accounts

We have two types of bad actors. First, there are external attackers and malicious insiders who can exploit privileged accounts to orchestrate a variety of attacks. Privileged accounts are used in nearly every cyber attack. With privileged access, bad actors can disable systems, take control of IT infrastructure, and gain access to sensitive data. So, we face several challenges when securing identities, namely protecting, controlling, and monitoring privileged access.

Challenge 3: Zero trust identity management and lateral movements

Lateral movements will happen. A bad actor has to move throughout the network. They will never land directly on a database or important file server. The initial entry point into the network could be an unsecured IoT device, which does not hold sensitive data. As a result, bad actors need to pivot across the network.

They will laterally move throughout the network with these privileged accounts, looking for high-value targets. They then use their elevated privileges to steal confidential information and exfiltrate data. There are many ways to exfiltrate data, with DNS being a common vector that often goes unmonitored. How do you know a bad actor is moving laterally with admin credentials using admin tools built into standard Windows desktops?

The issue with VLAN-based segmentation is large broadcast domains with free-for-all access. This represents a larger attack surface where lateral movements can take place. Below is a standard VLAN-based network running Spanning Tree Protocol ( STP ).

Challenge 4: Zero trust identity management and distributed attacks

These attacks are distributed, and there will be many dots to connect to understand threats on the network. Could you look at ransomware? Enrolling the malware needs elevated privilege, and it’s better to detect this before the encryption starts. Some ransomware families perform partial encryption quickly. Once encryption starts, it’s game over. You need to detect this early in the kill chain in the detect phase.

The best approach to zero-trust authentication is to know who accesses the data, ensure they are the users they claim to be, and operate on the trusted endpoint that meets compliance. There are plenty of ways to authenticate to the network; many claim password-based authentication is weak.

The core of identity security is understanding that passwords can be phished; essentially, using a password is sharing. So, we need to add multifactor authentication (MFA). MFA gives a big lift but needs to be done well. You can get breached even if you have an MFA solution in place.

Knowledge Check: Multi-factor authentication (MFA)

More than simple passwords are needed for healthy security. A password is a single authentication factor – anyone with it can use it. No matter how strong it is, keeping information private is useless if lost or stolen. You must use a different secondary authentication factor to secure your data appropriately.

Here’s a quick breakdown:

•Two-factor authentication: This method uses two-factor classes to provide authentication. It is also known as ‘2FA’ and ‘TFA.’

•Multi-factor authentication: use of two or more factor classes to provide authentication. This is also represented as ‘MFA.’

•Two-step verification: This authentication method involves two independent steps but does not necessarily require two separate factor classes. It is also known as ‘2SV’.

•Strong authentication: authentication beyond simply a password. It may be represented by the usage of ‘security questions’ or layered security like two-factor authentication.

The Move For Zero Trust Authentication

No MFA solution is an island. Every MFA solution is just one part of multiple components, relationships, and dependencies. Each piece is an additional area where an exploitable vulnerability can occur. Essentially, any element in the MFA’s life cycle, from provisioning to de-provisioning and everything in between, is subject to exploitable vulnerabilities and hacking. And like the proverbial chain, it’s only as strong as its weakest link.

Zero trust authentication: Two or More Hacking Methods Used

Many MFA attacks use two or more of the leading hacking methods. Often, social engineering is used to start the attack and get the victim to click on a link or to activate a process, which then uses one of the other methods to accomplish the necessary technical hacking. 

For example, a user may receive a phishing email directing them to a fake website, which accomplishes a man-in-the-middle (MitM) attack and steals credential secrets. Alternatively, a hardware token may be physically stolen and forensically examined to find the stored authentication secrets. MFA hacking requires using two or all of these main hacking methods.

You can’t rely on MFA alone; you must validate privileged users with context-aware Adaptive Multifactor Authentication and secure access to business resources with Single Sign-On. Unfortunately, credential theft remains the No. 1 area of risk. And bad actors are getting better at bypassing MFA using a variety of vectors and techniques.

For example, a bad actor can be tricked into accepting a push notification to their smartphone to grant access in the context of getting admission. You are still acceptable to man-in-the-middle attacks. This is why MFA and IDP vendors introduce risk-based authentication and step-up authentication. These techniques limited the attack surface, which we will talk about soon.

Considerations for zero trust authentication: 

• Think like a bad actor.

By thinking like a bad actor, we can attempt to identify suspicious activity, restrict lateral movement, and contain threats. Try envisioning what you would look for if you were a bad external actor or malicious insider. For example, are you looking to steal sensitive data to sell it to competitors, start Ransomware binaries, or use your infrastructure for illicit crypto mining? 

• Attacks with happen

The harsh reality is that attacks will happen, and you can only partially secure some of their applications and infrastructure wherever they exist. So it’s not a matter of ‘if’ but a concern of’ when.’ Protection from all the various methods that attackers use is virtually impossible, and there will occasionally be day 0 attacks. So, they will eventually get in; it’s all about what they can do once they are in.

• The first action is to protect Identities.

Therefore, you must first protect their identities and prioritize what matters most—privileged access. Infrastructure and critical data are only fully protected if privileged accounts, credentials, and secrets are secured and protected.

• The bad actor needs privileged access.

We know that about 80% of breaches tied to hacking involve using lost or stolen credentials. Compromised identities are the common denominator in virtually every severe attack. The reason is apparent: 

The bad actor needs privileged access to the network infrastructure to steal data. However, without privileged access, an attacker is severely limited in what they can do. Furthermore, without privileged access, they may be unable to pivot from one machine to another. And the chances of landing on a high-value target are doubtful.

• The malware requires admin access

The malware used to pivot and requires admin access to gain persistence; privileged access without vigilant management creates an ever-growing attack surface around privileged accounts.

Example Product: Cisco Secure Workload

### What is Cisco Secure Workload?

Cisco Secure Workload, formerly known as Tetration, is a security platform that offers visibility and micro-segmentation for your entire IT infrastructure. It provides real-time analytics and enforces consistent security policies across your network. With capabilities like automated application dependency mapping, behavioral analysis, and zero-trust security, Cisco Secure Workload enables organizations to identify and mitigate threats effectively.

### Key Features of Cisco Secure Workload

– **Real-Time Visibility**: Cisco Secure Workload offers unparalleled visibility into your applications and their dependencies. This real-time insight helps in identifying vulnerabilities and understanding traffic patterns.

– **Micro-Segmentation**: By dividing your network into smaller, isolated segments, Cisco Secure Workload limits the lateral movement of threats, effectively containing potential breaches.

– **Behavioral Analysis**: The platform uses advanced algorithms to analyze the behavior of applications and users, detecting anomalies that could signify a security threat.

– **Automated Policy Enforcement**: With Cisco Secure Workload, you can automate the creation and enforcement of security policies, ensuring consistent protection across your entire infrastructure.

### Benefits of Using Cisco Secure Workload

– **Enhanced Security Posture**: With features like micro-segmentation and behavioral analysis, Cisco Secure Workload significantly enhances your organization’s security posture.

– **Operational Efficiency**: The platform’s automation capabilities reduce the need for manual intervention, allowing your IT team to focus on more strategic tasks.

– **Scalability**: Cisco Secure Workload is designed to scale with your business, making it suitable for organizations of all sizes.

– **Compliance**: By enforcing consistent security policies and providing detailed audit trails, Cisco Secure Workload helps organizations meet regulatory compliance requirements.

### Best Practices for Implementing Cisco Secure Workload

– **Start with a Comprehensive Assessment**: Before implementing Cisco Secure Workload, conduct a thorough assessment of your current security posture and identify areas that need improvement.

– **Define Clear Policies**: Establish clear security policies that align with your organization’s goals and regulatory requirements. Cisco Secure Workload can help automate these policies, but they need to be well-defined from the outset.

– **Monitor Continuously**: Continuous monitoring is crucial for identifying and mitigating threats in real-time. Make use of Cisco Secure Workload’s real-time analytics to keep an eye on your network.

– **Regularly Update and Review**: The threat landscape is constantly evolving, so it’s essential to regularly update your security policies and review your implementation strategy.

Adopting Zero Trust Authentication 

Zero trust authentication:

Technology with Fast Identity Online (FIDO2)

Where can you start identity security with all of this? Firstly, we can look at a zero-trust authentication protocol. We need an authentication protocol that can be phishing-resistant. This is FIDO2, known as Fast Identity Online (FIDO2), built on two protocols that effectively remove any blind protocols. FIDO authentication Fast Identity Online (FIDO) is a challenge-response protocol that uses public-key cryptography. Rather than using certificates, it manages keys automatically and beneath the covers.

The FIDO2 standards

FIDO2 uses two standards. The Client to Authenticator Protocol (CTAP) describes how a browser or operating system establishes a connection to a FIDO authenticator. The WebAuthn protocol is built into browsers and provides an API that JavaScript from a web service can use to register a FIDO key, send a challenge to the authenticator, and receive a response to the challenge.

So, there is an application the user wants to go to, and then we have the client, which is often the system’s browser, but it can be an application that can speak and understand WebAuthn. FIDO provides a secure and convenient way to authenticate users without using passwords, SMS codes, or TOTP authenticator applications. Modern computers, smartphones, and most mainstream browsers understand FIDO natively. 

FIDO2 addresses phishing by cryptographically proving that the end-user has a physical position over the authentication. There are two types of authenticators: a local authenticator, such as a USB device, and a roaming authenticator, such as a mobile device. These need to be certified FIDO2 vendors. 

The other is a platform authenticator such as Touch ID or Windows Hello. While roaming authenticators are available, for most use cases, platform authenticators are sufficient. This makes FIDO an easy, inexpensive way for people to authenticate. The biggest impediment to its widespread use is that people won’t believe something so easy is secure.

Risk-based authentication

Risk is not a static attribute, and it needs to be re-calculated and re-evaluated so you can make intelligent decisions for step-up and user authentication. We have Cisco DUO that reacts to risk-based signals at the point of authentication.

These risk signals are processed in real-time to detect signs of known account takeout signals. These signals may include Push Bombs, Push Sprays, and Fatigue attacks. Also, a change of location can signal high risk. Risk-based authentication (RBA) is usually coupled with step-up authentication.

For example, let’s say your employees are under attack. RBA can detect this attack as a stuffing attack and move from a classic authentication approach to a more secure verified PUSH approach than the standard PUSH. 

This would add more friction but result in better security, such as adding three to six digital display keys at your location/devices, and you need to enter this key in your application. This eliminates fatigue attacks. This verified PUSH approach can be enabled at an enterprise level or just for a group of users.

Conditional Access

Then, we move towards conditional access, a step beyond authentication. Conditional access examines the context and risk of each access attempt. For example, contextual factors may include consecutive login failures, geo-location, type of user account, or device IP to either grant or deny access. Based on those contextual factors, access may be granted only to specific network segments. 

Risk-based decisions and recommended capabilities

The identity security solution should be configurable to allow SSO access, challenge the user with MFA, or block access based on predefined conditions set by policy. It would help if you looked for a solution that can offer a broad range of shapes, such as IP range, day of the week, time of day, time range, device O/S, browser type, country, and user risk level. 

These context-based access policies should be enforceable across users, applications, workstations, mobile devices, servers, network devices, and VPNs. A key question is whether the solution makes risk-based access decisions using a behavior profile calculated for each user.

Technology with JIT techniques

Secure privileged access and manage entitlements. For this reason, many enterprises employ a least privilege approach, where access is restricted to the resources necessary for the end-user to complete their job responsibilities with no extra permission. A standard technology here would be Just in Time (JIT). Implementing JIT ensures that identities have only the appropriate privileges, when necessary, as quickly as possible and for the least time required. 

JIT techniques that dynamically elevate rights only when needed are a technology to enforce the least privilege. The solution allows for JIT elevation and access on a “by request” basis for a predefined period, with a full audit of privileged activities. Full administrative rights or application-level access can be granted, time-limited, and revoked.

Final Notes For Identity Security 

Zero-trust identity management involves continuously verifying users and devices to ensure access and privileges are granted only when needed. The backbone of zero-trust identity security starts by assuming that any human or machine identity with access to your applications and systems may have been compromised.

The “assume breach” mentality requires vigilance and a Zero Trust approach to security centered on securing identities. With identity security as the backbone of a zero-trust process, teams can focus on identifying, isolating, and stopping threats from compromising identities and gaining privilege before they can harm.

Zero Trust Authentication

The identity-centric focus of zero trust authentication uses an approach to security to ensure that every person and every device granted access is who and what they say they are. It achieves this authentication by focusing on the following key components:

1. The network is always assumed to be hostile.
2. External and internal threats always exist on the network.
3. Network locality needs to be more sufficient to decide trust in a network. As discussed, other contextual factors must also be taken into account.
4. Every device, user, and network flow is authenticated and authorized. All of this must be logged.
5. Security policies must be dynamic and calculated from as many data sources as possible.

Zero Trust Identity: Validate Every Device

Not just the user

Validate every device. While user verification adds a level of security, more is needed. We must ensure that the devices are authenticated and associated with verified users, not just the users.

Risk-based access

Risk-based access intelligence should reduce the attack surface after a device has been validated and verified as belonging to an authorized user. This allows aspects of the security posture of endpoints, like device location, a device certificate, OS, browser, and time, to be used for further access validation. 

Device Validation: Reduce the attack surface

While device validation helps limit the attack surface, it is only as reliable as the endpoint’s security. Antivirus software to secure endpoint devices will only get you so far. We need additional tools and mechanisms to tighten security even further.

Example Product: Cisco Meraki

### What is Cisco Meraki?

Cisco Meraki is a cloud-based IT management platform that provides a range of solutions, including wireless, switching, security, enterprise mobility management (EMM), and security cameras. The platform is designed to simplify the complexities of modern network management, making it accessible even to those without deep technical expertise.

### Key Features

#### Cloud Management

One of the standout features of Cisco Meraki is its cloud management capabilities. This allows IT administrators to manage their entire network from a single, intuitive dashboard. The cloud-based approach ensures that updates and patches are automatically applied, keeping the network secure without requiring manual intervention.

#### Advanced Security

Security is at the forefront of Cisco Meraki’s offerings. The platform includes advanced security features such as intrusion detection and prevention, malware protection, and content filtering. These features work together to provide a multi-layered defense against cyber threats, ensuring that your network remains secure.

#### Scalability and Flexibility

Cisco Meraki is designed to scale with your business. Whether you are managing a small office or a large enterprise, the platform can be easily expanded to meet your needs. The flexible architecture allows for the addition of new devices and services without significant reconfiguration, making it an ideal choice for growing businesses.

### Benefits for Businesses

#### Simplified IT Management

Cisco Meraki’s cloud-based approach simplifies IT management by consolidating various network functions into a single platform. This reduces the need for multiple tools and interfaces, streamlining operations and reducing the potential for errors.

#### Enhanced Productivity

By automating routine tasks and providing real-time insights into network performance, Cisco Meraki enables IT teams to focus on more strategic initiatives. This enhances overall productivity and allows businesses to make more informed decisions.

#### Cost Efficiency

The cloud-managed nature of Cisco Meraki eliminates the need for expensive on-premises hardware and reduces the associated maintenance costs. Additionally, the platform’s scalability means that businesses only pay for what they need, making it a cost-effective solution for organizations of all sizes.

### Use Cases

#### Retail

In the retail sector, Cisco Meraki can be used to provide secure guest Wi-Fi, streamline point-of-sale systems, and enhance customer engagement through analytics. The platform’s security features also protect sensitive customer data from breaches.

#### Education

Educational institutions can benefit from Cisco Meraki’s robust security and easy-to-manage network infrastructure. The platform supports a range of devices and applications, facilitating a modern learning environment while ensuring student data privacy.

#### Healthcare

For healthcare providers, Cisco Meraki offers secure and reliable network solutions that support telemedicine, electronic health records (EHR), and patient monitoring systems. The platform’s compliance with industry standards ensures that patient data is protected.

Example Product: Cisco Umbrella

**What is Cisco Umbrella?**

Cisco Umbrella is a cloud-delivered security service that provides the first line of defense against internet threats. It leverages DNS (Domain Name System) to block malicious domains, IP addresses, and cloud applications before they can cause harm. By analyzing and learning from internet activity patterns, it proactively identifies potential risks and stops them in their tracks. The beauty of Cisco Umbrella lies in its simplicity and effectiveness, making it an essential tool for both individuals and organizations.

**Identity Security: The Heart of Cisco Umbrella**

One of the standout features of Cisco Umbrella is its focus on identity security. In an era where cybercriminals are increasingly targeting user identities, protecting these credentials has become crucial. Cisco Umbrella employs advanced techniques to ensure that user identities are not compromised. By integrating with identity providers, it ensures secure access to applications and data, regardless of the user’s location. This not only enhances security but also provides a seamless user experience, as employees can securely access the resources they need without unnecessary hurdles.

**How Cisco Umbrella Works**

Cisco Umbrella operates by routing your internet traffic through its global network of data centers. When you attempt to access a website, Umbrella checks the domain against its vast database of known threats. If the domain is flagged as malicious, access is blocked instantly, preventing any potential harm. Additionally, Cisco Umbrella uses machine learning algorithms to detect new threats by analyzing patterns and behaviors. This proactive approach ensures that even emerging threats are identified and mitigated before they can impact your network.

**Benefits of Using Cisco Umbrella**

The benefits of using Cisco Umbrella are manifold. Firstly, it provides comprehensive protection against a wide range of cyber threats, including malware, phishing, and ransomware. By blocking these threats at the DNS layer, it stops attacks before they can infiltrate your network. Secondly, Cisco Umbrella offers visibility into internet activity across all devices, ensuring that you have complete oversight of your digital environment. Lastly, it simplifies security management by providing a single, unified platform that integrates seamlessly with existing security solutions.