Identity centric security

1. Confidential. Copyright © 2018 Nanosec1
Zero Trust and Identity in the Enterprise
Co-­organized by
5/ 14/ 2019

2. Copyright © 2018 Nanosec2
Agenda Details
6:00PM to 6:25PM: Registration
6:25PM to 7:00PM: A Changing Paradigm: What Happens When You Put
Identity at the Center of Security?
-> Joe Gottlieb, Executive Advisory Board, Identity Defined Security
Alliance and SVP Strategy and BD, SailPoint
7:00PM to 7:10PM: Q&A
7:10PM to 7:45PM: Adobe's Zero Trust Enterprise Network (ZEN) and the
Role of Identity
-> Den Jones, Director Enterprise Security, Adobe
Event WiFi
SSID: HD-­Events
Password: f83l7b
SSID: HD-­Guest
Password: hackerdojo

4. Confidential. Copyright © 2018 Nanosec4
ENTERPRISE CHALLENGES
Cybersecurity is relentlessly, cumulatively challenging
Compromised identities are still the leading cause of breaches
– “The exploitation of usernames and passwords by nefarious actors
continues to be a ripe target…” ITRC 2018 End-of-Year Data Breach Report
Single vendor approaches are not working

5. EVOLUTION OF IDENTITY AND ITS IMPACT
Employees
Perimeter
Employees
and Partners
Consumers
Perimeter-less
Federation
Cloud / SaaS
Things
Perimeter-less
Federation
Cloud / SaaS
Mobility
Relationships
Attributes
Context
Stateless
IT EFFICIENCY
IT COMPLIANCE
SECURITY
API
AI
API
BUSINESS AGILITY
UX
Perimeter
Federation
Source: Optiv

6. Confidential. Copyright © 2018 Nanosec6
Identity is a critical cybersecurity technology
FOUNDATION FOR A NEW APPROACH
Cybersecurity technologies must fundamentally work together if they
are to achieve meaningful effectiveness
Every business transaction, attack surface or target involves a
credential and a service or piece of data
Given the cumulative investment in security, each new investment is
increasingly measured for its ability to make the whole more effective

7. GOAL:
Become an independent source of education and
information on identity-centric security
strategies.
MISSION:
The Identity Defined Security Alliance is a
non-profit organization that facilitates
community collaboration to develop a
framework and practical guidance that
helps organizations put identity at the center
of their security strategy.

8. Confidential. Copyright © 2018 Nanosec8
Deliver on our mission through…
Cross vendor collaboration
Thought leadership through blogs, webinars, speaking
Identity Centric Security Framework: vendor-­agnostic best practices, security controls, use cases
Customer implementation stories
Virtual community for sharing experiences and validation
IDENTITY DEFINED SECURITY ALLIANCE

9. Confidential. Copyright © 2018 Nanosec9
Steers the focus away from single point
defense mechanisms to include a broader set
of identity and security components
BENEFITS OF IMPROVING IDENTITY THROUGH SECURITY
Delivers a fresh, balanced set of
detective and preventive controls
Enables organizations to tackle security
with a more precise, identity-aware and
identity-specific approach
Leverages increasingly open and API-
first tech stacks

10. Customer Advisory Board

11. Confidential. Copyright © 2018 Nanosec11
IDENTITY DEFINED SECURITY ALLIANCE
RESOURCES

12. Once user roles and entitlements are
defined, high profile users should require a
level of assurance of authentication to match
the value of the protected asset.
IAM Best PracticePutting Identity-Centric Security to Work – IAM Best Practice (Sample)

13. IGA+PAM:
Aggregation of Direct & Effective Privileged Access for each
IdentityIntegrate Components:
• Identity Governance + Privileged Account
Management
What Happens:
• All privileged access provided by the PAM
system is imported and maintained in the
Identity Governance system
Value to Organization:
• Understand who has access to privileged
accounts
Putting Identity-Centric Security to Work – Security Controls

14. IGA+PAM:
SoD Policy Enforcement across Privileged Accounts
Integrate Components:
• Identity Governance + Privileged Account
Management
Pre-requisite:
• Aggregation of Direct & Effective Privileged Access
for each Identity
What Happens:
• Toxic combinations of privileged access are reduced
via detective and preventive controls
Value to Organization:
• Reduction in fraud and other access abuse scenarios
Putting Identity-Centric Security to Work – Security Controls

15. IGA+PAM:
Certification of Privileged Accounts
Integrate Components:
• Identity Governance + Privileged Account Management
Pre-requisite:
• Aggregation of Direct & Effective Privileged Access for
each Identity
What Happens:
• Supervisors and/or application owners review and
approve/deny privileged access for specific users and
groups, either periodically or as driven by a life cycle event
Value to Organization:
• Continuous pruning of unnecessary privileged access,
reducing the risk of privileged credential abuse
Putting Identity-Centric Security to Work – Security Controls

16. IGA+SIEM/UEBA:
Semi-automated Identity Governance for Incident Response
Integrate Components:
• Identity Governance + SIEM or UEBA
What Happens:
• Security incident involving a specific
identity is routed to that identity’s supervisor
for review and response
Value to Organization:
• Business context (e.g., supervisor’s
knowledge of an employee’s situation)
enables efficient incident response
Putting Identity-Centric Security to Work – Security Controls

17. IGA+SIEM/UEBA:
Automated Identity Governance for Incident Response
Integrate Components:
• Identity Governance + SIEM or UEBA
What Happens:
• Security incident involving a specific
identity automatically triggers entitlement
suspension or dynamic re-certification
Value to Organization:
• Identity- and entitlement-specific control
enables a proportional and targeted response
to security incident
Putting Identity-Centric Security to Work – Security Controls

18. HOW TO LEVERAGE
THE IDSA

19. LEARN FROM YOUR PEERS
Adobe Finds ZEN Using Identity-Centric Security
“Working with the IDSA is a great
opportunity to help drive innovation across
the tech industry with vendors and solution
providers alike. Adobe benefits through
exposure to vendors, use cases and
community best practices that help elevate
and strengthen our identity and security
teams.”
Den Jones
Director of Enterprise Security, Adobe

20. Resources
https://www.idsalliance.org/
https://forum.idsalliance.org/

21. Confidential. Copyright © 2018 Nanosec21
Thank You!
For more information please contact:
Vishwas Manral
CEO and Founder
VISHWAS@NANOSEC.IO