Mitigating identity security risks: Safeguarding India's digital transformation

Digital transformation has become an imperative for Indian organisations, particularly in the wake of the pandemic. Research firm, IDC India’s Digital Transformation (DX) Survey conducted in 2022 validates the significant emphasis on digital transformation within Indian organisations. Around three-fourths of the respondents expressed their intent on increasing DX spending in 2022 and 2023 compared to the previous year, while 20% planned to maintain the same level of spending as in 2021.

However, as businesses embrace the digitalisation, the risks associated with identity security have intensified. Unsecured identities can pose significant risks to organisations, providing attackers with a gateway to infiltrate and carry out malicious campaigns. Weak or default credentials on systems and services open the door for unauthorised access.

Additionally, password reuse and credential stuffing tactics allow attackers to exploit shared credentials across multiple accounts. Phishing attacks and social engineering techniques can trick employees into revealing login information, while malware and keyloggers record keystrokes to capture sensitive data. Using the compromised credentials, attackers escalate their privileges to gain higher-level access from compromised low-level accounts. There is hence a need for robust cybersecurity measures to protect sensitive information and maintain the momentum of India's digital revolution.

Identity-centric risks
The CyberArk 2023 Identity Security Threat Landscape Report highlights the following risks from an identity perspective, which are extremely relevant to organisations today. Some of these risks include:

• As organisations rely on digital platforms and processes, the number of identities with sensitive access increases significantly. Among Indian organisations, 75% of these are inadequately secured. Notably, India surpasses global findings with a higher number of machines possessing sensitive access (42%) compared to humans (38%).
• The report also emphasises the importance of addressing cyber threats resulting from employee churn. In 2023, approximately 80% of Indian organisations expect cyber issues caused by employee churn, which could stem from disgruntled ex-staffers or exploitable leftover credentials.
• Significantly, a massive 92% of Indian firms today feel that malware or malicious code injection into their respective software supply chains is one of the biggest security threats they face

Mitigating identity security risks
To mitigate identity security risks, Indian organisations should adopt the following best practices:

• Strengthen access controls: Implement robust access control mechanisms such as multifactor authentication (MFA), strong passwords, and role-based access control (RBAC) to minimise unauthorised access. Regularly review and update access permissions to align with changing roles and responsibilities.
• Employee education and awareness: Establish a culture of cybersecurity awareness by conducting regular training sessions. Educate employees about secure practices, such as identifying and avoiding phishing emails, using secure networks, and reporting potential threats promptly.
• Privileged access management (PAM): Implement a comprehensive PAM solution to manage and secure privileged accounts. Enforce strong password policies, regular rotation of credentials, and least privilege principles. Monitor privileged access activities closely to detect any anomalies or potential misuse.
• Regular security audits and assessments: Conduct periodic security audits and assessments to identify vulnerabilities and gaps in identity security. Address these weaknesses promptly and regularly update security protocols to align with emerging threats and best practices.
• Secure third-party relationships: Exercise caution when granting access to third-party vendors, consultants, and service providers. Implement rigorous security measures, conduct due diligence, and enforce strict contractual obligations to ensure the protection of sensitive information.
• Adopt a zero-trust approach: Implementing a Zero-Trust approach is paramount to ensuring identity security. By adopting a "trust nothing, verify everything" mindset, organisations can protect a wide array of human and machine identities. To secure the infrastructure running business-critical applications, organisations must have a least privilege access approach, which ensures that individuals only have access to the resources necessary for their specific roles, minimising the potential impact of a breach.

Further, to prevent unauthorised access, organisations can also implement just-in-time access for operations that do not require continuous 24/7 access permissions. By granting temporary access when needed and revoking it afterward, organisations can reduce the attack surface and limit potential security risks. Organisations must also limit administrative privileges and thereby mitigate the risk of unauthorised changes and unauthorised software installations.

Embracing the principles of least privilege, just-in-time access and local admin removal can empower organisations to mitigate the risks associated with identity compromise and bolster their overall cybersecurity defences.

• Robust incident response plan: Develop and test an effective incident response plan to detect, contain, and mitigate security incidents promptly. Establish clear communication channels, designate responsible teams, and regularly update the plan based on evolving threats and lessons learned.

As India embraces digital transformation in a big way, the risks associated with identity security cannot be ignored. Organisations must prioritise cybersecurity measures to protect sensitive information from malicious actors. By implementing the best practices outlined above, Indian organisations can mitigate identity security risks and foster a secure digital environment.

Safeguarding identities is crucial to ensuring the continued success of India's digital revolution and achieving the anticipated benefits of enhanced efficiency, improved security/risk capabilities, and an elevated customer experience.

-- Sumit Srivastava, Solutions Engineering Director. India, CyberArk.