Digital identity growth driving cyber security debt uptick

The CyberArk 2022 Identity Security Threat Landscape Report identifies how the rise of human and machine identities – often running into the hundreds of thousands per organisation – has driven a build-up of identity-related cyber security “debt”, exposing organisations to greater cyber security risk.

According to Udi Mokady, founder, chairman and CEO, CyberArk, the past few years have seen spending on digital transformation projects skyrocket to meet the demands of changed customer and workforce requirements.

“The combination of an expanding attack surface, rising numbers of identities, and behind-the-curve investment in cyber security – what we call cyber security debt – is exposing organisations to even greater risk, which is already elevated by ransomware threats and vulnerabilities across the software supply chain.

“This threat environment requires a security-first approach to protecting identities, one capable of outpacing attacker innovation,” Mokady said.

Every major IT or digital initiative results in increasing interactions between people, applications and processes, creating large numbers of digital identities. If these digital identities go unmanaged and unsecured, they can represent significant cyber security risk. CyberArk identified the key Australian findings included:

• Eight-five per cent of Australian organisations indicated that non-humans or bots have access to sensitive data and assets.
• In Australia, machine identities now outweigh human identities by a factor of 15x on an average.
• The average staff member in Australia has greater than 33 digital identities.
• Ninety-one per cent of Australian organisations surveyed store secrets in multiple places across DevOps environments, while 84 per cent say developers typically have more privileges than necessary for their roles.

The 2022 attack surface

Secular trends of digital transformation, cloud migration and attacker innovation are expanding the attack surface.

The report delves into the prevalence and type of cyber threats facing security teams and areas where they see elevated risk:

VIEW ALL

• Eighty per cent of Australian organisations surveyed have experienced ransomware attacks in the past year: two each on average.
• Seventy-nine per cent of Australian organisations have done nothing to secure their software supply chain following the SolarWinds attack, compared to 62 per cent globally.
• Seventy-six per cent of those surveyed from Australia admit compromise of a software supplier would mean an attack on their organisation could not be stopped.
• Credential access was the number one area of risk for Australian respondents (at 35 per cent) – followed by execution (34 per cent), exfiltration (31 per cent), lateral movement (30 per cent) and privilege escalation (30 per cent).

Getting into cyber security debt

Security professionals agree that recent organisation-wide digital initiatives have come at a price. This price is cyber security debt, security programs and tools have grown but not kept pace with what organisations have put in place to drive operations and support growth.

This debt has arisen through not properly managing and securing access to sensitive data and assets, and a lack of Identity security controls is driving up risk and creating consequences.

The debt is compounded by the recent rise in geopolitical tensions, which have already had direct impact on critical infrastructure, highlighting the need for heightened awareness of the physical consequences of cyber attacks:

• Eight-seven per cent of Australian organisations report prioritising the maintenance of business operations over ensuring robust cyber security in the last 12 months (compared to 79 per cent globally).
• Fifty-six per cent have identity security controls in place for their business-critical applications (compared to 48 per cent globally).

While cyber risk awareness has generally risen among executives and board members, it has not necessarily triggered the required programmatic focus and funding to mature core cyber security controls among Australian businesses across all sizes and industries, according to Thomas Fikentscher, regional director of Australia and New Zealand, CyberArk.

“The volume of machine and human identities has steadily grown and will play into the hands of malicious actors unless the current cyber security debt is rapidly addressed with the implementation of strong and adaptive access controls and by enforcing zero trust principles surrounding critical data and assets.

“Compromising fundamental cyber security controls in favour of rapid introduction of new digital initiatives is a risky endeavour and should be brought into balance in 2022 and beyond,” Fikentscher said.

What can be done?

• Push for transparency: 87 per cent of Australian respondents say that a software bill of materials would reduce the risk of compromise stemming from the software supply chain.
• Introduce strategies to manage sensitive access: in Australia, the top three measures that most CIOs and CISOs questioned in the survey have introduced (or plan to introduce): least privilege security/zero trust principles on infrastructure that runs business-critical applications, process to monitor SaaS user accounts and access.
• Eliminating embedded credentials in order to secure passwords, secrets and other credentials used by applications, machines, and scripts.
• Prioritise identity security controls to enforce zero trust principles: The top three strategic initiatives to reinforce zero trust principles are: workload security, identity security tools and data security.

[Related: Finance apps ‘screen scraping’ bank login credentials, fintech expert warns]