رونوشت کامل Identity Security: Why It Has Become the Most Important Control in Modern Organisations

shifts we've seen over recent years is how attackers gain access to organisations. 00:02:20.639 --> 00:02:24.000 Historically, attackers needed sophisticated exploits. 00:02:24.159 --> 00:02:29.120 They had to find vulnerabilities, develop attack code, and work hard to break through technical defences. 00:02:29.520 --> 00:02:43.039 Today, many attacks start with something much simpler: a compromised account, a stolen password, a successful phishing attack, a supplier account that wasn't properly secured, or perhaps a privileged account with excessive access. 00:02:43.599 --> 00:02:46.080 Let's think about it from an attacker's perspective. 00:02:46.319 --> 00:02:50.560 Why spend weeks trying to break into a building when somebody has left the front door unlocked? 00:02:50.800 --> 00:02:55.199 That's essentially what compromised identities provide: legitimate access. 00:02:55.439 --> 00:02:58.639 And that's what makes identity attacks so dangerous. 00:03:02.719 --> 00:03:07.520 One issue I see repeatedly when reviewing organisations is something called privilege creep. 00:03:07.759 --> 00:03:11.120 Now that sounds quite technical, but the concept is actually very straightforward. 00:03:11.280 --> 00:03:14.240 Imagine somebody joins an organisation in a junior role. 00:03:14.400 --> 00:03:18.719 Over time they get promoted, they move departments, they take on additional responsibilities. 00:03:18.960 --> 00:03:24.000 Every new role requires new access, but often nobody removes the old one. 00:03:24.240 --> 00:03:29.520 Five or ten years later, that individual may have permissions accumulated from multiple previous roles. 00:03:29.759 --> 00:03:35.599 In many organisations, if you ask why somebody has access to a particular system, nobody can actually tell you. 00:03:35.759 --> 00:03:38.000 It's simply because they've always had it. 00:03:38.319 --> 00:03:48.400 And that's where risk starts to emerge, because excessive access doesn't just increase the impact of insider threats, it also increases the potential damage if an account is compromised. 00:03:48.719 --> 00:03:57.360 One of the easiest indicators of identity maturity is whether an organization can confidently explain why people have the access they currently have. 00:03:57.599 --> 00:03:59.120 Surprisingly many can't. 00:03:59.280 --> 00:04:01.439 Now let's take that challenge one step further. 00:04:01.680 --> 00:04:03.599 Not all accounts are created equal. 00:04:03.759 --> 00:04:12.719 Some users can reset passwords, some can create new accounts, some can change security settings, some can effectively control entire environments. 00:04:12.879 --> 00:04:14.639 These are privileged accounts. 00:04:14.879 --> 00:04:19.519 And if there's one category of identity that deserves attention from senior management, it's these. 00:04:19.759 --> 00:04:24.639 Because if a privileged account is compromised, attackers often gain the keys to the kingdom. 00:04:24.800 --> 00:04:34.560 I've seen organisations with hundreds of privileged accounts, I've seen administrators sharing credentials, I've seen service accounts with administrator rights that nobody realised still existed. 00:04:34.800 --> 00:04:40.480 One question I often ask is, how many people in this organisation have administrative access? 00:04:40.720 --> 00:04:44.079 The answer is usually much higher than the leadership expects. 00:04:44.399 --> 00:04:47.120 Mature organisations take a very different approach. 00:04:47.279 --> 00:04:55.279 They minimise privileged access, they monitor it closely, and increasingly they only grant elevated permissions when they're actually needed. 00:05:00.319 --> 00:05:05.279 What's particularly interesting is that many organisations focus heavily on human users. 00:05:05.519 --> 00:05:10.399 Employees receive training, levers are processed, access reviews take place. 00:05:10.639 --> 00:05:13.759 But often the biggest identity risks aren't people at all. 00:05:13.920 --> 00:05:20.319 They're machine identities, service accounts, application accounts, APIs, certificates, cloud workloads. 00:05:20.480 --> 00:05:26.720 These identities often outnumber employees many times over, yet they frequently receive far less scrutiny. 00:05:26.959 --> 00:05:28.560 The challenge is ownership. 00:05:28.720 --> 00:05:32.079 When you ask who owns a service account, the answer is often unclear. 00:05:32.319 --> 00:05:35.120 Maybe it belonged to a project team that no longer exists. 00:05:35.279 --> 00:05:37.600 Maybe the original owner left years ago. 00:05:37.759 --> 00:05:39.519 Maybe nobody really knows. 00:05:39.759 --> 00:05:46.160 And that's where risk accumulates, because unmanaged identities inevitably become poorly controlled identities. 00:05:46.399 --> 00:05:53.199 One of the strongest indicators of identity maturity is whether every identity has a clearly accountable owner. 00:05:53.439 --> 00:05:56.560 Not most identities, every identity. 00:06:01.680 --> 00:06:04.319 Another major challenge involves suppliers. 00:06:04.560 --> 00:06:07.439 Modern organisations rely heavily on third parties. 00:06:07.680 --> 00:06:15.360 Cloud providers, managed service providers, software vendors, consultants, support partners, all of these relationships often require access. 00:06:15.519 --> 00:06:19.279 The problem is that third-party access frequently falls into a grey area. 00:06:19.519 --> 00:06:28.319 Internal teams assume suppliers are managing security, suppliers assume the organization is monitoring access, and somewhere in the middle visibility is lost. 00:06:28.720 --> 00:06:34.639 When major incidents occur, organisations are often surprised by the extent of supplier access that exists. 00:06:34.959 --> 00:06:44.480 One useful exercise is to ask a simple question: if we terminated every supplier relationship tomorrow, could we identify every account that we would need to remove? 00:06:45.040 --> 00:06:49.439 If that answer isn't immediately available,

there may be more risk than people realise. 00:06:54.079 --> 00:06:57.839 Perhaps the biggest identity story right now involves AI agents. 00:06:58.079 --> 00:07:05.759 Increasingly, organisations are deploying systems that can retrieve information, make decisions, trigger workflows, and interact with applications. 00:07:06.079 --> 00:07:10.079 In many ways, these agents are beginning to behave like digital employees. 00:07:10.240 --> 00:07:15.519 But unlike employees, organizations often haven't yet developed governance frameworks for them. 00:07:15.759 --> 00:07:17.600 Who owns the AI agent? 00:07:17.759 --> 00:07:19.360 What systems can it access? 00:07:19.600 --> 00:07:21.199 What actions can it perform? 00:07:21.439 --> 00:07:23.120 How is activity monitored? 00:07:23.360 --> 00:07:25.839 What happens if it behaves unexpectedly? 00:07:26.079 --> 00:07:30.800 These are rapidly becoming some of the most important identity questions organizations face. 00:07:31.279 --> 00:07:33.519 The key principle is actually very simple. 00:07:33.759 --> 00:07:40.319 If an AI agent can perform actions inside your organization, it should be governed just like any other user. 00:07:40.720 --> 00:07:44.959 Unfortunately, many organizations are only beginning that journey. 00:07:48.800 --> 00:07:51.439 One final point that I think is often overlooked. 00:07:51.680 --> 00:07:56.399 Identity security isn't just about preventing attacks, it's also about resilience. 00:07:56.639 --> 00:08:00.959 Think about how many critical services depend on identity platforms today. 00:08:01.439 --> 00:08:10.160 Employees logging into systems, customers accessing applications, administrators managing environments, cloud platforms authenticating users. 00:08:10.399 --> 00:08:13.759 Now imagine your identity platforms become unavailable. 00:08:14.160 --> 00:08:17.120 How long could your organisation continue to operate? 00:08:17.439 --> 00:08:20.720 For many businesses, the answer is surprisingly short. 00:08:20.959 --> 00:08:26.319 That's why leading organisations increasingly treat identity systems as critical infrastructure. 00:08:26.560 --> 00:08:34.480 They test recovery procedures, they validate backup mechanisms, and they ensure that they can recover identity services rapidly following disruption. 00:08:34.720 --> 00:08:40.879 Because ultimately, resilience is about assuming nothing will go wrong, it's about being prepared when it does. 00:08:45.039 --> 00:08:52.240 So, if there's one message I'd leave you with today, it's this identity security is no longer an IT administration activity. 00:08:52.480 --> 00:08:57.600 It's one of the most important technology risk disciplines in any modern organization. 00:08:58.480 --> 00:09:07.440 As organizations become more cloud-based, more interconnected, and increasingly dependent on AI, identity becomes the foundation upon which trust is built. 00:09:07.759 --> 00:09:17.200 The organizations that understand this are investing heavily in identity governance, privileged access management, machine identity management, and resilience. 00:09:17.600 --> 00:09:22.399 Those that don't may discover during an instant that they were far more exposed than they realized. 00:09:24.000 --> 00:09:25.200 I'm David Horn. 00:09:25.519 --> 00:09:28.879 Thank you for listening to the Technology Risk podcast sponsored by Cortex. 00:09:29.120 --> 00:09:34.399 Until next week, stay resilient, stay informed, and stay ahead of Technology Risk.