A white keyboard with one of the letters on the keyboard replaced by a graphical image of three people. The key is slightly darker than the other keys on the keyboard.

In this year's RSA Conference 2022, the latest trends were Zero Trust, Passwordless, and "Endpoint" to "X" Detection Response. There were only a few sessions and talks that were focused on Identity and Access Management. One of which is the session “Users Are Not Stupid – Eight Cybersecurity Pitfalls Overturned”. I won’t go through the 8 pitfalls, but as an IAM Specialist, these are the few that I think are important and are often overlooked by organizations.

Making Users Into Insider Threats Due to Poor Visibility

There is a balance that needs to be kept in mind when creating a security plan for a company: Security, Privacy, Usability. As security professionals, we often trust our code and configuration that we disregard the user entirely from the process and automate as much as we can, without carefully considering what the user experience would be.

In one of my client implementations, a new process is introduced. New Systems must have different password complexity from legacy systems, and a default password expiry of 90 days must be set. This sounds like a simple security process, however, the impact to the end user's was not carefully considered. First, this would require all users in the organization to replace their credentials across all systems. If the end user has access to more than one system, they would have to go through the trouble of accessing all the systems and changing their credentials, and meet the proper complexity.

Second, the default password expiry would add additional burden to the end user as they would have to re-access the systems again and reset their credentials. And what if it was a service account? This could halt some automation processes that critical systems use.

How Do We Attain The Right Balance?

Implement a solution/configuration that has password sync capabilities. This way, the solution would push the new encrypted password to legacy systems and new systems that would be onboarded. This would satisfy usability and security because the end user does not have to login to each system and reset their password. Be able to identify a service user (account's main purpose is to automate/run scripts on the system) to an end user. Then set rules to have a default password expiry for each type of account. In this approach, automations processes are not halted. The balance between usability, security, and privacy will never be perfect but having a system in place that is followed companywide is a lot more re-assuring. The end users know their responsibility and the reason that these processes are in place.

Not Tailoring Communications

“If you cannot communicate them to people in a language they understand, in a language that means they’re going to be receptive to your message, then they’re worthless.”

~ Usenix, The Advanced Computing Systems Association

In another client implementation, when a process has been improved/added, the development team would send out a communication of the completed configuration, containing a brief description of the changes made and the code/configuration changes that were added or removed. This communication would be sent out to the teams it would’ve impacted.

What Could’ve Made This better?

It’s great that the communication is sent to only the impacted teams. However, the code/configuration changes that were added or removed is not necessary. It would be simpler if the development team would describe the old process, state the new process and how it is beneficial for the end user. The communication was sent out through email - there is no issue with this. However, for an end user to review the process they must scroll through all the emails that would’ve been sent to them. In addition to a clear subject for email communication, a dashboard should be easily accessible. With this dashboard, they are able to review all current and past process changes. We need to take into account the knowledge/skill level of the user when addressing communications. Additionally, we need to be able to align this message with their daily duties.

Overlooked IAM Pitfalls: Poor Visibility & Communication

Services

Solutions

Pricing

Resources

Events

About Us

Get Started