Can Your Secrets Be Secured With Privileged Access
Threat actors don't often need to use the most recent zero-day vulnerability or breach firewalls to commence their assaults.
Updated
On this page
Updated November 2026. This was first published on 5 December 2022. The idea is the same. Any number below is what the original piece said then. It is not a new count.
Key takeaways
- Threat actors don’t often need to use the most recent zero-day vulnerability or breach firewalls to commence their assaults.
- Instead, they just stroll in with stolen login credentials and assume legal digital identities.
- But, although cyber assaults are unavoidable, damage and interruption are not.
Threat actors don’t often need to use the most recent zero-day vulnerability or breach firewalls to commence their assaults. Instead, they just stroll in with stolen login credentials and assume legal digital identities. But, although cyber assaults are unavoidable, damage and interruption are not. companies that take a privilege-centric approach to identity security — both human and machine — are better positioned to prevent attackers from accessing important assets and data.
How Can Businesses Adopt Privileged Access Management? #
Any security system’s weakest link is a human mistake. By clicking on dubious email links, storing files on their insecure personal drives, and seeking to access information and projects that are irrelevant to them, users unwittingly increase cybersecurity risks within the company.
There are more instances where people purposefully misuse the degree of access they have, particularly when their connection with the company is about to expire. One employee leaving the company and downloading massive volumes of data either as resources or to reveal sensitive material is an example.
These flaws are exploited by hackers, who then use them to access exposed workstations and endpoints. Once inside, hackers have full access to the papers and data of your company, where they can steal and delete confidential or intellectual property data. It could be too late by the time you learn about the attack. Before being apprehended, cybercriminals typically go unnoticed.
Due to this, your company might face millions of dollars in lost and stolen data, further legal repercussions, and even brand harm. That is why a crucial component of your company’s data protection plan should be the setup of ‘Privileged Access Management’ (PAM).
In a systematic approach to cybersecurity known as privileged access management, all users and their degrees of access inside a particular workspace are constantly under observation. PAM assists your company in implementing an organized level of access so that users may only access the information they require to do their duties. This not only stops people from obtaining information that is unnecessary to their position, but also allows the company to identify hostile behavior and respond to it.
PAM is essential for assisting your company in adhering to legal requirements. Your company is susceptible to breaches when users are not controlled and monitored. companies may use this method to provide a more user-friendly environment for logging all IT and sensitive data-related operations.
Audit trails also make assurance easier to understand. Users will have new rights assigned to them and old ones removed when projects start and finish, preventing unauthorized access to the data.
This form of protection reduces the chance of a hostile attack from within the business, Also to keeping undesirable outsiders from accessing your data. As one might expect, maintaining this degree of protection manually takes a lot of time and resources. At times, a software solution is required to help your business go the additional distance.
There Were Human Identities in the Beginning. Then, in Full Force, Non-Human Identities Em #
Continuous integration and continuous delivery (CI/CD) and DevOps approaches have become critical to moving quickly and keeping agile as firms accelerate significant digital efforts and implement automation across their company. And apps — from classic software solutions stored in corporate data centers to new cloud-based applications — are the foundation of modern business. Privileged Access Management must be woven into the fabric of organizational strategy and application pipelines as Identity Security initiatives mature and expand across these domains.
Identity is abundant in applications, DevOps tools, and development and delivery pipelines. It’s only that in these dynamic situations, “identities” take on a new, non-human form: they’re software, scripts, automation tools, and a plethora of other devices. To execute their jobs, they all need secrets – SSH keys, API keys, and other credentials — to get access to IT systems and other sensitive resources. These secrets and credentials are very appealing targets and the principal mechanism by which attackers gain access to a business.
Application Secrets and Credentials Everywhere #
Because non-human identities exceed human identities by 45x on average, safeguarding this critical component of the digital identity equation is critical.
According to 87% of respondents, secrets are kept in various locations. Half of the respondents stated that application credential security was entrusted to developers, a functional area renowned for prioritizing speed over security. 80% agreed that developers have more rights than they need.
The SolarWinds digital supply chain assault, CodeCov, and other notable instances have increased company leaders’ awareness of the crucial necessity to safeguard secrets in application and development environments. Despite this, according to the CyberArk analysis, 62% of firms have done nothing to defend their software supply chains post-SolarWinds, even though 71% have incurred damages from a supply chain-related assault after the historic breach.
Extending a Strong Privilege-Based Security Foundation for Secret Management. Gartner® recommends that security and risk management professionals in charge of IAM “extend the breadth and usefulness of your PAM programs by using the complete feature set of your PAM solutions, particularly secrets management for DevOps use cases and CIEM for IaaS visibility.”.
After establishing a strong Privileged Access Management foundation, security teams must now work on expanding their Identity Security programs to include all aspects of privileged access. That means safeguarding human and non-human identities throughout the lifecycle of important assets – without slowing down development teams or delaying automation installations.
It might be challenging to know where to begin. Most businesses will need to protect a variety of apps developed and maintained by diverse teams using various technologies and hosted in multiple locations using various deployment patterns (on-prem, private cloud, public cloud, or hybrid environments). Some apps are more important to the company than others. Some are more mature and adjust to more difficulty than others. And each application carries its own set of hazards. Security teams need more time and resources to address all of these issues at once.
Questions and answers #
What is the main point? #
Threat actors don’t often need to use the most recent zero-day vulnerability or breach firewalls to commence their assaults.
What else did the original piece say? #
Instead, they just stroll in with stolen login credentials and assume legal digital identities.