Identity, Credential, and Access Management

Identity, Credential, and Access Management (ICAM) is a core component of Cybersecurity that governs the authentication, authorization, and accounting of person and non-person identities. In the shift towards Zero Trust Architecture (ZTA), ICAM serves as the linchpin of a successful implementation. This migration from perimeter-based to identity-based network defense requires organizations to assume the network is perpetually compromised, through thorough and continuous verification of the entities operating within their network.

Throughout Cybersecurity’s short history, the most difficult variable to account for is the human element. Even the most sophisticated Cybersecurity defense architecture can be rendered useless with the careless or intentional actions of a single user within the network. Due to the investment into perimeter-based network defense, once an attacker is inside the network all of those mechanisms are rendered moot. In the past, when a user’s account became compromised and a threat actor gained access to the internal network, the attacker was able to traverse the network with relative ease. Through employing ZTA, even if a threat actor gains access to a user’s account, the ability to traverse the network becomes significantly more difficult.

As shown in the diagram above, ZTA implements least privilege access in conjunction with contextual access decisions. Additionally, these checks are conducted continuously, with immediate revocation of access if/when the user no longer meets the access criteria.

Cryptography & Public Key Infrastructure

Cryptography and Public Key Infrastructure (PKI) are the foundation for maintaining confidentiality and integrity across any secure network. These security mechanisms are facilitated through mathematical ciphers, such as encryption algorithms and cryptographic hash functions. PKI is an essential mechanism organizations leverage to establish trust across disparate environments and networks. Protection and validation of these encryption and hashing functions are conducted through Hardware Security Modules (HSMs), Certificate Revocation Lists (CRLs), and Online Certificate Status Protocol (OCSP).

X.509 certificates exist to bind identities to cryptographic key. These certificates are fundamental in facilitating Transport Layer Security (TLS/HTTPS) Mutual Transport Layer Security (mTLS) and digital signing. Without the ability to cryptographically validate an identity, a receiver cannot be assured they received a communication from the alleged sender. Additionally, these certificates are used to create secure tunnels for web traffic, ensuring only those intended to receive the information are able to view it.

When establishing mTLS, both the client and server present their public certificates to be validated prior to access. In encrypting the traffic received and sent, no information is visible to external systems. All traffic is only able to be read by the intended recipient.

Incident Response

Incident Response is a predefined and structured approach to address cyber attacks or system/data compromise. These responses are typically guided by the NIST SP 800-61 Framework, with the ultimate goals of limiting operational damage, reducing threat persistence, and restoring capabilities to their pre-compromised state. Modern incident response is shifting focus from reactive to proactive approaches by mapping observed Indicators of Compromise (IoC) and Indicators of Attack (IoA) directly to the MITRE ATT&CK framework. By doing so, incident response teams can more effectively identify, address, and investigate cyber incidents.

Security Orchestration, Automation, and Repsonse (SOAR) platforms are central to incident response. These tools assist in reliably reducing the time taken to address and remediate cybersecurity incidents. Additionally, they assist in standardizing workflows and consume the responsibility of manually addressing various identified incidents. The main purpose of SOAR platforms is to reduce the repetitive burden of alert response and severely minimize the impact of security incidents, giving security personnel more time to focus on higher level objectives and response.

The above flow chart illustrates the process by which a SOAR tool identifies and addresses potentially malicious events. The core component of this process is the ability for the SOAR tool to continuously expand its ability to address new and evolving cybersecurity events through its recursive analysis.