Expert independent industry opinion.What you need, when you need it. CISO Briefing Inquiry services provide an expert voice for a range of projects. Whether you are a looking to engage a vendor and design an RFP, perform a maturity assessment for an existing identity and access management investment or enable a team on market technologies, the CISO […]
Security starts when authentication ends. It's a line I have used a few times over the years as it is one I actually quite believe in. In an era where firewalls are derided as being pretty toothless in the fight against omnipresent complex cyber attacks - and the concept of trusted networks quite rightly become obsolete in the world of "zero trust" - it always seemed odd to me, to put such a large emphasis on stringent authentication services. Clearly authentication is hugely important don't misunderstand, but my point really was that authentication (even with a strong MFA component) becomes less relevant if a) it is not continuous and b) not part of a more holistic approach focused on the access control of services, data and APIs.
Trust within the identity world is a huge priority. Trust regarding the on-boarding and registration of external users via proofing (think assurance levels using identity validation and verification techniques) right through to creating trust labels for employees in order to monitor for malicious activity - that is either driven by external threat actors, insider threat or just unintentional bad user behaviour.

When on briefings and inquiry workshops there are often emerging themes that start to spring up repeatedly. Perhaps every few months, perhaps under different projects, using different terms and stories and perhaps from unexpected people or teams.

There has been one theme over the past 12 months or so that is difficult to ignore: not only how identity based security has left-shifted into the thinking of information leaders to being a first-class citizen in the technology arsenal, but how identity is moving into a new territory. The territory of autonomy.

A long read post investigating the evolution of decoupled authorization platforms – including use case and capability analysis and brief vendor review including Axiomatics, PlainID, Styra and Scaled Access.

This post is only available to members.
An introduction to authorization startup Aserto.
What is driving the demand for new authorization models, software vendors and emerging authorization design patterns? This discusses previous failures of RBAC and XACML as well as modern architecture patterns such as identity centricity and the business mesh.

I recently ran another of my highly scientific industry polls - via LinkedIn to get a feel for this years spending patterns as they pertain to some emerging identity and access management technology areas. I have been tracking four emerging areas over the past 8 months or so, including Passwordless Authentication (where The Cyber Hut released a 61 page buyer guide last year), Cloud Identity/Infrastructure Entitlements Management, Decoupled Authorization and Identity Threat Detection and Response.

All four areas have had significant venture capitalist funding over the past 36 months and the use cases and capabilities of each have started to stabilise to a point where buy side procurement and integration is becoming consistent and vendors are identifying their competitive go to market narratives.

So my poll was essentially asking, which of these areas would a buy-side practitioner look to invest in during 2022?

Vendor introduction report covering oort.io - an emerging vendor in the Identity Threat Detection and Response sector.
A few interesting items to hit The Cyber Hut intelligence inboxes over the past couple of weeks. Funding Roundup: Antimatter and SkiffSkiff a privacy enablement startup focused on the end-to-end encrypted workspace just received a $10.5 million Series A, lead by Sequoia. What do they do? They are focused on creating a completely private decentralised […]