Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Identity & Access

Identity Governance Isn’t Just for Compliance Anymore

Remember when sushi was exotic? Has it been a while since you thought of it as cold dead fish? That was probably before it became popular enough to cause endangerment of species.

Remember when sushi was exotic? Has it been a while since you thought of it as cold dead fish? That was probably before it became popular enough to cause endangerment of species. Today, sushi might be a treat, but as Americans we no longer look at it as alien – we’ve come to appreciate the colors, textures and flavors shared by our Asian friends.

Over the last 26 days, I’ve had the privilege of traveling to 11 different cities in Australia and Asia, and I’ve had my share of exotic food (by American standards). But, aside from cultural experiences, Asian perspectives helped me learn to look at identity governance in a new light.

The conventional wisdom on identity governance

Identity Governance Isn’t Just for Compliance Anymore In my travels throughout North America and Europe, I’ve noticed that identity governance has dominated the Identity and Access Management landscape. Heavier regulations in North America and Europe have been the biggest driver of a compliance-driven approach to identity. 

The analyst firm Gartner merged the topics in its Magic Quadrant for Identity Governance and Administration (IGA), first released in late 2013. And Forrester released a Wave report for Identity Management and Governance (IMG) earlier this year, providing some consensus on the state of the biggest markets for governance.

Why Asia is different

Asia is still in the early days of considering identity governance – there is a shared sense of trust in employees to do the right thing even without strict guidelines. Asian multi-national companies, of course, have to demonstrate compliance to regulations such as Sarbanes Oxley when they operate in other jurisdictions. But for many companies, there is a real sense of insulation from regulations, and far less of a sense of urgency, as much of the focus remains on the provisioning part of IGA/IMG 

What is changing

That sense of trust without strong enforcement, however, is being tested by recent events. I happened to be in Manila when the news broke that Rizal Commercial Banking Corporation (RCBC) paid a 500 million peso (~$10.7M USD) fine to Philippine regulators, which was only half of the penalty for the role that the bank played in the 2016 Bangladesh Bank heist. In addition to the fines, the attack has cost the jobs of high-ranking members of the banks.

Advertisement. Scroll to continue reading.

The FBI believes that insiders had a role to play in obtaining the credentials for payment transfers that were used to perpetrate the crime. And that has led to the realization that better management of credentials – minimizing rights through identity governance – is an important control in the fight against fraud.

In Japan, there was still a sense of shock that two Japanese men participated in an ATM heist that resulted in a loss of 1.4B yen ($13M USD) in May 2016. It is events like these that are changing the sense of isolation in Asia and introducing a realization that global interconnectedness means global vulnerabilities.

What we can learn

As the demand for identity governance in Asian companies grows, the key differentiator is that it’s going to come from a need to reduce risk. For North American and European companies, identity governance will still function primarily as a means to satisfy auditors and regulators for the foreseeable future, creating a false sense of security.

The challenge is that identity governance typically relies on business managers to certify access to sensitive systems. Those business managers neither understand, nor care much about risk, and while they rubber-stamp their attestations to satisfy auditors, there is little risk reduction occurring as a result. 

The Asian companies that I met with have little interest in a compliance charade, because that isn’t the challenge that they need to solve. They are interested in how identity governance can be used to enforce separation of duties, and discover and eliminate excessive entitlements. 

Like learning to appreciate different Asian perspectives in food, we could learn to shift the focus of identity governance from compliance to risk management.

Written By

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...

CISO Strategy

Okta is blaming the recent hack of its support system on an employee who logged into a personal Google account on a company-managed laptop.

Compliance

Government agencies in the United States have made progress in the implementation of the DMARC standard in response to a Department of Homeland Security...

Email Security

Many Fortune 500, FTSE 100 and ASX 100 companies have failed to properly implement the DMARC standard, exposing their customers and partners to phishing...

Funding/M&A

The private equity firm merges the newly acquired ForgeRock with Ping Identity, combining two of the biggest names in enterprise IAM market.

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...