Three perspectives on identity security: how machine identities threaten cyber security

Why are existing security approaches no longer sufficient on their own?

Traditional security strategies were developed at a time when digital identities, such as user accounts, largely related to employees, administrators and external users. Consequently, protective measures focused primarily on reducing the risks associated with human behaviour, such as warding off phishing attacks, protecting passwords or detecting suspicious user activity. Machine identities often remained under the radar, as IT systems with once clearly defined processes were generally trusted.

What has changed across modern IT landscapes?

Today, companies no longer manage just their employees’ accounts. They also manage numerous digital identities relating to applications, services or automated processes. They access systems and data, carry out tasks and, in doing so, are often granted far-reaching permissions that are not strictly necessary. Whilst user accounts are an established part of many security and governance processes, technical identities often lack the same level of transparency.

What does this mean for organisations?

Identity security broadens the focus from securing virtual human identities to managing all digital identities. The aim is to provide a clear picture of who or what is accessing systems and data, and whether the permissions granted are actually necessary.

Three experts from Forvis Mazars explain why this task is becoming increasingly important for businesses, drawing on their respective specialist perspectives.

The risk perspective: machine identities are increasing rapidly

When people talk about identity security, many initially think of employees. In reality, however, the number of human identities within organisations usually grows only slowly. The situation is different when it comes to technical identities.

Many applications require access to other systems in order to use or store information. Automated processes often exchange sensitive information that requires special protection. Cloud services communicate with one another. A modern IT landscape can now comprise many times more machine identities than human users.

The problem is that many processes in identity and access management were originally designed for people. For employees, there are onboarding, role change and offboarding processes. Roles and their associated authorisations are clearly defined.

Machine identities, however, do not follow this logic. They are often set up on a project-by-project basis, are granted extensive rights and then remain permanently in the system, without their necessity being reviewed. At the same time, organisations are constantly changing. When employees leave the company, the applications for which they were responsible often continue to run as part of day-to-day operations – along with the digital identities that were set up for them, which their successors rarely question as a matter of principle, in line with the ‘never touch a running system’ adage.

This creates a blind spot. Whilst suspicious behaviour by employees is usually noticed quickly, unusual activity on technical accounts can go undetected for a long time. This is precisely why machine identities are increasingly being regarded as a distinct risk category.

It is not just a matter of identifying these identities. Organisations must also understand the purpose they serve, the rights they actually require, and how their behaviour can be monitored.

The process perspective: the biggest challenge is a lack of transparency

Identity security begins with a simple question: do organisations even know which identities exist within their systems?  In practice, the answer is often: ‘Only to a limited extent’.

Whilst staff user accounts are usually well documented, the situation is often quite different when it comes to technical accounts. Over the years, service accounts, interfaces, application access points and automations accumulate. Systems are expanded, service providers are integrated and new applications are introduced. Many of these identities remain in place permanently, even though their original purpose is no longer known.

The danger is that companies can only control access rights if they know who or what actually has access. Many security projects therefore do not begin with new technologies, but with the laborious task of taking stock of existing identities and access rights.

This is one of the greatest challenges for the coming years. Before companies can discuss modern authentication methods or intelligent security solutions, they must first establish transparency regarding their inventory of digital identities and their access permissions.

The governance perspective: identity security is a management issue

Many companies are aware that cyber risks are on the rise, and although the technical challenges are considerable, identity security rarely fails because of individual software solutions.

The reason for this lies in the unique nature of digital identities. They link technical systems with organisational decisions. Questions such as what access is required, what permissions are granted and what risks are associated with them cannot be answered solely at a technical level.

Identity security thus becomes a management task. This is because the introduction and revision of security processes require resources, clear responsibilities and cross-functional collaboration. Business units, IT, information security and compliance must decide jointly how digital identities are managed and controlled.

The need for collaboration and control is particularly evident when it comes to machine identities. Whilst IT ensures the applications run smoothly, business departments often decide on their use and necessity. At the same time, information security and compliance must assess the risks. Effective control can therefore only be achieved through clear governance structures.

Identity security is also subject to regulatory pressure due to NIS2 and DORA. As a result, requirements for governance and risk management have become increasingly important. Consequently, identity security is not merely a matter of technical security; it is also an integral part of effective corporate governance.

Clear boundaries across organisational borders are disappearing, whilst identities with access rights remain

The real change does not lie in the fact that digital identities have suddenly become important. They have always been a cornerstone of digital security.

What is new is the scale. Organisations now manage significantly more identities than they did just a few years ago. In particular, the proportion of non-human identities is steadily increasing. Many of these operate automatically and, with the advent of AI, are increasingly less constrained by clearly defined processes. Digital identities often possess far-reaching permissions inherited from the past yet elude traditional control mechanisms.

The challenge in the coming years will therefore not lie solely in fending off ever-new security threats. It will be crucial to create transparency regarding the growing number of human and machine identities, to effectively manage their permissions, and to firmly embed this management within governance and risk management processes. It is precisely here that the future resilience of organisations to cyber risks will be determined.

Contact us