GenZ IAM: Transforming Identity and Access Management with Gen-AI

In today’s digital landscape, identity and access management (IAM) and regulating access to sensitive data and resources are paramount for any organization. From a zero-trust framework to a cybersecurity mesh architecture, the identity fabric is the core and is considered the most critical element in defining your security strategy. It is and was IAM that enabled businesses to function, keep their lights on, and run during the pandemic, with a secured remote workforce login and adaptive access management concepts.

However, traditional IAM techniques and technologies often struggle to adapt to the dynamics and complexity of modern applications and technology. There is a need for the next version of advanced and scalable IAM technologies with a core foundation. As digital platforms become more popular and advanced, the blooming generation, commonly referred to as GenZ, enthusiastically embraces and appreciates them.

Gen-AI (Generative Artificial Intelligence) and IAM together hold immense potential to strengthen IAM processes, simplify the integration and administration complexities, act on threats in near real-time through predictive analysis, improve user experience, and provide additional features and functionality, alongside greater agility and efficacy, for enhanced operation.

Artificial intelligence is breaking myths in the tech sector every day, changing the definition of sales from ‘What is Seen Sells’ to ‘What is Trending Sells.’ Millennials are descending, and GenZ will ascend as the new customer base in the near future. It’s time we started brainstorming about GenZ IAM.

Are IAM and Gen-AI Big Bets for Organizations? What Do Market Analysts Say?

According to a market analysis report from Blueweave Consulting group, during the forecast period between 2023 and 2029, the global IAM market is to grow at a significant CAGR of 15.45% and reach a value of USD 43.1 billion by 2029, compared to USD 15.8 billion in 2022 (BlueWeave Consulting, 2023).

Source: BlueWeave 2023.

The interesting point to note is that the major drivers include the integration of IoT (Internet of Things) and AI with IAM. Along with this, rising awareness of regulatory compliance, growing dependence on digital platforms, automation, and cloud adoption are still strong points for IAM adoption. Based on the current trends, it can also be inferred that businesses are interested in solutions powered by AI, which includes advanced identity analytics, user and entity behavior analytics (UEBA), dynamic security controls enforcement, guided authentication and proofing, advanced application onboarding, and risk-based real-time/near-real-time features like AI access & assist. Not only this, but the trajectory of banking is also set for an accelerated shift due to the inclusion of artificial intelligence.

AI-driven modifications align seamlessly with financial institutions’ customer-centric approach, enhancing connectivity and delivering a superior digital experience. Key AI strategies include natural language processing (NLP), deep learning, reinforcement learning, generative adversarial networks (GANs), computer vision, and predictive analytics (Precedence Research, 2023).

The market is projected to have a promising growth trajectory in 2023 and is expected to soar to USD 236.70 billion by 2032 at a CAGR of 31.7% (Polaris Market Research).

Source: Polaris Market Research.

What Are the Problems in the Existing IAM Space?

As more organizations globally adopt IAM solutions, the associated costs have become substantial, reflected in the current IAM market revenue of approximately USD 18.1B in 2023 (Grand View Research, 2023). However, traditional IAM and IAM 2.0 still have many challenges associated with them:

• Access management reviews are still quarterly, half-yearly, or yearly events. This not only makes it difficult for decision-makers to deal with a high volume of data for reviews but also poses challenges in accurately identifying privilege escalation, data breaches, and various related threats in a timely manner.
• For new employees, getting access and getting acquainted with their usage still takes at least a week to a month. Isn’t that unbelievable?
• When making an access request for an entitlement or role, the end user may be unclear on whether they are eligible to request such access, which may lead to a violation.
• Approval and request processes are very lengthy and often involve manual approvals (single/multi-level), even though manual approvals are the least privileged.
• Just-in-Time (JIT) access and time-bound accesses are the least used options, as access assignments are more static in nature due to technological complexity.
• There is less visibility on entitlement and role information (least privilege access for an application, description, level, and impact of access, risk category, compliance linked to the access, and target application).
• Even after purchasing a product, application onboarding is the job of technical folks and requires extensive customization to meet organizational objectives. Maintenance, updates, and upgrades are other pain areas.
• It takes months to identify whether a privilege escalation caused by an insider led to a data breach.
• Adaptive access controls are not available in traditional IAM and are still underdeveloped in IAM 2.0. More data enrichment is required to make these controls robust.
• Predictive analytics on identities is still a distant goal.
• A converged solution for identity and data governance is unavailable, forcing organizations to rely on different products and SKUs, leading to data redundancy, unexpected complexities, and increased costs.
• Real-time anomaly detection and acting on them in real-time is still in the development phase.
• Overall, the user experience of using the features is cumbersome and needs improvement.

How Can IAM and Gen-AI Be Game-Changers Together?

Now, considering GenZ’s expectations, we can imagine these possible digital disruptions by combining IAM and GenAI. These features will not only revolutionize the IAM market but also attract GenZ to this fast-evolving technology.

AI access assist

AI-powered access assistance can provide end-users with adequate information, including the level of access, risk levels, breach impact, and modus operandi. It also clarifies existing and new application access requirements, including the roles and entitlements required to perform their roles and responsibilities. This AI-powered Access Assist could be a chatbot or a GPT (Generative Pre-trained Transformer) and can function bidirectionally in voice/text mode.

Model access recommendations

“What accesses must one have as per the least privilege concept for my job role, and for which of them does an individual need to raise an access request?”. This is the biggest unsolved question in any organization. With AI and supervised learning, we could categorize and tag these individual accesses as Org-Generic, Job-Role-Generic, Job-Function-Generic, Unique, etc., based on business and RBAC requirements along with a color code representing SOD (Segregation of Duties) and risk factors. Further, the AI model can recommend the access sets based on the requirements at various stages of an identity lifecycle.

UEBA-based access control and identity proofing

With the advancement of technology and AI, passwordless authentication techniques using face ID and voice authentication are not safe. Deep fake and voice modulation techniques are belting these factors ruthlessly. It’s high time we focused more on breach-resistant MFAs, which complement adaptive access techniques. Using the same Gen AI, we could create supervised and unsupervised learning models that are identity-specific and focused on user entity behavior parameters. These models can be integrated into the MFA enforcement and decision-making logic of access control solutions to neutralize unauthorized attacks in real or near-real time. This integration will also help applications track and challenge impromptu identity behavior through identity proofing in near-real time.

Guided random passwordless authentication

Authentication pattern is the most confidential decision within an organization and the prime focus for the attackers during reconnaissance. Using AI, you can allow an end user to enroll multiple factors of passwordless authentication (Like all fingerprints, retina, TOTP (Time-based One-time Password), magic email links, soft token, and hard token) and challenge an end user to authenticate randomly using a chain of these factors based on their configured preferences. This random guided pattern of authentication is not easy for an attacker to crack because of its dynamic presentation to the end-user and the complexity of hacking the entire possible pattern.

Unified anomaly and threat detection followed by risk-driven reviews and attestations

Most of the governance solutions available in the market are collecting changes through a scheduled collection. Due to this, there is a high possibility of missing incidents taking place at targets within a certain time window. AI and ML can help here by learning critical status and error codes from integrated apps and machines, and based on that learning, they can help immediately notify or take action, which can help businesses overcome the visibility issues that exist at present.

Questionnaire-based application onboarding

Application onboarding is always a hot topic in IAM, and why shouldn’t it be? Onboarding an application from authentication, authorization, and governance has its own life cycle and prerequisites. But, if you dive deeper, the use cases remain the same in all these cases; it’s just the logic is different. It is also seen that the standard best practices used across the industry are the same, with some tweaks involved. AI can help here as well by integrating a logic factory with standard and generic connectors. A business owner can answer the questionnaire, select the OOTB logic required for business (From the logic factory powered by AI), and submit the requirement through a questionnaire. In the backend, the product should be able to adapt that logic and deliver the integration on the go in simulation mode. Once the business owner approves the simulation-based outcome, it should be deployed and brought into real action (i.e., Production).

Advanced analytics, dashboarding, and reporting

AI and ML models can help here by intelligent reporting with actionable insights, highlighting critical issues, trends, and potential vulnerabilities. It can help optimize access to control privilege escalations. AI-driven solutions can provide accurate and robust authentication as they reduce the dependencies on elements that are frequently prone to hacking and phishing (EMR Claight, 2024). For individual users, AI can help them with a personalized dashboard with risk scores and suggest recommendations that can allow them to stay compliant and help them make decisions about their self-access, which will further aid the overall certification process.

Integrated gamified security training

AI and ML can help create interactive and engaging content with gamification tailored to IAM business use cases. This will help end-users make quick decisions during critical times and strengthen overall security.

Conclusion

Implementing a GenZ IAM system enhanced with GenAI capabilities offers revolutionary and transformative benefits across industries, including Banking. For Banking, an AI-enhanced IAM streamlines customer access, fortifies fraud detection in near-real-time, ensures compliance with mandatory regulatory standards, and thus enhances customer trust, experience, and operational efficiency. Also, by integrating AI with IAM, organizations can adapt to evolving threats, learn from user behavior, and provide proactive security measures. This convergence represents a significant leap toward smarter, more secure, and more responsive IAM solutions—enabling organizations to thrive in a rapidly changing digital landscape.

Source: eccouncil.org

Continue reading

The Rise of IoT Attacks: Endpoint Protection Via Trending Technologies

Information technology (IT) handles data and communication, whereas operational technology (OT) manages physical operations and machinery. OT is the hardware and software used in industrial control systems, like SCADA, to monitor and manage physical processes. The Internet of Things (IoT) is a network of interconnected devices and sensors that collect and exchange data over the internet. IoT security is concerned with protecting connected devices and their data, while OT security is concerned with systems controlling physical industrial processes (Pawar & Palivela, 2022; Pawar & Pawar, 2023; Pawar & Palivela, 2023).

The rise in IoT attacks is alarming for security professionals and organizations globally. In 2022, there were approximately 112 million IoT cyberattacks, up from about 32 million in 2018. The incidence of IoT malware increased by 87% year-over-year in the most recent year monitored (Petrosyan, 2023). In March 2021, hackers breached Verkada, a cloud-based video surveillance service, compromising access to private information and live feeds from over 150,000 cameras. Over 100 employees with “super admin” privileges accessed thousands of customer cameras, highlighting the risks of overprivileged users (BBC, 2021).

In another case, a woman died from delayed treatment after hackers attacked a hospital’s ICU system, potentially being the first fatality from a ransomware attack (Eddy, 2020). Notable IoT attacks include the attempted to poison Florida city’s water supply by altering its chemical levels (BBC, 2021), and disruption of heating in Lappeenranta, Finland, causing severe low temperatures during winter (Mathews, 2016).

The sheer increase in the number of IoT-connected devices because of technological advancement places an immense burden on security teams. To combat this escalating threat landscape, security experts look toward innovative and trending technologies that offer promising solutions. This blog discusses the IoT threat landscape and the impact that vulnerabilities can have on systems, data, and privacy. It also explores new approaches that could be considered for protecting IoT systems from evolving cyber threats.

Understanding the IoT Threat Landscape

IoT has revolutionized our daily interactions with the technology around us, significantly impacting businesses, particularly those with a solid digital presence. The IT and OT industries now rely heavily on IoT devices as a primary source for collecting data to manage and improve business operations. As the number of IoT devices continues to soar into billions, security vulnerabilities across the entire IoT network have become increasingly apparent.

Among the various vulnerabilities, the security of endpoint devices within the IoT network is a growing concern. Cybercriminals are actively targeting these weak points to gain unauthorized access and cause substantial damage. The absence of proper encryption in IoT endpoint devices makes them susceptible to breaches and privacy violations. Compromised IoT devices can be used in Distributed Denial of Service (DDoS) attacks to form botnets and launch large-scale attacks. Furthermore, inadequate device management and patching processes exacerbate the problem.

As the ecosystem of IoT endpoints expands, the threat landscape will continuously evolve, posing even more significant risks. Consequently, there is a pressing need for robust security measures, continuous monitoring, and custom security solutions to protect against potential threats.

The Vulnerabilities of IoT Networks

IoT empowers networks to offer immediate access to data and operations, enabling valuable data-driven insights. Nevertheless, this capability also attracts cybercriminals, granting them opportunities to exploit IoT devices’ broad array of vulnerabilities. Below are some prominent vulnerabilities that they may target (Fortinet, 2023; Guest, 2022; Arampatzis, 2023):

• Weak Passwords: The utilization of weak, default, or hardcoded passwords presents the most accessible pathway for attackers to compromise IoT devices, leading to the creation of extensive botnets and the spread of malware.
• Insecure Networks: Insecure network services on a device risk information confidentiality, integrity, authenticity, and availability. They also enable unauthorized remote-control access.
• Vulnerable API: If the API, cloud, or mobile interfaces are insecure, they can compromise the device and its associated components. Common causes of such vulnerabilities include inadequate authentication/authorization, weak or absent encryption, and insufficient input and output filtering.
• Outdated and Defunct Components: Failing to update the device, which neglects firmware validation, anti-rollback mechanisms, or security change notifications, becomes a significant threat vector for launching attacks against IoT devices.
• Unsecured Data Transfer and Storage: A lack of access control or encryption, either during data transmission or at rest, threatens the reliability and integrity of IoT applications. Securing and restricting access to data in the transport and storage layers of IoT networks is crucial to prevent unauthorized access by malicious individuals.
• Inadequate Device Management: Managing all devices throughout their lifecycle is a critical responsibility and a significant security challenge within the IoT ecosystem. Relying on default settings intended for simple device setup without considering the entire network’s security is highly insecure and provides attackers with an easy entry point. Additionally, mishandling unauthorized devices introduced into the IoT ecosystem can jeopardize access control and potentially intercept network traffic and sensitive information.
• Lack of Privacy: As IoT devices are endpoint devices that frequently collect personal and sensitive information from the user or their surrounding environment, the concern for potential leaks and misuse of such data is significant. Inadequate security measures can also result in data leaks, compromising user privacy. Hence, neglecting to safeguard this data can expose these organizations to potential fines, damage their reputation, and lead to business loss.
• Insufficient Physical Security: IoT devices are often deployed in remote environments instead of controlled stations, making them easy targets for attackers to access. This accessibility allows them to potentially target, disrupt, and tamper with the devices’ physical layer.
• Inadequate Authentication Capabilities: When an IoT device lacks proper authentication and access control mechanisms to verify legitimate users, it creates a vulnerability that external attackers and insider threat actors can exploit. This flaw enables unauthorized access to IoT endpoints and systems that should otherwise be restricted and protected.

The Impact on Compromised IoT Devices

When IoT devices are compromised due to vulnerabilities at the endpoint or other network layers, they can become tools for launching significant cyber attacks like DDoS or malware attacks, disrupting IoT network operations and services. Data and privacy across the network become vulnerable, resulting in data theft and unauthorized access. Furthermore, compromised IoT devices can be utilized to propagate malware to other assets on the network. The threats listed below represent just a few examples of the numerous risks targeting IoT devices and networks (Williams et al., 2022).

Hardware Trojan

This attack involves an attacker surveilling, altering, or hindering the data or communication within a circuit using a trojan. This stealthy manipulation occurs during the circuit’s design or fabrication, introducing malevolent modifications at the physical layer.

Side Channel Attack

A side-channel attack transpires when an attacker capitalizes on the inadvertent disclosure of physical information from a system while an application is running. The adversary conducts non-invasive hardware-based attacks by observing and quantifying power consumption, electromagnetic emissions, timing data, and acoustic signals. Subsequently, the acquired information can be analyzed to extract sensitive data, such as cryptographic keys.

Tampering

Tampering denotes the act of an attacker modifying the data associated with an integrated circuit (IC) after it has been deployed in an application. Many IoT devices are often situated in environments lacking physical safeguards, making them vulnerable to unauthorized access by attackers. Such intruders can exploit physical access or wireless means to tamper with the device’s software or firmware. By installing malicious hardware or software, the attacker can manipulate the behavior of the IC or the entire device.

Botnet

Botnets, specifically IoT botnets, are extensive networks of devices, such as routers, exploited for launching attacks. These botnets consolidate numerous centrally managed devices through a command-and-control (C&C) server. Resource-constrained IoT devices’ inherently weak security measures make them susceptible to cybercriminals, who can swiftly convert them into fully controlled botnets. These compromised botnets are then utilized for DDoS attacks, wherein the attackers manipulate the internal workings of the networking protocol to obstruct users from accessing the targeted service.

Spoofing

Device spoofing involves using specialized tools to deceive systems into believing that different devices are being used. In the context of IoT networks, when an attacker’s system masquerades as a legitimate IoT device or an authenticated user in order to gain access to a network, it is called IoT device spoofing. This deceptive act often involves manipulating the genuine user’s media access control (MAC) address or internet protocol (IP) address. Another form of spoofing is voice spoofing, where adversaries employ replay attacks to exploit smart devices’ voice user interface (VUI). By doing so, they can attempt to override authentications and gain unauthorized control or access (Antispoofing, 2023).

Eavesdropping

Eavesdropping is a security concern for smart gadgets that communicate through Wi-Fi or Bluetooth, as it exposes them to potential data breaches. This attack involves intercepting data in transit, which can later be exploited in spoofing attacks. By compromising the wireless channel, attackers can analyze the data’s semantics, engage in reverse engineering, and more. The primary vulnerability in eavesdropping arises from the link between users’ daily activities and the corresponding requests that IoT devices execute, providing valuable insights to malicious actors.

Replay Attack

A replay attack is a security protocol-targeted breach where legitimate data transmission is deceitfully duplicated or delayed. In this attack, captured packets are re-transmitted, tricking honest participants into believing that they have completed the protocol on an authenticated device. The danger of replay attacks lies in their elusive nature, making them difficult to detect. Moreover, they can be effective even if the original transmission was encrypted.

OnPath Attack

This refers to an attack in which the attacker positions themselves as a relay or proxy between a sender and a receiver during communication. By occupying this intermediate position, the attacker can intercept and manipulate the information exchanged between the sender and receiver. This significantly enables a MiTM attack on IoT endpoints when the link between the wireless device and the network is compromised, allowing the attacker to eavesdrop on remote devices.

Emerging Technologies for IoT Security

There are few cybersecurity standards like the National Institute of Standards and Technology (NIST)-provided standard, which provide different recommended controls for IoT and OT. Also, specific to small and medium-sized companies, there is the Business Domain Specific Least Cybersecurity Controls Implementation (BDSLCCI) framework, which also provides IoT, OT, and IT controls to be implemented by organizations, considering those as mission-critical assets (Pawar & Palivela, 2022; Pawar & Pawar, 2023; Pawar & Palivela, 2023).

Safeguarding against IoT vulnerabilities is vital for security teams, IT professionals, and vertical industry experts. Numerous security software solutions for IoT networks exist, effectively mitigating cyber attacks and establishing secure environments. However, with the increasing demand for IoT technology, scaling and automating security capabilities have become imperative. Consequently, several novel technologies have emerged to ensure a comprehensive security approach for integrated IoT networks and devices.

Blockchain for Secure IoT Devices and Network

Blockchain security involves various measures and technologies designed to safeguard blockchain networks, ensuring the integrity, confidentiality, and availability of data within the system.

The principal security element in blockchain technology (BCT) is proof of work (PoW), utilized for appending new blocks. BCT’s high privacy level is achieved through changeable public keys, ensuring user identity protection. These characteristics make BCT ideal for offering distributed privacy and security in IoT. Blockchain technologies empower IoT architecture and units to be self-functional and independent entities in the physical layer. When combined with decentralized network topology, this uniqueness significantly enhances network security. Individual node independence thwarts threat actors from hacking multiple devices simultaneously, safeguarding the entire network (Pu, 2020).

Cloud for IoT

Enabling the integration of IoT devices with cloud computing technology facilitates seamless end-to-end processes and services across the network. This integration creates a closed-source network with enhanced access control and identity-driven security. Cloud solutions offer many security features, including access control, authorization, authentication, encryption, secure data transfer, and storage security for IoT devices and data. IoT cloud computing has multiple connectivity options, on-demand scaling, resource management, and more. As IoT devices and automation adoption increase, cloud solutions provide companies with robust authentication and encryption protocols, ensuring reliability in their operations.

Artificial Intelligence (AI) and Machine Learning (ML)

IoT’s diverse and complex nature and the evolving security threats pose challenges for traditional security methods in safeguarding IoT devices, applications, and networks. However, leveraging AI and ML technologies for behavior analysis and anomaly detection can offer a comprehensive and efficient security solution. By employing algorithms based on network traffic patterns, data scanning during transit becomes more effective, enhancing defense against malware. These technologies involve building data-based learning models that implement threat prevention techniques through identification, classification, and predictive security approaches.

Conclusion

The growing adoption of IoT technology has led to an increased number of devices, expanding the scope for vulnerabilities and opportunities for threat actors. Although security solutions exist to address IoT vulnerabilities, scaling traditional approaches poses challenges. Integrating IoT with blockchain and cloud computing, known for scalability, can benefit large-scale operations and storage. Similarly, leveraging AI ML technologies automates security capabilities and boosts threat detection and mitigation. Organizations should also choose cybersecurity strategies that will protect different layers of the organization, making a good cybersecurity posture for the IoT.

Source: eccouncil.org

Continue reading