A reflection on Identity Security, and my Cybersecurity Fellowship

At first glance, identity security can look like a password problem.

Make it longer, Add a number, Insert a symbol, Perhaps, as the image suggests, include an emoji, your pet’s name, and a little piece of your soul. 😄

But during my cybersecurity fellowship with International Justice Mission (IJM) under the Global Technology Solutions, I learned that the real challenge begins after a user successfully enters the password.

𝗧𝗵𝗲 𝗺𝗼𝗿𝗲 𝗶𝗺𝗽𝗼𝗿𝘁𝗮𝗻𝘁 𝗾𝘂𝗲𝘀𝘁𝗶𝗼𝗻𝘀 𝗮𝗿𝗲:

  • Who is this user?
  • What can they access?
  • Why were they granted that access?
  • Is the access still necessary?
  • What happens when their role changes, or they leave?

These questions took me deeper into 𝗜𝗱𝗲𝗻𝘁𝗶𝘁𝘆 𝗮𝗻𝗱 𝗔𝗰𝗰𝗲𝘀𝘀 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁, where identity is not simply a username stored in a directory. It is a security boundary that must be governed throughout its lifecycle.

I began looking at the complete identity journey.

When an employee joins an organization, access must be provisioned according to their role. When they transfer departments or assume new responsibilities, their permissions must change without allowing old access to accumulate. When they leave, access must be revoked promptly across applications, groups, administrative roles, and other connected systems.

This is the 𝗷𝗼𝗶𝗻𝗲𝗿-𝗺𝗼𝘃𝗲𝗿-𝗹𝗲𝗮𝘃𝗲𝗿 𝗹𝗶𝗳𝗲𝗰𝘆𝗰𝗹𝗲; and weaknesses at any stage can create orphaned accounts, excessive permissions, privilege creep, and opportunities for attackers.

That led to one of my biggest lessons:

𝗜𝗔𝗠 𝗴𝗿𝗮𝗻𝘁𝘀 𝗮𝗰𝗰𝗲𝘀𝘀, 𝗯𝘂𝘁 𝗶𝗱𝗲𝗻𝘁𝗶𝘁𝘆 𝗴𝗼𝘃𝗲𝗿𝗻𝗮𝗻𝗰𝗲 𝗲𝗻𝘀𝘂𝗿𝗲𝘀 𝘁𝗵𝗮𝘁 𝗮𝗰𝗰𝗲𝘀𝘀 𝗿𝗲𝗺𝗮𝗶𝗻𝘀 𝗮𝗽𝗽𝗿𝗼𝗽𝗿𝗶𝗮𝘁𝗲.

Effective identity governance requires clear ownership, role-based access controls, segregation-of-duties policies, auditable approvals, entitlement visibility, and periodic access reviews. Access should not remain active indefinitely simply because it was approved at some point in the past.

𝗧𝗵𝗲 𝗿𝗶𝘀𝗸 𝗯𝗲𝗰𝗼𝗺𝗲𝘀 𝗲𝘃𝗲𝗻 𝗴𝗿𝗲𝗮𝘁𝗲𝗿 𝘄𝗵𝗲𝗻 𝗽𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲𝗱 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀 𝗮𝗿𝗲 𝗶𝗻𝘃𝗼𝗹𝘃𝗲𝗱.

Through studying 𝗣𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲𝗱 𝗜𝗱𝗲𝗻𝘁𝗶𝘁𝘆 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁, I saw why administrative access should not be permanently assigned. Privileges should be activated only when needed, limited to the required task, approved where appropriate, time-bound, and monitored.

This is the principle behind 𝗷𝘂𝘀𝘁-𝗶𝗻-𝘁𝗶𝗺𝗲 𝗮𝗻𝗱 𝗷𝘂𝘀𝘁-𝗲𝗻𝗼𝘂𝗴𝗵 𝗮𝗰𝗰𝗲𝘀𝘀: provide only the privilege required, only for the period it is required.

𝗭𝗲𝗿𝗼 𝗧𝗿𝘂𝘀𝘁 𝗰𝗼𝗻𝗻𝗲𝗰𝘁𝗲𝗱 𝗮𝗹𝗹 𝘁𝗵𝗲𝘀𝗲 𝗹𝗲𝘀𝘀𝗼𝗻𝘀.

Zero Trust is not a single tool or a one-time project. It is a security model built on the principle of “never trust, always verify.”

𝗔 𝘀𝘂𝗰𝗰𝗲𝘀𝘀𝗳𝘂𝗹 𝗽𝗮𝘀𝘀𝘄𝗼𝗿𝗱 𝘀𝗵𝗼𝘂𝗹𝗱 𝗻𝗼𝘁 𝗮𝘂𝘁𝗼𝗺𝗮𝘁𝗶𝗰𝗮𝗹𝗹𝘆 𝗿𝗲𝘀𝘂𝗹𝘁 𝗶𝗻 𝘂𝗻𝗿𝗲𝘀𝘁𝗿𝗶𝗰𝘁𝗲𝗱 𝗮𝗰𝗰𝗲𝘀𝘀. Every access decision should consider signals such as:

🔹 Identity and assigned role
🔹 Device health and compliance
🔹 Sign-in location and behavior
🔹 Authentication strength
🔹 Sensitivity of the requested resource
🔹 User and session risk
🔹 Whether the access remains necessary

Another key takeaway is that identity security extends beyond employees.

Applications, APIs, service accounts, automation tools, and cloud workloads all have identities. Without proper ownership, credential rotation, lifecycle controls, least-privilege permissions, and monitoring, these non-human identities can become invisible pathways into critical systems.

𝗪𝗵𝗮𝘁 𝘄𝗼𝘂𝗹𝗱 𝗺𝘆 𝗿𝗲𝗰𝗼𝗺𝗺𝗲𝗻𝗱𝗮𝘁𝗶𝗼𝗻𝘀 𝗯𝗲 𝘁𝗼 𝘁𝗵𝗲 𝗼𝗿𝗴𝗮𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻𝘀 𝗶𝗺𝗽𝗿𝗼𝘃𝗶𝗻𝗴 𝗶𝗱𝗲𝗻𝘁𝗶𝘁𝘆 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆:

✅ Establish an authoritative identity source of truth
✅ Automate joiner-mover-leaver processes
✅ Design roles around least privilege
✅ Perform risk-based access reviews
✅ Remove dormant, duplicate, and orphaned accounts
✅ Replace standing privileges with time-bound access
✅ Strengthen MFA and move toward phishing-resistant authentication
✅ Govern service accounts and workload identities
✅ Integrate identity telemetry with SIEM and incident response
✅ Treat identity governance as a continuous program—not an annual compliance exercise

My fellowship is reinforcing an important truth:

Cybersecurity is no longer only about protecting the network perimeter. In modern cloud and hybrid environments, 𝗶𝗱𝗲𝗻𝘁𝗶𝘁𝘆 𝗵𝗮𝘀 𝗯𝗲𝗰𝗼𝗺𝗲 𝘁𝗵𝗲 𝗻𝗲𝘄 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗽𝗲𝗿𝗶𝗺𝗲𝘁𝗲𝗿.

The goal is not to make passwords so complicated that users need a haiku to remember them.

𝗧𝗵𝗲 𝗴𝗼𝗮𝗹 𝗶𝘀 𝘁𝗼 𝗯𝘂𝗶𝗹𝗱 𝗮𝗻 𝗶𝗱𝗲𝗻𝘁𝗶𝘁𝘆 𝗲𝗰𝗼𝘀𝘆𝘀𝘁𝗲𝗺 𝘄𝗵𝗲𝗿𝗲 𝗲𝘃𝗲𝗿𝘆 𝗮𝗰𝗰𝗲𝘀𝘀 𝗱𝗲𝗰𝗶𝘀𝗶𝗼𝗻 𝗶𝘀 𝗶𝗻𝘁𝗲𝗻𝘁𝗶𝗼𝗻𝗮𝗹, 𝘃𝗶𝘀𝗶𝗯𝗹𝗲, 𝘃𝗲𝗿𝗶𝗳𝗶𝗲𝗱, 𝗮𝗻𝗱 𝗴𝗼𝘃𝗲𝗿𝗻𝗲𝗱.

What is the greatest identity-security challenge facing your organization: privilege creep, access reviews, lifecycle automation, or non-human identities?

Article: https://lnkd.in/p/g_PdkmMQ

#Cybersecurity #IAM #IdentitySecurity #IdentityGovernance #PIM #ZeroTrust #LeastPrivilege #PrivilegedAccessManagement #InformationSecurity #EntraID