While social media, digital payments, and NFTs are all post-internet creations, there are some fundamental aspects of technology that date back to the very beginning of the internet. When the government first started using an early version of the internet in the 60’s to share files, there was one component that quickly followed: online identity.
Around the same time as the birth of the internet, a computer scientist at MIT in the 60s created a framework for the earliest form of identity management; usernames and passwords. Since then, identity has woven its way deeper and deeper into the foundations of our digital lives.
Social accounts and profiles, anonymous vs. identity verifications, digital fraud prevention, and on and on. There are very few aspects of our digital lives that don’t rely on some system understanding that we are who we say we are.
Identity has, historically, acted as an adjacency to cybersecurity. Identity stood at the beginning to make sure no bad actors got in. Security was in place to look out for that bad behavior if something at the entryway failed. But increasingly, that just isn’t the case. Identity has stepped into the very center of the security paradigm.
This past week, Okta alerted customers that it had suffered a breach. Always scary when something like that happens; you hope you weren’t one of the customers affected. Unfortunately, in this instance? 100% of customers were impacted. Back in October, Okta had estimated the impact was only felt by ~1% of customers. Missed it by a mile.
But Okta isn’t alone. A staggering 80% of breaches occur as a result of identity issues, such as compromised credentials. Firms like MGM, Caeser’s, Atlassian, and New Relic join Okta among the identity-impacted breaches just over the last few months. Losses from these breaches can add up to the tune of hundreds of millions of dollars.
Okta is the pinnacle of identity management. But even they fell victim to the threat of identity vulnerabilities. Increasingly, it seems identity management will be the main battlefield for security practitioners going forward. The only question is what approach will finally fill the gaps in securing an organization’s network of identities?
