All news with #iam tag

🔐 Rona Michele Spiegel transitioned from an arts and multimedia background into cybersecurity by blending early human-computer interface work with formal study and hands-on industry experience. She helped establish a user experience practice at Deloitte, worked in technology governance at Cisco, earned a Master of Information and Cybersecurity, and later focused on cloud controls at Wells Fargo before joining Autodesk to lead security and trust for mergers and acquisitions. Spiegel emphasizes careful risk assessment in M&A—especially when absorbing small, resource-constrained companies—while navigating AI-driven complexity, addressing hiring and entry-level gaps, and preventing burnout through inclusive leadership and mentoring.

🔐 In 2026 CISOs are balancing core security tasks with urgent AI-related challenges. Strengthening data protection, securing cloud and enterprise AI deployments, and improving identity and access management rank high. Leaders are preparing for AI-enabled attacks, rolling out AI to accelerate security operations, and addressing shadow AI and third-party risks to bolster resilience and supply-chain security.

🔐 Jamie Norton, CISO at ASIC and vice chair of ISACA, describes persistent cyber challenges across government and financial sectors. He points to legacy systems, weak foundational hygiene, and the need to align people, process and technology while warning that rapid advances in AI will change roles and tooling. Norton emphasizes executive accountability, mentorship, training and a mission-driven culture to retain talent, and champions the mantra Do the basics brilliantly.

🔐 New research from CyberArk finds enterprise users routinely bypass IAM controls to work faster, with 63% of security leaders reporting this behavior. Only 1% of organizations have fully implemented a modern just‑in‑time privileged access model, while 91% say at least half of privileged access remains always‑on. Shadow accounts and unmanaged secrets surface weekly in 54% of firms, and many lack clear AI access policies.

🔒 As enterprises deploy AI agents, expand cloud use, and rely on complex global supply chains, CISOs must tighten identity and access controls, govern agent accounts, and apply phishing-resistant MFA. They should prioritize zero-trust architectures across IT and OT, enforce proactive cloud posture management and supplier risk monitoring, and integrate geopolitical and regulatory scenario planning. Failing to address chatbot privacy, misconfigured cloud services, human error, and escalating compliance (e.g., GDPR, DORA, HIPAA) risks operational disruption, financial penalties, and reputational harm.

🔍 Identity has fragmented across SaaS, on‑prem, IaaS, PaaS and unmanaged apps, creating an invisible mass of ungoverned accounts and non‑human identities the author calls identity dark matter. Traditional IAM and IGA address only the nearly managed half of this universe, while APIs, bots, service accounts and agent‑AI remain unobserved and ungoverned. Orchid Security recommends shifting from configuration‑based controls to Identity Observability: collect telemetry from every application, unify audit trails, and extend governance across managed, unmanaged, and agent‑AI identities to achieve measurable visibility and faster response.

🔒 Many enterprise CISOs continue to struggle to abandon passwords despite decades of effort and mounting security risks. RSA’s ID IQ Report 2026, based on a survey of 2,000 security professionals, finds that 90% of respondents report problems with passwordless deployments. Technical complexity across hybrid environments, legacy systems, OT/IoT devices, and inconsistent platform support creates gaps that often force organizations to retain insecure fallbacks. Experts recommend sequencing rollouts to secure privileged users first, using reverse proxies or VPN-enforced SSO for legacy apps, and ensuring end-to-end phishing-resistant enrollment and recovery.

🛡️ Companies facing NIS2 risk turning compliance into a voluminous paperwork exercise unless security is embedded in the technical stack from the outset. The piece argues that documentation alone does not equal protection and advocates for automating controls and evidence via infrastructure as code, CI/CD pipelines, and policy-as-code. Practical focus areas include IAM, vulnerability and supply-chain management, and monitoring and incident response, where automation both reduces burden and improves auditability.

🛡️ NIST and CISA released the initial draft of Interagency Report (IR) 8597, offering implementation guidance to protect identity tokens and assertions from forgery, theft, and misuse. The draft, open for public comment through January 30, 2026, targets federal agencies and cloud service providers. It reviews controls for IAM systems that rely on digitally signed tokens and calls on CSPs to adopt Secure by Design principles while prioritizing transparency, configurability, and interoperability. The report also urges agencies to understand CSP architectures and deployment models to align protections with their risk and threat environment.

🔒 Organizations regularly leave servers, accounts, APIs, applications, and storage unmanaged or forgotten, creating high‑risk “IT zombies” that attackers exploit. The post outlines detection approaches — Automated Discovery and Reconciliation (AD&R), CMDB reconciliation, directory analysis, WAF/NGFW monitoring and SCA — and prescribes concrete responses for decommissioning, credential rotation, and data lifecycle control. Implementing IAM, SBOMs, DLP/CASB and automated test‑environment lifecycles reduces exposure and helps meet regulatory obligations.

📊 AWS now supports cost allocation using workforce user attributes imported into IAM Identity Center. Customers can enable attributes such as cost center, division, organization, and department as cost allocation tags to automatically attribute per-user subscription and on-demand application fees to internal business units. Costs are visible in AWS Cost Explorer and AWS CUR 2.0 and the capability is generally available in all Regions except GovCloud (US) and China (Beijing and Ningxia).

🔒 The Cybersecurity Forecast for 2026 highlights how agentic security automation and widespread AI will reshape defenses, shifting SOCs from monitoring to automated action. It calls for building workforce AI fluency, evolving IAM to treat agents as managed identities, and deploying model-protection measures alongside tamper-proof backups. Boards will increasingly demand operational resilience, quantified exposure, and mature AI governance.

🔐 Organizations face rising complexity as AI and sprawling systems make policy and compliance management touch every application. Deloitte has helped industrial and financial customers by linking named users to accounts, surfacing privileged and unvaulted accounts, and automating contact and remediation to reduce manual work. That improved SOC telemetry and cut time mapping incidents to MITRE ATT&CK. Meanwhile, apexanalytix uses Azure Active Directory and conditional access to detect risky sign-ins, impossible travel, and enforce geographic boundaries.

🔒Amazon Cognito identity pools now support AWS PrivateLink, enabling private connectivity between your VPC and Cognito to exchange federated identities for temporary AWS credentials. This removes the need to route authentication traffic over the public internet and reduces exposure of auth flows. PrivateLink endpoints are available in all Regions where Cognito identity pools operate except AWS China (Beijing) and AWS GovCloud (US); standard PrivateLink charges apply.

🤖 Robotic Process Automation (RPA) bots are rapidly becoming first‑class Non‑Human Identities (NHIs) that streamline provisioning, deprovisioning and credential handling while reducing human error. Left unmanaged, bot identities and embedded secrets expand the attack surface and enable privilege misuse or lateral movement. Organizations should treat bots like human users — using secrets managers, PAM, JIT access and unified IAM with Zero Trust controls to preserve least‑privilege and maintain auditability.

🔧 IAM Policy Autopilot is an open-source static analysis tool that generates baseline AWS IAM identity-based policies by analyzing application code locally. Available as a CLI and an MCP server, it integrates with MCP-compatible AI coding assistants to produce syntactically correct, dependency-aware policies and to troubleshoot Access Denied errors. The tool favors functionality during initial deployments and recommends reviewing and tightening generated policies to meet least-privilege principles as applications mature.

🔒 Operational technology (OT) environments underpin critical infrastructure but frequently lag behind IT in cybersecurity maturity. Strong password policies mitigate risks from outdated hardware, shared accounts, remote vendor access, and credential reuse. Core measures include prioritizing password length, enforcing rotation with reuse prevention, and adopting password vaults. Combined with MFA, network segmentation and Privileged Access Workstations, these practices form a resilient OT security posture.

🔒Identity-focused attacks are driving major breaches across industries, with recent vishing incidents at M&S and Co-op enabling ransomware intrusions and combined losses exceeding £500 million. Attackers harvest credentials via infostealers, targeted phishing/smishing/vishing, breached password stores and automated attacks like credential stuffing. Implement least privilege, strong unique passwords in managers, MFA (authenticator apps or passkeys), PAM and automated identity lifecycle controls to limit blast radius.

🛡️ Amazon Web Services' AgentCore introduces preview features — Policy and Evaluations — to help teams scale agents from prototypes into production. Policy intercepts real-time tool calls via AgentCore Gateway and converts natural-language rules into Cedar for auditability and compliance without custom code. Evaluations offers 13 built-in evaluators plus custom model-based scoring, with all quality metrics surfaced in an Amazon CloudWatch dashboard to simplify continuous testing and monitoring.

🔒 Security leaders must shift from gatekeeper to partner, embedding practical risk controls early in product lifecycles so teams can deliver fast without exposing the business. By defining business-language risk tolerances, standardizing identity and logging, and automating guardrails in CI/CD and infrastructure-as-code, governance becomes an accelerator rather than a bottleneck. Pre-vetted, secure-by-default templates, runtime shielding and risk-based telemetry make the secure path easier for developers while preserving production resilience.