Centrify Perspective

Centrify Perspective

As a leader in unified identity management, Centrify offers helpful information for organizations to enable greater user productivity, improved IT efficiency, better regulatory compliance and lower TCO of their identity infrastructure.


By , December 18, 2018

As CEO of Centrify, I have been writing about “CEO Fraud” — whereby scammers send emails that impersonate senior executives to obtain money or data — for well over three years now. I have blogged about it based on first-hand encounters, presented on it and the broader topic of “business email compromise” (BEC) at the 2016 RSA Conference, and was even interviewed on a nightly news show about it (scroll to 18:30 to see yours truly wax poetic). But I am not the “vox clamantis in deserto” (“voice crying out in the wilderness” for those that know Latin, or you…

By , December 12, 2018

Every year when the holidays roll around, I’m amazed at the way shopping deals dominate the headlines. Black Friday and Cyber Monday are annual juggernauts that produce some amazing opportunities for shoppers and retailers alike. Yet this year, even the mighty shopping season has taken back-seat to the continuing domination of security breaches in the press. With $114 billion being spent on Information Security products and services in 2018, as estimated by Gartner, we should see the frequency of data breaches going down. Instead, rather than seeing fewer headlines, we’re seeing more. In the past two weeks alone we’ve seen…

By , December 7, 2018

On December 3, 2018 Gartner released The Magic Quadrant for Privileged Access Management, Q4 2018. Evaluating 14 vendors, Gartner positioned Centrify in the LEADERS quadrant. Here at Centrify, we believe this is a strong validation of Centrify’s Zero Trust Privilege approach to privileged access management. A complimentary version of this report is available for download here. As breaches and attacks grow, the market is finally realizing that importance of PAM not just for compliance, but as a strong security control. At Gartner’s Security and Risk Management Summit in June 2018, Neil MacDonald noted in the keynote that PAM was one of the Top…

By , November 8, 2018

Cyber attackers long ago figured out that the easiest way to gain access to sensitive data is by compromising an end user’s identity and credentials. According to the Verizon 2017 Data Breach Investigation Report, 81% of hacking-related breaches leverage either stolen, default, or weak credentials. Often these credentials belong to privileged users, providing cyber adversaries the “keys to the kingdom” and providing them a perfect camouflage for their data exfiltration efforts. Betting on the human factor and attacking the weakest link in the cyber defense chain, credential harvesting has become the base of most cyber-attacks. Recent reports of a newly-detected Smoke…

By , October 23, 2018

Wow! Right out of the gate and the brand new spinout of Centrify Application and Endpoint Services as Idaptive is named as an Overall Leader in the recent KuppingerCole Leadership Compass for Cloud-based MFA Solutions report. Most organizations today are wrestling with how to better authenticate users. Passwords are not enough and MFA has risen as a secure option for most enterprises. According to the report: “Cloud-based MFA is the process of using a SaaS solution to gather additional attributes about users and their environments and evaluate the attributes in the context of risk-based policies. The goal of Cloud MFA…

By , August 22, 2018

Earlier this month, I posted a blog about how most companies I speak with have not implemented a modern database authentication and authorization approach. I also recommended 8 steps IT leaders can take to modernize their database management operations. Upon reflection, I think an interesting follow up would be to take a look at some numbers that further illustrate the need to put effective database authentication and authorization practices in place to secure the enterprise. LOOK AT THE NUMBERS Let’s create a fictitious sample company to examine, called Company X. At the DB Survival Blog site, the accepted high-end number…

By , August 15, 2018

In today’s mobile-first, cloud-first environment, cybersecurity starts with protecting the primary attack vector – privileged identities – with a “never trust, always verify” mindset for Zero Trust Security. Gartner predicts that companies will spend $96 billion in cybersecurity solutions in 2018 alone. While worldwide spending will increase 8% from last year’s total, less than 10% will be spent on Identity and Access Management, the number one attack vector. Clearly there is misinformation and misunderstanding of how to stop a breach. A recent research study with Dow Jones Customer Intelligence, “CEO Disconnect is Weakening Cybersecurity,” revealed that a discrepancy in the C-Suite is weakening enterprise security postures. CEOs mistakenly focus on eliminating malware, while Technical Officers (CIOs, CTOs and CISOs) on the front lines of cybersecurity point to identity breaches – including privileged user identity attacks and default,…

By , August 8, 2018

The most common question I hear about Database Accounts is, “Can your solution vault Database Service and other Privileged Database Accounts?” Every time I hear this question, a voice in the back of my head wants to ask, “Have you implemented modern approaches to Database Authentication and Authorization Management?” See the real problem is the majority of Databases and the hosted Database Instances still have legacy Database Authentication and Authorization methodologies applied to them, so we are trying to apply a band-aid to the issue by reaching into the databases and vault the DB local accounts. THREE DATABASE APPROACHES Let’s…

By , August 2, 2018

While phishing attacks continue to jeopardize today’s organizations (a reported 76% of organizations experienced phishing attacks in 2017), it was refreshing to hear that tech giant Google has apparently eliminated phishing by giving security keys to all of its 85,000 employees. “We have had no reported or confirmed account takeovers since implementing security keys at Google,” a company spokesperson told Krebs on Security last week. “Users might be asked to authenticate using their security key for many different apps/reasons. It all depends on the sensitivity of the app and the risk of the user at that point in time.” This…

By , July 25, 2018

CISOs are overwhelmed with a multitude of projects that are pulling at their time and resources. All of these projects feel important and usually will have some benefit, but nobody has the time or budget to do it all. So which projects will give you the biggest bang for your buck? How do security professionals prioritize these initiatives? At this year’s Gartner Security and Risk Management Summit, Gartner’s Neil MacDonald revealed the analyst firm’s top 10 recommended security projects for 2018. MacDonald stated that CISOs need to, “focus on projects that reduce the most amount of risk and have the…