Expert view: how to effectively protect identities and access to IT resources

OP-ED · 30 JANUARY 2025

By Marc Schmitt, Senior Cybersecurity Consultant at SASETY · Lire en français

Identity and access protection: from constraint to priority

In an increasingly connected world, protecting identities and access has become a top priority for businesses and individuals alike.

Cyberattacks are growing in number and sophistication, putting sensitive data and the confidentiality of access at risk.

85% of attacks stem from a failure to protect identity elements, which underlines how important it is to protect digital identities and the access associated with them.

Despite all the security technologies available, the human factor plays an essential role. People are both the greatest risk and the greatest protection against cyber threats.

Human errors, such as using weak passwords or carelessly sharing sensitive information, can seriously compromise security.

Technical and organisational measures are needed to minimise the risk of identity compromise.

The rise of the Cloud and of the internet in general, together with easy access to the related resources, has made people somewhat forget that behind every application and every resource, an identification element is used, sometimes wrongly.

For businesses, SaaS applications have opened up new possibilities in terms of speed of deployment and go-to-market.

One of the trade-offs of this "digital speed" is the emergence of Shadow IT, which means consuming applications or services that IT teams do not control.

In their quest for simplicity, SaaS providers have streamlined the ways to access their services by relying on identity federation from every possible source (corporate directory, Google, Facebook, etc.).

Conversely, these "modern" applications natively support multi-factor authentication (MFA), provided of course that the feature is enabled and configured.

In fact, more and more providers now require MFA to log in, making this process part of everyday practice.

More than ever, the challenge for IT teams will be to manage and secure access to these SaaS applications while ensuring overall governance of existing corporate directories such as Active Directory, used by more than 90% of organisations.

Paradoxically, traditional directories such as Active Directory were mostly designed at a time when the features offered to users and IT teams were the top priority, before identity security became a central issue.

Third-party tools were developed to fill this need, but it was the explosion of cyberattacks and changing regulatory requirements that made strengthening identity security a priority.

It was not so long ago that overly complex passwords, changed at regular intervals, were considered unnecessary.

Recent cyberattacks have proven that identities and access need protecting more than ever. While zero risk does not exist, effective identity and access security limits the impact and helps detect a potential intrusion faster.

This article presents the identity protection technology from Silverfort, whose promise is to protect all identities and access using modern methods such as MFA, while also restoring visibility over access to the various resources.

What about MFA for legacy applications?

Today, multi-factor authentication is common practice in the business world, and also in some personal uses (banking, healthcare, etc.).

The principle is to have an additional authentication element on top of the username / password pair.

This element, or factor, can take various forms, from SMS to facial recognition or an app installed on a smartphone.

These methods offer different levels of security, and the main constraint is that applications must support them in order to use these additional authentication methods.

While most modern applications, usually SaaS, offer MFA, the situation is quite different for legacy and on-premise applications, which in most cases rely on a corporate directory whose role is to validate users' identity and access.

Although SaaS applications are an integral part of companies' application portfolios, it is important to give due attention to legacy and on-premise applications and resources.

Many information systems are "hybrid", using both on-site and Cloud resources.

It is important to distinguish between SaaS and Cloud applications, even though the two terms are often used interchangeably in everyday language.

A Cloud application is not necessarily a SaaS application.

Application servers can perfectly well be migrated to a public cloud in IaaS mode, yet the application will still not be SaaS.

While SaaS applications natively allow MFA to be implemented, this is rarely the case for internal applications, which fully delegate identity and access management to the directory.

Clearly, it is difficult to apply the same level of identity security to on-premise applications and resources as to SaaS, unless of course a whole set of tools is deployed, which risks making management heavier and reducing overall visibility.

Silverfort's revolutionary approach

Founded in 2016 with the ambition of revolutionising identity protection, Silverfort has developed a technology that protects what could previously not be protected: legacy applications, system administration tools and service accounts, with a simple, agentless architecture.

All that is needed is to install a component on each domain controller to protect Active Directory.

As soon as a user tries to access a resource in the information system, the Silverfort engine analyses the request and, based on the configured rules, allows or denies access, possibly after an MFA request.

The key point is that the technology is agnostic to the underlying applications. As long as the access request goes through Active Directory (or another supported IdP), Silverfort can process it and apply the same security options as for a modern application.

Visibility over Active Directory

The first step is to gain complete, up-to-date visibility of the Active Directory environment in order to define its security posture (Identity Security Posture Management).

Silverfort analyses both the Active Directory configuration and all authentication and resource access activity.

These metrics are reviewed by the internal engine, which provides various insights into the security posture and makes recommendations.

Even though many tools exist to assess the security of an Active Directory, continuous analysis of the security posture is essential, since the environment changes constantly and keeping security settings stable is difficult.

Protecting access to resources

The next step is to protect access to resources.

To do this, the Tiering model developed by Microsoft provides best practices for securing the different tiers of Active Directory.

Silverfort analyses all requests to access directory resources, assesses whether the access is legitimate and allows it or not. Based on Silverfort's verdict, Active Directory will accept or reject the access request.

This is a key aspect of how the technology works. Active Directory (through the domain controllers) responds to the access request. The advantage is that no components need to be deployed on the various resources, as long as they use Active Directory as their identity provider (IdP).

To reach its verdict, Silverfort uses a set of rules (policies) which, as in a firewall, have a number of input criteria (who, what, where, how) and an action as output.

An action can be to request MFA if a user tries to connect to a sensitive resource or is identified as "at risk".

The technology also protects service accounts, not through MFA, but by restricting the sources and destinations of service account access.

Once the service account has been analysed and categorised, the Silverfort security engine proposes a list of authentication and access sources and destinations that are allowed for that account.

This way, if the account is compromised, its scope for lateral movement is reduced and any attempt to break out is detected and blocked.

In short, Silverfort behaves like a firewall, but instead of acting on network protocols, it acts on access requests.

Main use cases

Deploying Silverfort significantly strengthens access security for environments that previously had no such protection.

It also makes it easier to implement the tiering model, ensuring that security mechanisms cannot be bypassed.

On its own, the technology covers a large number of use cases, including:

Service account protection
Strengthening the Active Directory Tiering model
Compliance and cyber insurance
Preventing lateral movement
AD and Entra ID consolidation
Zero Trust Active Directory
Visibility and risk analysis

New features are already in development to broaden the use cases and further increase security and visibility.

It also enables overall identity governance thanks to its native integrations with the major market platforms.

Silverfort by SASETY

As a local cybersecurity partner, SASETY makes Silverfort a cornerstone of a Zero Trust strategy for securing identities and access.

Combined with SASE technology from Cato Networks and automated security validation from Pentera, SASETY offers a comprehensive Zero Trust approach that delivers maximum security with effective technologies that are quick to integrate and simple to operate.

To ensure optimal identity security within organisations, SASETY's teams bring their expertise in consulting, integration and adoption of Silverfort.

In addition, SASETY offers a catalogue of à la carte managed services:

24x7 monitoring of authentication and resource access requests
Automatic notification and handling of related security alerts
Change and evolution management
Regular security posture reviews
Compliance reports for stakeholders

By combining Silverfort with its service offering, SASETY delivers a comprehensive approach covering strong authentication, access management and continuous monitoring of identities and authentication systems.

With Silverfort and SASETY, organisations can take on the challenges of identity and access protection with confidence and efficiency.

👀 To secure identities and access to IT resources, discover Silverfort x SASETY, the expert in adaptive authentication and agentless access protection 🔐👇

💡 To see how effective Silverfort really is, nothing beats a demo 👇

Contact our experts →