December 2024 Summaries

The December product update includes significant changes across the platform, including enhancements to Access Intelligence, Access Reviews, Lifecycle Management, Integrations, Open Authorization API, and Veza Platform. In Access Intelligence, report export scheduling has been improved, with customizable schedules for PDF or CSV formats. Report filtering with AWS account groups offers advanced options for analyzing data across large-scale AWS environments. In Access Reviews, digest notification customization and improved review exports have been added, along with new features such as risk scores in the reviewer interface and row grouping. Lifecycle Management now supports Azure Directory Extensions, Schema Extensions, and Distribution Lists, with draft mode enabled for staging unpublished changes. Integrations have also been enhanced, including a new Artifactory integration and support for Secure Scores, Azure Identity Protection, and Entra ID Conditional Access Policies. The Open Authorization API has been updated to support defining a set of applications available within the IdP. Veza Platform now allows administrators to configure event subscriptions and alerts for specific events using filters for severity, category, and event type.

AI is revolutionizing the way organizations manage access control and identity management, offering a more secure, scalable, and efficient approach to protecting sensitive data and systems. By combining artificial intelligence with machine learning, natural language processing, and generative AI, businesses can automate access requests, detect potential vulnerabilities, and provide real-time risk assessment. This enables them to implement the principle of least privilege, reducing excessive permissions and improving security. With AI-driven insights, organizations can manage permissions, eliminate redundant access, and identify potential security gaps across applications and user accounts, ultimately reducing the workload for administrators and improving productivity. As AI continues to evolve, it has the capacity to transform how organizations manage access control in complex environments, providing a comprehensive, granular view of identities and permissions, and enabling teams to make informed decisions with intuitive dashboards and real-time analytics.

Veza’s identity security platform addresses the increasing complexity of managing access control and demonstrating compliance with PCI DSS 4.0 requirements, particularly in addressing crucial access control requirements and periodic access reviews. The new standard introduces enhanced requirements for access control, user identification, and monitoring, which Veza's platform can help organizations meet effectively. By providing comprehensive capabilities to manage access relationships across the environment through a number of core capabilities, including visibility into "who can take what action on what data," supporting privileged access monitoring, and enabling non-human identity management, Veza enables organizations to streamline PCI DSS compliance while enhancing their overall security posture and compliance efforts. The platform offers practical examples of queries that can help demonstrate compliance with specific control requirements, such as restricting access to system components and data, assigning access based on job classification and function, implementing least privileges, and implementing audit trails. By leveraging Veza's Access Graph capabilities and the PCI DSS 4.0 requirements, organizations can more effectively manage their compliance efforts and improve their overall security posture.

SailPoint is an enterprise identity security solution that uses artificial intelligence and machine learning to automate access management. It aims to grant the appropriate level of access to the right identities at the right time, integrating with existing systems and workflows. However, a closer look at SailPoint reveals that it may not be a suitable choice in today's complex environment due to its limitations, including cache issues, limited role organization, inability to detect all identities, high cost, long implementation time, technical issues, performance problems, bugs, and steep learning curve. The platform offers extensive customization options but can be overwhelming for some users. SailPoint pricing is notably higher than many of its competitors, making it a significant drawback for budget-conscious organizations. Customer reviews highlight both the pros and cons of using SailPoint, with some appreciating its customization options and others experiencing technical issues. Veza stands out as a superior alternative to SailPoint, offering a comprehensive access platform designed to provide a seamless, user-friendly experience, going beyond traditional user and group permissions to offer insights and control. Veza's intuitive interface, powerful automation, and real-time threat detection capabilities make it an attractive choice for modern enterprises seeking effective and efficient identity governance.

In this episode of the Identity Radicals podcast, Mike Towers and Adam Fletcher discuss managing access in today's hybrid and cloud environments, highlighting the importance of least privilege and agile access decisions. They emphasize the need to understand who has access, what they can access, and the role of automation in securing both human and non-human identities. Security teams must balance security with operational efficiency, aiming for least privilege with minimal friction. The conversation also touches on the growing exponential growth of non-human identities in modern enterprises, requiring agile management across diverse environments to reduce risk and improve efficiency.

In a recent episode of the Identity Radicals podcast, Mike Towers and Adam Fletcher discuss managing access in today's hybrid and cloud environments, emphasizing the importance of achieving least privilege with minimal friction. Understanding who has access, what they can access, and making agile access decisions are crucial in this context. Security leaders must aim to secure both human and non-human identities, leveraging automation to reduce risk and improve operational efficiency. The conversation highlights the growing need for identity-based security solutions, particularly as non-human identities continue to expand in modern enterprises.

Access requests are a crucial part of any business, allowing employees to request permission to use specific tools or systems. However, if not managed properly, access requests can lead to identity security risks like data leaks or unauthorized access. Effective access request management ensures that the right people have the right access at the right time, without unnecessary delays or excessive permissions that could lead to breaches. A well-organized process helps businesses stay secure, cut costs, and work more efficiently, while also reducing regulatory compliance issues, minimizing the risk of data leaks, insider threats, permission sprawl, and other security risks. Automating the access request workflow speeds things up, cuts down on errors, and reduces workload for IT teams. Implementing role-based access control and a least-privilege policy helps prevent too much access from being given out, while regularly reviewing access activity across the organization catches outdated or unnecessary permissions. Veza's Access Platform simplifies this process by giving users a complete view of who has access to what, transforming how you manage and secure access with powerful tools to spot risks and streamline compliance.

Modern enterprises face the challenge of balancing security and productivity while ensuring employees have appropriate access to resources. The growing complexity of systems, roles, and permissions has placed an unsustainable burden on IT and identity teams. Veza Access Requests is a solution designed to automate and streamline the access request process by integrating powerful automation with data-driven insights about permissions. It provides real-time visibility into entitlements, enabling organizations to efficiently manage access at scale while maintaining strict control. The platform allows users to request and receive the right access in minutes, not days, while just-in-time provisioning and automatic expiration minimize privilege creep over time.

The Sarbanes-Oxley (SOX) Act, enacted in response to significant financial scandals involving large corporations, requires publicly traded organizations to prove they have the appropriate internal controls in place for accurate financial reporting and protection of sensitive data. This guide explores SOX compliance, including who must comply, benefits and challenges, best practices, and a comprehensive checklist. Maintaining SOX compliance involves implementing procedures to meet specific requirements such as maintaining financial records, establishing internal controls, conducting regular audits, and protecting against data tampering. The Act aims to foster transparency, reliability, and accountability in corporate financial practices to protect the interests of investors and the general public.