Access is the New Breach: Observability Must Start with Identity
summary
Claims that 80% of breaches are related to identity and that observability must correlate identities with system events drive the concrete agenda: run automated access reviews, audit permissions in real time, and enforce least privilege. Cited incidents include Tesla 2023 insider leak of ~700 employees and MFA fatigue at Uber; failures often stem from silos — about 60% of organizations report 21 disparate identities per user. Recommended tooling and patterns: Microsoft Sentinels and entra ID integration, Defender for cloud apps, DLP, zero trust, and incident response.
AI-written summary · about
chapters (10)
- 0:00Introduction to Observability and Identity
- 0:32The Importance of Access Reviews
- 1:05Blind Spots in Observability Tools
- 2:47Identity as the New Perimeter
- 3:56Common Identity-Related Breaches
- 6:01The Visibility Gap in Identity and Observability
- 7:00Quadrants of Identity Visibility and Risk Awareness
- 14:58Challenges in Implementing Identity Tools
- 17:05Best Practices for Identity and Observability
- 21:31Conclusion and Final Thoughts
related talks
45mApplying Past Lessons for Intel-Driven Identity Threat Detection
16mSecurity, Fraud, and Compliance
56mEmerging threats against cloud application identities and what you should do about it
12mIdentity and permissions concerns to watch out for
16mInnovation in Authentication and More
19mBeyond Perimeters: Implementing Zero Trust at Enterprise Scale
46mThe Human Factor: Building a Culture of Identity Security in a Decentralized Workforce
37mCustomer Identity for Modern Apps and APIs