Luke Z.

Identity is the new perimeter. Treat it like security infrastructure, not a provisioning queue. Most breaches don’t start with a firewall failure. They start with access that shouldn’t have existed, lasted too long, or wasn’t monitored. That’s not a tooling problem. That’s identity design. What I keep seeing in the field: JML drift: joiner–mover–leaver processes built on tickets and spreadsheets. Stale accounts and orphaned access become permanent attack paths. Excess privilege by default: roles accrete entitlements over time; “temporary” access becomes standing access. Credential sprawl: service and admin accounts without owners, rotation, or session recording. Unmapped trust edges: third parties, bots, and workloads granted broad access with weak guardrails. Detection blind spots: SOC watches endpoints and networks while privileged sessions and identity changes happen “off to the side.” If identity is your control plane, design it like one: Authoritative source of truth for identities and their lifecycle. No ad-hoc identities, no unknown service accounts. Least privilege as the default state: role engineering, time-bounded elevation, and removal on move/exit. PAM over permanent admin: just-in-time elevation, approvals, session monitoring/recording, credential rotation. Strong auth everywhere it matters: phishing-resistant MFA and conditional access policies tied to risk, device, and location. Continuous access review that’s owner-driven and evidence-based, not annual checkbox campaigns. Identity signals into detection: feed login anomalies, privilege elevation, and policy exceptions to the SOC like any other high-value telemetry. Third-party and non-human identity controls: scoped tokens, short-lived credentials, and contract-bound offboarding. Zero Trust, EDR, and SIEM are necessary, but without disciplined IAM, they’re compensating controls around an undefined core. You can’t defend what you haven’t modeled. Model identity, constrain it, monitor it, and expire it on time. 📌 P.S. As a trusted cybersecurity specialist, I can help you assess your cybersecurity risks and recommend the right solutions for your business. Please feel free to contact me if you have any questions or need assistance. #cybersecurity

186

35 Comments

Two newly disclosed N-able vulnerabilities, CVE-2025-8875 and CVE-2025-8876, have been added to CISA’s KEV Catalog. They affect N-able’s N-central remote monitoring and management (RMM) platform. These flaws allow local code execution and command injection but require authentication to exploit, meaning they are unlikely to be used at the beginning of an exploit chain. Alexander Culafi at Dark Reading covers the details, noting the vulnerabilities impact versions prior to 2025.3.1. The article also features insight from Rapid7's Seth Lazarus: “They require authentication to achieve exploitation, which is much less severe than what we’ve recently seen, and likely why exploitation in the wild doesn’t appear to be widespread.” Read the full breakdown here: https://lnkd.in/eiukB6HM

77