Identity as the new organizational security perimeter
In today's hybrid work environment, the traditional network perimeter has lost its effectiveness, leaving user identity as the sole line of defense. According to the ENISA Threat Landscape 2025 report, phishing remains the primary vector for initial access, with 53.7% of affected organizations classified as critical entities. The updated NIST CSF 2.0 framework emphasizes that access risk management must be integrated into overall corporate governance.
Privilege creep and orphaned accounts
Most successful cyberattacks exploit organizational gaps in access management. The most common issues include:
- Privilege creep: occurs when an employee changes roles and receives new permissions but retains their old ones.
- Orphaned accounts: active accounts of former employees that remain active and become prime targets for attackers.
What changes for the sector
Uncontrolled privilege creep and orphaned accounts significantly expand an organization's attack surface, making them highly vulnerable to credential-based attacks and phishing. For businesses, this results in an inability to meet regulatory compliance requirements such as ISO/IEC 27001 and NIS2, potentially leading to legal penalties, loss of customer trust, and severe data breaches.
How IAM and PAM systems work together
For effective control, organizations use two complementary classes of systems:
- IAM (Identity and Access Management) manages basic access for all employees to standard business applications.
- PAM (Privileged Access Management) isolates and controls access for administrators and DevOps engineers to critical infrastructure.
Integrating these systems ensures that privileged access in PAM is automatically revoked when a user is blocked in IAM.
Access review methodology
Regularly reviewing whether access rights match job responsibilities is a requirement of ISO/IEC 27001 and NIS2 standards. The process consists of four stages:
- Determining resource criticality to establish review frequency.
- Delegating access approval responsibility to business unit managers.
- Automating the audit process using specialized solutions.
- Irreversibly logging review results in an audit trail.
Secure off-boarding according to NIST standards
According to NIST SP 800-63 guidelines, the off-boarding process for a privileged user must include immediate deactivation in the Identity Provider, termination of active sessions, revocation of PAM access with password and SSH key rotation, and reassignment of permissions to critical data.
An architectural approach to access control
To minimize the impact on business processes, security is built in at the architectural level (Security by Design). For example, solutions based on the UnityBase platform allow automating the access lifecycle through built-in Row-Level Security (RLS) mechanisms and Access Control Lists (ACL), simplifying integration into the company's overall IAM/PAM landscape.
What to do next
To effectively mitigate access risks and prevent privilege creep, organizations should adopt the following practical steps:
- Integrate IAM and PAM systems to ensure that blocking a user automatically revokes all privileged access.
- Establish a four-stage access review methodology, delegating approval authority to business unit managers and automating audits.
- Enforce strict NIST-compliant off-boarding procedures, including immediate session termination and credential rotation.
- Build security at the architectural level using platforms that support built-in RLS and ACL mechanisms.
Prepared by a Software Ukraine member. Original publication.