Resumen de Confianza Digital: Noticias imprescindibles de esta semana (31 de octubre - 4 de noviembre).

Welcome to the first installment of a new series on the Keyfactor blog — the Digital Trust Digest. It’s nearly impossible for IT and security leaders to keep up with the daily deluge of cybersecurity news, which is why we’re curating the need-to-know headlines for you each week. Tune in every Friday to get a pulse on the latest developments in PKI, machine identity management, IoT security, quantum computing, and much more.

Here are the top five cybersecurity updates you need to know about this week:

1. “How cloud PAM can transform the enterprise“ from VentureBeat

With the push to the cloud and nearly two-thirds of application-based spending going towards cloud technologies by 2025, enterprises are at greater risk of potential breaches. Enterprises must implement cloud-based privileged access management (PAM) platforms that can span the entire hybrid cloud infrastructure to achieve true Zero-Trust Network Access (ZTNA) frameworks. 

Los sistemas PAM basados en la nube también ofrecen estos beneficios:

• La capacidad de rastrear los gastos operativos en tiempo real
• Mayor seguridad de las integraciones basadas en la nube con confianza SSL bidireccional
• Fiabilidad mejorada para integrarse con servicios de nube pública
• Optimizado y escalable para requisitos de auditoría y cumplimiento 

Read more about cloud-based PAM platforms here.

2. “El CISO de Microsoft sobre por qué la nube es importante para la respuesta de seguridad” de CIODive

Microsoft CVP and CISO Bret Arsenault argues that cloud-based technologies are the future of predicting, detecting, tracking, and protecting against the increase of identity- and password-based attacks. The frequency of these attacks, 920/second in 2022 up from 600/second in 2021, has led organizations like Microsoft to strive for a passwordless environment. 

While passwordless environments are out of reach for many, Arsenault highlights what he calls the “brilliant basics” model to prevent attacks:

• Utilice la autenticación multifactor
• Restringir el acceso únicamente a dispositivos certificados como seguros.
• Recopilar datos que ayuden a su organización a detectar anomalías a nivel de la nube. 

Read more cloud-based security responses here.

3. “Estamos atravesando una crisis de identidad de máquinas”, por Ted Shorter, CTO de Keyfactor, para Forbes.

Machine identities now outnumber humans 45-1 and 68% of them have access to sensitive data and assets, according to a report by CyberArk. However, with this increase, there has been a lack of attention on machine identity protection, leaving a potential vulnerability in the armor of cybersecurity.

Keyfactor CTO Ted Shorter recommends these steps to secure machine identities with proper PKI and certificate management:

• Implementar una estrategia a nivel empresarial para la criptografía y las identidades de máquinas.
• Mejorar su criptoagilidad para proteger proactivamente las identidades.
• Construir un kit de herramientas eficaz para la gestión de identidades. 

Read more about the machine identity crisis here.

4. ISARA pone a disposición pública cuatro patentes de certificados digitales para impulsar la seguridad cuántica.

In a press release, ISARA shared that it is giving the intellectual property behind its ISARA Catalyst Agile Digital Certificate Methodology, which includes four patents, to the public to support industry-wide cryptoagility. ISARA’s methodology includes hybrid certificates which enable a streamlined migration to quantum-safe security to protect connected devices, IoT, and PKI.

Keyfactor’s Chief PKI Officier Tomas Gustavsson weighed in on the release of ISARA’s methodology and the use of hybrid certificates: “The potential threat of quantum computers to computer security and secure communications is potentially the biggest existential threat our industry has faced to date. It’s on us to help ensure that the transition from conventional to post-quantum cryptography is as smooth as possible and hybrid certificates are a key part of that.”

Leer más aquí.

5. La inscripción para Keyfactor Tech Days 2023 está abierta.

¡La inscripción para Tech Days 2023 está abierta! El panorama de la PKI y la criptografía se encuentra en un estado de constante evolución. La aparición de la criptografía postcuántica, los nuevos casos de uso de PKI e IoT, y el rápido crecimiento de las identidades de máquinas son todos desafíos formidables. En Tech Days 2023, decimos “¡Manos a la obra! Únase a nosotros en Barcelona, del 13 al 15 de febrero.

¿Le interesa compartir su perspectiva única sobre PKI, seguridad de IoT, firma de código y documentos, o cualquier otro tema orientado a la seguridad empresarial? La convocatoria de ponentes está abierta hasta el 8 de noviembre. Envíe su tema aquí.