The 10 biggest issues CISOs face today and how authorization can help

We look at 10 issues that are top-of-mind for CISOs and see how policy-driven authorization can help solve these issues.

David Brossard   ·   Tuesday, January 14th, 2025   ·   Reading Time: 7 minutes

Recently, a colleague of mine sent this interesting article on the responsibilities of the CISO in today’s enterprise. In the article, Mary K. Pratt argues there are 10 issues that are top-of-mind:

1. A massively expanded threat landscape
2. Protecting a moving target — without introducing digital friction
3. An ‘avalanche of regulations’
4. Third-party and supply chain risk
5. Increasing liability for the organization’s security
6. Securing AI within the enterprise
7. Protecting the organization from AI-enabled threats
8. Adequate resources
9. Security’s role (and stature) in the organization
10. Achieving operational excellence

As a CTO in a cybersecurity firm, I can relate closely with all of these points. Some are easier to grasp and keep under control. Others, like third-party risk, require organizational skills to work with said third-party and make sure they have security as a top priority. I can observe how my team, on the product and the customer-facing side, handles customer expectations with regards to vulnerabilities, dependency management, and software hardening. Regulations like DORA (the EU’s Digital Operational Resilience Act) provide both a guideline and a set of requirements companies must comply with.

Let’s be clear: these should not be afterthoughts. We must consciously build with security & compliance in mind – not to check some box on a form or an RFP but because it’s the right thing to do.

Threat Landscape

Let’s go back to the other issues listed in the article. The threat landscape is indeed massively expanded. Not only are there more users, data, entry points, services, processes, etc, but there are also new attack vectors and new types of attacks.

How can we tackle the threats? In my mind there are three main pillars:

• Education: We need to educate users (employees, partners, contractors, customers) to the risks that exist within IT systems. We need to teach software developers to think about security/safety first.
• Security by design: The US’s Cybersecurity and Infrastructure Security Agency (CISA) has an entire website dedicated to “secure by design”. In their words, “It’s time to build cybersecurity into the design and manufacture of technology products.” It’s both a mentality thing and an architectural decision. Make sure your architects adopt that approach.
• Standards first: Standards are here to help us implement the different parts of a secure framework (authentication, authorization, secure data storage…) so we don’t individually come with our own untested unproven ways of handling security. Look at OAuth 2.0 as an example. After years of designing OAuth with the leaders in this space (both on the vendor side and the practitioner side), OAuth has released Best Current Practices (draft-ietf-oauth-security-topics-29) as well as OAuth 2.1. These are evolutions of the standard that address new threats and attack vectors. Only standards bodies have the ability to deliver such continuous enhancements.

Architects and CISOs should also turn to communities that provide security best practices and monitor the landscape for new threats. Two come to mind:

•  The Open Source Foundation for Application Security (OWASP) maintains two top-ten threats lists
  • The Top Ten list (due for a refresh in 2025)
  • The Top 10 API Security Risks, last updated in 2023
• IDPro (disclaimer: I’m a founding member). IDPro provides identity professionals – and employers – a method for validating essential IAM industry knowledge.
  • This is important to stay abreast of the latest IAM developments, trends, and threats

Putting customer/user experience first

Protecting a moving target — without introducing digital friction, is interesting. As a former developer and a fairly technical person, I had no appreciation for the impact our technology has on the human experience.

Why does that matter? Applying the right degree of security in the right circumstances allows companies to deliver optimal customer experience.

Let’s take an example: sites that force you to create an account before completing a purchase run the risk of losing your business – creating an account takes time and gets in the way of you finalizing the purchase. Social login helps mitigate that. Determining post-purchase account creation flows help mitigate that. It’s all about reducing digital friction.

Last week, a peer of mine who works for a leading APAC financial institution told me about purposeful friction: introducing additional checks (MFA, one-time passwords, etc) when the bank has a doubt as to the legitimacy of the financial transaction in play. This is another great example of delivering the best possible experience for consumers while enhancing their security posture and therefore the trust the consumer has in your brand.

Axiomatics and the entire field of fine-grained authorization help in that regard. In a world as dynamic and contextual as ours with a broad range of ever-changing threats, we cannot merely rely on static authentication mechanisms. Even if authentication methods have become stronger with new advances such as passkeys, you shouldn’t just let authenticated users do whatever they want on your systems. You need a means to run a fine-grained decision making process that takes into account user identity, risk score, device metadata, relationships, purpose, and more. Authorization is there to provide the different nuances that authentication alone cannot handle. As a side effect, it produces an audit trail of which access was requested, granted, or denied.

Translating regulations into actionable policies

Does an ‘avalanche of regulations’ scare you? With the existing toolset based on a legacy role-based and entitlement-based approach to access control, I can understand. For as long as authorization is strictly derived from identity-centric systems (think identity providers, OAuth authorization servers, tokens, claims), then it’ll be hard to reconcile the regulations a business must obey with the technical configuration of the IAM layer.

With policy-driven authorization however, it becomes child’s play. A government regulation (eg. GDPR) can be mapped directly into an authorization policy (such as Rego or ALFA). It becomes simple to define those policies, apply them to a broad range of applications & data, and even reuse them. Multiple regulations can be combined together as well. Because our approach is policy-based, aspects such as recertification and governance become more straightforward. Simply use our authorization APIs to generate reports that address questions like “what can happen?”, or “is my policy FAPI-compliant?”.

It’s not me, it’s them

My four-year-old is really good at shifting the blame to my 18-month old who can barely babble his way out of trouble. That said, blaming someone else for a failure, an accident, or a breach is not going to help you gain customer trust. And so it goes with third-party risk.

Third-party and supply chain risk can be limited by applying the principle of least-privilege as well as continuous enforcement. Again, existing identity-centric toolsets do not deliver on either. When you authenticate, you are given a ‘generous’ access token that typically grants you access to more than you need.

Additionally, sessions (or tokens) have a lifetime that is often longer than needed. Let’s take a page from the Zero Trust playbook. We need to continually enforce – never trust, always verify. To achieve continuous enforcement, adopt NIST ABAC’s  reference architecture. Use a Policy Enforcement Point where you can (e.g. via an API gateway) and request that your Saas providers adopt AuthZEN for a standardized, interoperable externalized authorization framework. For more on the topic, the US Department of Defense has an outstanding Zero Trust Reference Architecture.

In the case of my four-year-old, she needs to make sure my mischievous toddler doesn’t breach the cookie jar. But can we trust a four-year-old who also badly wants to munch on that cookie?

This leads into the liability aspect. Yes CIO, CISOs, and others can become personally liable. The way out? Make sure you have the right controls in place with the right transparency. The entire IAM industry has failed to provide authorization transparency by pushing off access control checks to individual applications and their proprietary ways of handling access (roles, groups, entitlements, and opaque code).

Hello, how can I help? Ask me anything (I know everything).

Yes, we’ve seen those prompts everywhere from ChatGPT to Gemini and Copilot. AI is firmly here to stay and grow. There are talks of an impending singularity.

AI poses a series of simple threats:

• Can it be used to attack an enterprise or users in novel ways never thought of before?
• Can it supercharge existing attacks such as social engineering or deep fakes?

It also poses challenges around its legitimate uses:

• If AI is rolled out in the enterprise, how can the CISO guarantee it’s only using data that the prompter (end-user) is allowed to see?

That question is also true of large datalake-querying engines (e.g. Snowflake). How can we make sure a user querying data is only seeing results based off of data they’re allowed to see? And what does that mean for any type of analytics projects they’re running.

Authorization can help set some guardrails on the use of either AI, machine learning, or simple ETL processes. Our team of researchers is looking into implementing authorization for RAG-based AI systems. This would mean applying the same authorization policies you defined for your business processes and APIs to your AI solutions. It’s a fundamental first step towards a safer and more compliant usage of AI within the enterprise.

It’s all about the people

The last three issues all tie back to the human element and the funding a security team receives. Going back to one of the first paragraphs, we must have a security-by-design mentality in every single industry be it retail, transportation, food services, etc. 

At the same time, security (especially authentication & authorization) shouldn’t be pegged as a negative, restraining, frictionful layer. The truth is, they open up new opportunities. Authentication lets marketing teams know their customer better.

For example, rather than spying on consumer habits via questionable techniques such as third-party cookies, let consumers engage with your brand directly by having a successful and rewarding CIAM (consumer identity) program. Rather than preventing users from accessing their medical records on-demand, establish the right access control policies that will grant patients their records. Allow them to delegate access (for minor or senior citizen access. Allow them to share with specialists (for better care) and even other actors in the value chain (insurance companies for instance). This generates new scenarios such as insurance company incentives to patients for good health or behavior.

The region where I live prohibits the electronic transfer of medical records (electronic being email). Everything must be faxed from provider to provider. This leads to a poor experience. Let’s revisit this with the right controls in place, the right policies, and the right level of visibility. Everyone will benefit; from providers to customers.

When we elevate security (and authorization) to the place it needs to be, it will attract the right level of funding and will allow CISOs to build the teams they need. Organizations like IDPro are here to build a workforce passionate about Identity & Access Management. Standards bodies such as FIDO or OpenID are here to perpetuate research, innovation, and interoperability. These standards (whether technical or best practices) are here to help each one of us achieve operational excellence.

TL;DR; the never-ending story

Security issues aren’t going away. New technologies and innovations will always bring about a host of concerns. Adopting the right mindset though will help build the next generation of architects, developers, and practitioners who put security first, not out of fear alone but because there is tangible business value. This goes through standards and collaborative innovation.

At Axiomatics, I’m proud to say we’ve always put both first. We are passionate about authorization. To borrow from Delta Airlines (the first airline I ever flew as an 8-year old), we love to secure and it shows.