Gathid has debuted its patented Identity Model. It claims that this sets a new identity and access governance standard. It is built on a directed graph model. The company says this means it can deliver a secure, scalable identity in days, not months.
Peter Hill, Founder and CEO of Gathid, said, “While deploying our physical access security products for some of the world’s largest companies, including five of the Fortune 500’s top 50 companies, we saw firsthand how much identity debt most organizations carry.
“We realized organizations that are not as mature as these industry giants didn’t have the resources to effectively identify who has access to what and – more importantly – whether they should have access at all. This inspired us to invent a solution that helps organizations strengthen access management without completely overhauling their people, processes, physical infrastructure, and technology.”
How is Gathid redefining the IAM problem?
One of the biggest challenges in Identity & Access Management (IAM) is visibility. Talk about access control and most people think about individual and group access. Yet, these make up an ever-decreasing percentage of the objects that have access and permissions inside our organisations.
What Gathid is doing comes from its name – Gath(ered) id(entities). It identifies everything from individuals to groups, software, machines, printers, scanners, cameras, IoT, services accounts, and basically any object with rights and access inside an environment. Just identifying them is nothing new. Most directory service solutions, such as Active Directory, already do that.
Gathid differs in how it enumerates and articulates what each of those objects has access to and how they relate to each other. It does that through graph database technology, using what it calls a directed graph model. The model is not just simple to deploy but incredibly fast when it comes to identifying connections.
Importantly, it is also scalable. It is not something that is necessarily simple with graph technology. As an organisation grows, so does its complexity. Objects will have access to other objects and often inherit rights, access and permissions from them.
Tracing why an object, be that a person or otherwise, has access to something due to its interaction with groups and other objects has always been a major challenge. Gathid claims that is no longer the case. It means that when access to something is removed from an individual, for example, you can see its impact. It removes, or at least severely mitigates, the risk of a user losing access to something critical to their job.
What benefits is Gathid claiming?
Gathid has listed a number of key benefits for its directed identity model. They include:
- Identity graph technology: Gathid’s patented approach creates a daily identity graph model. Enabling the constructed representation of virtual data relationships between identities and access rights to systems. This provides a comprehensive and holistic view of the entire enterprise identity landscape.
- Rapid deployment: Gathid offers a streamlined, easy-to-deploy solution that receives and models data from digital, operational technology (OT). And physical access control systems (PACS) without requiring admin rights or complex bi-directional integration. Gathid delivers immediate insights and ROI, unlike the traditional approach of integrating all the disparate systems together. Which can take months or years to design and implement.
- Affordable insight for every system: Gathid bridges the accessibility gap in identity governance. Offering scalable solutions tailored for organizations of all sizes. It can analyze role-based access and role mining for any system. Including legacy, air-gapped, or specialized systems, without the high costs of traditional approaches, which often include large consulting projects.
- Toxic role combination alerts: Gathid’s advanced algorithms can analyze data across diverse technologies and detect instances where identities have risky access privileges that violate security and compliance policies. This allows organizations to identify and rectify toxic role combinations, creating a meaningful and accurate identity overview.
- Incident memory: Gathid empowers incident response with a historical record of identity security alterations, allowing for a detailed review of access rights changes before, during, and after an incident. It can also provide alerts and recommendations for mitigating and preventing future incidents.
- Compatibility: The Gathid platform is completely independent of existing enterprise applications and can receive simple identity-related data from all systems, either manually or automatically. Gathid does not attempt to maintain concurrency of its identity model, simply receiving daily identity data to form its daily identity graph model and then archiving the model the following day when a new model will be created from fresh data feeds.
Enterprise Times: What does this mean?
Access permission bloat is a thing. Stay at a company for any length of time and hold more than one role, and you will see your permissions increase. When people change roles, they are left with access for a period of time to facilitate handover. However, they are then rarely stripped of those accesses.
One reason is that people forget to take them away. The other is that often, nobody has a clue what accesses are really required for a particular role. It leads to people having rights and permissions they don’t need. When they are compromised, it makes it easy for cybercriminals to access other parts of the business.
The ability to see what a person has is a major step forward in IAM. However, it assumes that organisations are willing to use Gathid’s solution and invest in acting on what it shows.
Even more important is that this goes beyond people. It deals with every object that has access to an organisation. While there are solutions out there that already give greater visibility to the interconnectedness of objects, Gathid has gone further.
It will be interesting to see how quickly Gathid moves to provide case studies to show the impact of its technology. If it can engage security teams and show them what it offers, then there is a place for it in their tools. From an incident management and forensic analysis of an attack, it could be invaluable.
