Protecting privileged access is a prerequisite for minimizing damage–CyberArk’s 2021 Business Strategy

CyberArk Software explained its business strategy to the press on March 24th. At the same time, the case of Seven & i Group as a company that introduced it in Japan was also introduced. First, Mr. Kiminori Tomoda, President and Executive Officer of CyberArk Software, introduced the company’s business as “a pioneer in the industry that was founded in Israel in 1999 and pioneered the field of’privileged access management’.” It is said that the product is used by more than 6,600 companies worldwide.

Mr. Kiminori Tomoda, President and Executive Officer of CyberArk Software The Japanese corporation was established in 2014, “there is still a lot of name recognition in Japan” (Mr. Tomoda), but in addition to Seven & i Holdings, which was introduced as a domestic case. It also has about 70 domestic customers, mainly large companies such as major domestic financial institutions and automobile companies. The company’s solutions are mainly used by large companies. “If you look at the world’s top 25 companies in the industry responsible for social infrastructure, which is said to have large-scale IT infrastructure and the strictest security requirements, about 7 to 7 in each industry. Eighty percent of companies are protecting privileged access with CyberArk’s solution. ” On the business side, in 2020, it shifted from a sold-out perpetual license-centered business model to a subscription-type business that is expected to generate continuous income. As a result, “Although the increase in sales declined, the base of future regular income expanded. The temporary decrease in revenue due to the transition to the subscription model was about $ 45 million, and the annual growth took into account this. The rate will be about 25% “(Mr. Tomoda). Regarding the domestic market, Mr. Tomoda said, “Based on 2018, we have achieved about 7 times in 2019 and about 10 times in 2020, and the sales of Japanese corporations are increasing significantly.” The reasons are that “many companies are shifting to a multi-cloud environment due to the promotion of digital transformation (DX)”, “accidents of unauthorized access are increasing”, and “remote work is common as a countermeasure against the new coronavirus”. It is said that the number of companies that are trying to firmly build a cross-organizational privileged access infrastructure as one of the security measures has increased, driven by such things as “becoming”. “We recognize that the development / expansion of privileged access infrastructure at major domestic companies is still in its infancy, and many companies will introduce it in the future,” said Tomoda. He reiterated the importance of the “privileged access management” provided by the company. Currently, due to the influence of the new coronavirus infection, it is becoming necessary to access various IT assets including the cloud from a remote environment such as home, and security issues are becoming more serious. The idea of ​​creating a solid boundary on the premise of conventional on-premises and defending it is not enough, and “the cloud side needs to manage a huge number of IDs / roles, which makes management difficult. As a new security architecture, with the addition of circumstances such as “the degree has risen dramatically” and “because of the progress of automation, so-called” Machine IDs “used by applications instead of humans are distributed in large numbers”. Attention is focused on the “zero trust concept centered on identity (ID)”. And when ID is the new boundary, two major layers are needed to protect the IT assets of the organization. One is the “general access layer” that functions as an authentication platform for general users to access the system, and the other is general users such as system administrator privileges and access privileges to databases that store a large amount of confidential information. It is a “privileged access layer” when using “privileges” that have stronger authority.

Two layers of identity management. The deprivation of privileged access rights leads to large-scale information leaks in corporate IT systems. “The privileged access layer exists closest to the company’s digital assets, and this layer becomes the” last bastion of corporate IT. ” If this is breached or misused, it will directly lead to a large-scale security incident, “said Tomoda, emphasizing the importance of protection.” Protect privileged access in security measures that assume intrusion. That is an essential condition to minimize the damage. ”

Even in the intensifying cybercrime, attackers first make full use of various attack methods with the main purpose of stealing privileged IDs. Nowadays, it is said that it is not so difficult for an attacker to invade the inside of a corporate network, and it is required to build a system that can protect the privileged ID even if it is invaded inside. It has been repeatedly pointed out that it is important to protect privileged user IDs (known as root, admin, superuser, etc.) such as, but now it is not only the server alone, but also middleware, databases, networks, etc. on the cloud. The range to be managed, such as various environments in the cloud, is expanding significantly.

The scope of the privileged access management platform has expanded significantly due to the impact of the cloud shift. The company’s solution has realized a “privileged access platform” that can centrally manage these various targets. On the other hand, if the system scale and the number of IDs are not large, it is difficult to realize the effect, so the business has been developed mainly by large companies (top 100 companies by sales). However, in the future, as a new focus area, it will strengthen its response to major companies (top 101-300 companies by sales) through a collaboration model with partners.

The company’s efforts to further expand the Japanese market Next, Mr. Seigo Kawamura, Senior Officer, IT Infrastructure Department, Seven & i Holdings, introduced the process of introducing the CyberArk solution. The Seven & i Group develops a wide variety of seven businesses, including domestic / overseas convenience store business, superstore business, department store business, specialty store business and financial-related business, and has a large number of brands and a wide customer base. It is said that the Group DX Strategy Headquarters has been set up to consolidate human resources and resources to build a common infrastructure in response to the issues of diversification of expertise and inefficient IT costs of each business company. As part of this, CyberArk was selected / introduced as a privileged access management platform to control all accounts, permissions, and operation logs in the cloud and on-premises. The reasons for selection are that “the functions can be managed centrally, so the cost is superior to installing multiple solutions”, “the ability to acquire audit logs such as detailed audit logs and video recording functions”, and “it can be realized even in multi-cloud”. Was mentioned. Regarding the effect of the introduction, “CyberArk’s automatic management function has built an efficient operation mechanism” and “we were able to lay the foundation for a common service platform for all group companies.”