Identity and access
The wall and the moat are still standing, and you need them. The network, however, is no longer the border. Identity is, and that calls for a different kind of examination. Identara assesses who can reach your systems, why it was set up that way, and whether it is still defensible.
Why this matters now
For a long time an IT environment was much like a castle. One wall, a moat, a handful of guarded gates. Anyone already inside was trusted. That approach was right, for that landscape.
Today the castles are all connected. Cloud, remote working, suppliers, customer portals, devices logging in from anywhere. Every connection is another gate, and by no means all of those gates stand on your own ground.
What remains as the border is identity. The attacker forces nothing, he logs in. With a stolen password, a phishing email that worked, or the account of a former employee who left long ago. No alarm goes off, because the system does exactly what it was built to do.
The questions we ask
Who has access to what, people and technical accounts alike, and is that access still needed today?
Who granted those rights, on what grounds, and when was that last reviewed?
Can one person complete an entire transaction alone, or is segregation of duties demonstrable?
What happens to the access of an employee, a supplier or an administrator who leaves?
What sets us apart
A penetration test shows that someone can get in. Usually the story stops there. We follow the chain further, because it is only after that first access that it gets expensive.
We test the front door and assess the set of keys, and deliver one account of it rather than two separate reports.
How we look at your environment
As long as nobody has an overview of rights, any judgement about risk is a guess.
Access that was once justified rarely still is after a reorganisation or a departure.
A control you cannot evidence does not exist as far as an auditor or regulator is concerned.
Tooling finds anomalies. Whether something is a problem depends on what your organisation does.
What we deliver
Most organisations start with a test, because that shows the quickest where they stand. Identara sets the scope, assesses identity and access, and brings in the specialist who is strongest at each part. You have one point of contact, and the scope is fixed in advance.
Can someone get in, and how far do they get?
A controlled attack on network, systems or web applications, following international standards including the OWASP Top 10. From outside without prior knowledge, or from inside with a user account.
Where are the weak spots, and which ones are genuinely dangerous?
An inventory across the full landscape, not only the systems already in view. Automated scanning followed by manual verification, so the false positives are removed.
Who has access to what, and is that still right?
Employees, customers, suppliers and administrators come in via the office, from home, through cloud and portals, each combination with its own rights. We walk through them all, including accounts of departed staff, excessive rights, forgotten administrative access and the test on segregation of duties.
How resilient are the people, not just the systems?
Simulated phishing emails, tailored to your organisation and language, measured per department. Optionally a physical access test. Follow-up with targeted training rather than a generic course.
Can you demonstrate that it is in order?
Translating requirements into concrete controls, for ISO 27001, NIST and the information security provisions of the Central Bank of Curaçao and Sint Maarten. An assessment of access management and segregation of duties in the light of supervision, and the evidence an auditor wants to see.
A report changes nothing, carrying it out does.
Translating findings into a plan that fits your size and budget. Independent advice when choosing a platform, we sell no licences. Guidance for your own people or for the party doing the implementation.
Approach
A defined scope, a fixed price and no open ending. You know in advance what you get, when you get it and what it costs.
A one-hour scoping call, then the examination within the agreed boundaries. Serious findings reach you while the work is running, not only in the report.
Not everything can happen at once. Findings are weighed on what they could genuinely cost your organisation, not on a default score from a scanner. You receive an explanation for the board and a separate technical annex for IT.
A plan with owners and deadlines. You carry it out yourself or with your own supplier, we guide the work and make sure it holds up.
A repeat measurement shows that the improvement is genuinely there. That is exactly what an auditor or a supply chain partner wants to see from you.
About Identara
Identara does one thing: assess who has access to what, and whether that is still defensible. Behind the brand stands Dave Vijzelman, over twenty years in identity and access management at large organisations in the Netherlands and Belgium, in healthcare, energy, financial services, education and utilities.
The approach is vendor-neutral. Identara sells no licences and does not implement. Product knowledge runs deep enough to see through the differences between platforms, and that is exactly what makes an independent judgement usable. What one vendor calls a role is something else at the next one.
Identara is your contracting party. We set the scope together with you, oversee the work and deliver the report.
For each part we bring in the specialist who is strongest at it, with certified testers for the offensive work, under contract with us.
You know in advance who comes onto your systems. One point of contact, one report, no separate suppliers for you to manage.
No licence sales, no implementation, no management. That keeps the judgement free of any interest in the outcome.
Contact
No obligation, and it gives you a concrete proposal at a fixed price. No commitment to continue afterwards.
