Topic starter
08/06/2026 4:09 pm
TL;DR: Remote work, MFA adoption, cyberattacks and regulatory pressure shaped 2020, according to Axiad, while SolarWinds and FireEye showed how persistent compromise can escalate across agencies and enterprises. The bigger lesson is that authentication controls alone do not close identity attack surface when access, device trust and lifecycle governance lag behind.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “The Major Cybersecurity Themes of 2020”.
Key questions
Q: What breaks when MFA is treated as the whole identity strategy for remote work?
A: MFA reduces credential theft risk, but it does not fix weak recovery processes, unmanaged devices or user bypass behaviour.
Q: Why do temporary passwords increase identity risk?
A: Temporary passwords increase risk because they shift trust away from the primary authentication process and toward a weaker recovery channel, often email or help desk handling.
Q: How do security teams know whether zero-trust remote access is actually working in practice?
A: Security teams should look for evidence that users only reach approved resources, sessions are brokered through controlled gateways, and access decisions are enforced consistently across cloud and on-prem systems.
Practitioner guidance
- Harden remote access recovery paths Remove ad hoc temporary-password workflows and replace them with controlled recovery processes that verify the device, the user and the reason for access before credentials are issued.
- Enforce MFA across all access paths Apply MFA consistently to remote access, privileged workflows and regulated transactions so users cannot bypass stronger controls through exceptions or legacy login paths.
- Verify device trust before granting access Require a defined device policy for remote workers and block access when posture, ownership or supportability cannot be established.
Bottom line: 2020 showed that remote work can outpace identity controls faster than policy teams expect, especially when access support processes remain informal.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/06/2026 5:38 pm
Authentication is not identity governance: 2020 showed that MFA can raise assurance while leaving the access model untouched. Remote work forced organisations to rely on temporary passwords, remote support and user-driven recovery paths that still expose the identity plane. The lesson is that login security and access governance are different problems, and treating them as the same creates blind spots. Practitioners should separate authentication strength from lifecycle and access assurance.
A question worth separating out:
Q: What frameworks matter most for utility identity governance and compliance?
A: NERC CIP is central for utility compliance, and identity controls should also align with the NIST Cybersecurity Framework 2.0 for governance, access control, and continuous improvement. The practical test is whether the programme can demonstrate least-privilege access, prompt removal, and auditable decision trails across the full estate.
👉 Read our full editorial: 2020 cybersecurity trends exposed identity gaps in remote work
This post was modified 4 days ago by NHI Mgmt Group