Identity And Access The New Perimeter
Sanjay Vaid is an accomplished professional and expert in Cyber Security & Risk, he works as Regional Director at HCL Technologies, for more information about Sanjay and his work list www.sanjayvaid.com
Why is Identity so Important? Identity forms the basis of authorisation and Trust. (NIST Publication 800-103)
Today companies have data residing on-premise as well on the cloud, the access to the data is also via multiple sources like laptop, smartphones, tablets, at the same time these accesses are from various locations from out site the company’s office premise. Digital Identity and access hence are the new perimeter for securing companies data and infrastructure. As per a recent report by FireEye 59% of the attack on organisations in 2019 was originated from insiders and that means there is significant focus needed on insider threat and risk-based access for employees and third parties. Various factors need to be considered the user role definition, User life cycle management, application and cloud, Analytical driven reporting. Some important elements in identity & access management are listed as follows:
Role Definition: As a first step to provide identity and access is to define the role. Role mining plays an important role here, followed by data cleansing for identifying orphan accounts or duplicate data within an organisation which might exist. The third step is to then define roles for role-based access, mandatory access, discretionary access and adaptive access to digital resources and application of the organisation.
User life cycle management: An employees would have various phases in the organisation right from joining the organisation, moving to a different role or getting promoted and leaving the organisation. Their identities, privileges and access to organisation digital resources and Application would changes accordingly, and those changes need to made in parallel to the role changes.
Identity and access on Cloud: Now since devices used to access cloud are no longer fixed as it can be a laptop, desktop, tablet or employee BYOD devices as long as the internet and browser are available. Browser-based Application access or mobile-based application becomes essential, and hence gaining granular control on access to digital assets, intellectual property and controls is the new challenge. Hence embedding security within the browser will help in better visibility and availability, especially in bring your own devices (BYOD) scenarios. In the case of cloud access managed and audited via the browser, the company can get security over the devices employees and third party use.
Password Security/MFA: As there is an increase in number application accessed via browsers, there is a rise in issues with password security. There have been numerous password database breaches over the years for various companies and which is a risk to the digital assets of the companies. A weak password, brute force attacks can be some of the reasons for password breaches. The implication of password database breaches can be far-reaching, leading to regulatory, financial and reputation loss for companies. This brings us to using Multifactor authentication for cloud-based application as the user is required to have an additional layer of authentication beyond the password.
Single Sign-On (SSO): In order to avoid multiple username & passwords and multiple Sign-in into the different system by users and admin single, sign-on -SSO is introduced. Multiple user names and password is the genesis of credential/password theft. Single Sign On as the name suggests is designed to permit the user to authenticate through an authentication authority and access the protected resources without having to reauthenticating. Kerberos, SESAME, Kryptoknight are some of the cryptology using Public and private keys used for confidentiality, integrity and authentication that can implement Single Sign On (SSO).
Risk-based adaptive access: Employees today have a digital life and access outside the organisation as they have inside the organisation and this exposes companies to potential social engineering attacks. Hence the risk scoring based on threat, intel needs to aligned to employees access which can be elevated and degraded from time to time basis on the risk scope and need have access based on the principle of least privilege can be provided to users.
Identity & Access Management during the time of COVID: COVID 19 has lead to remote working, making identity and access management much more compelling need for the organisation. They are defining the identity and access for employees and third part, authentication of access most vital for an organisation to secure their digital assets and data. Identity as the new perimeter truly comes in to play during COVID 19 and is the right time organisation to implement or enhance their IAM programs.
NIST Publications: National Institute of Standard has come up with various publications that can be used for guidance in the IAM program and these include NIST SP 800-2 ´Identity and access management for electric Utilities´, NIST SP 800–210 ‘Access Control for Cloud’, NIST SP 800-53, NIST SP 800-63, NIST SP 1800-13, NIST SP 1800–3B, NIST SP 800-162, FIPS 201. These publication provide a framework and process for identity and access management.
Conclusion: The requirements and use cases for Identity access management are beyond what been listed in the article. Cloud has made possible collaboration between teams like Microsoft teams, one drive, google drive, dropbox, but this brings its own risk as well in terms of threat to companies intellectual property been shared which requires granting rights in term of sharing and editing that needs to be defined for confidentiality and integrity of data. Furthermore, identity and access management need to be introduced to mitigate such risk. Similarly with increased adoption and remote access of IoT- Internet of things and OT – Operational Technology there are various multiple applications and control that can be accessed in plants and access management, control and authentication needs to be introduced. There are many more use case, including identity-based encryption which are primarily used in emails security. Organisations can enhance the utilisation of identity and access management and leverage its full potential in their programs and spread the adoption in various areas Benefits in term of Security, operational excellence, safety in term of specific industries like ENU-Energy Oil and Gas, Pharma and Manufacturing and Compliance can yield companies exponential return on investment
Do you want to unlock the full potential of your Poco F1? Here is How to Root Xiaomi POCO F1: Complete Guide to use Magisk.
Michigan business owners have been given relief aimed at keeping physical locations open. The state has made it easy to start new businesses, and has made it incredibly apparent that it will support small and emerging enterprises.
Have you been planning for a feature-packed mid-range smartphone? Here is Motorola E7 Plus available at INR 9,499. Click for Specifications & features.
Here is the list of best Rabb.it alternatives you must try today. You can choose any alternative to continue your entertainment from anywhere you are.
Audible audiobooks can be expensive sometimes, but you have the option to listen to your favorite audiobook with an audible alternative. Choose your option today.
Are you enjoying games with the versatile Anne Pro 2 Keyboard? Here is a complete guide about Anne Pro 2 Software, How to set up and fix not working issues.