Providing access for the right people, to the right resources, at the right time starts with a well-structured identity and access management or IAM strategy; block everything else.
Identity access management or IAM defined relies on a three-step process whereby access to any resource, physical or logical, is granted only to the subject (user, program, or process) that successfully traverses each security level.
Authentication is the second step in verifying the identification. The increase in cyber-attacks resulting in data theft, reputational damage, etc. drives the need to improve authentication. While in the past, authentication was a password (something you know) and kept your data safe, a modern multi-layered approach is required to reduce your risk. The implementation and use of two and three-factor authentication, also known as multi-factor authentication (something you have), is rising and is used by entities of all sizes as a step to level the playing field against cyber threats.
Authorization is the final step and grants the subject access, controls, and privileges based on the configured identity. Authorization is where things go wrong, such as a misconfiguration or poor execution, leading to many vulnerabilities. To mitigate these risks, always plan and define systems with the least privilege principle, avoiding vulnerabilities resulting from authorization creep and credential sharing.[/wgl_custom_text][wgl_spacing spacer_size=”30px”]
Like the firm foundation of a house, a sound, well planned and implemented IAM strategy will ensure that everything you build on and around your business is with security in mind from the beginning. A sound IAM strategy enables organizations to keep their DAAS secure. DAAS or Data, Applications, Assets, and Services represent the organization’s key areas that you are trying to protect.
The use of a good IAM will help with the many compliance requirements that your organization faces, giving you the tools to help secure your organization’s data. From the beginning of bring your own device or BYOD and before, compliance now more than ever is a crucial piece of the puzzle. Aside from the ever-increasing cyber threat landscape, BYOD and big data, the regulation factor on user account management and storage is under the microscope.
The General Data Protection Regulation (GDPR) – online account privacy and rules of management storage and data breach notification, Sarbanes-Oxley Act (SOX) – financial regulations on corporate disclosure including an IT component dictating how financial data shall be stored, Health Insurance Portability and Accountability Act (HIPPA) – legislation around patient records are stored, managed and transferred, and finally International Standards Organization or ISO 27001 on information security management systems, setting a framework on information security with the support of controls, are just a few of the regulations that your organization is facing or will face going forward.[/wgl_custom_text]
[/wgl_custom_text]
The 2019 Verizon Data Breach Investigation Report, maintains that 80% of the time compromised breaches involve weak credentials. Overall, 29% of all breaches (regardless of the type of attack) involve using stolen credentials.
The 2019 MidYear QuickView Data Breach Report from Risk Based Security maintains that over 4.1 bn records were exposed within the first two quarters of 2019. This is estimated to be a 54% increase year on year.
Recently in the 2020 Twitter incident,
ARS Technica reported…[/wgl_custom_text]
“With the confidence of the targeted employees, the attackers directed them to a phishing page that mimicked an internal Twitter VPN. The attackers then obtained credentials as the targeted employees entered them. To bypass two-factor authentication protections Twitter has in place, the attackers entered the credentials into the real Twitter VPN portal within seconds of the employees entering their info into the fake one. Once the employee entered the one-time password, the attackers were in.”
It is crucial to understand that cyber threats of all shapes and sizes affect all companies and individuals. You are a target. Ensuring that you have adequate security layers in your organization and a sound identity and access management strategy can mitigate many of your organization’s risks.[/wgl_custom_text]
Looking for guidance on the right IAM solution for your organization? Contact us, and we can get you started right away. You’ll work with leaders in the industry, focused on solving your unique issues. With the right partner, you can rest assured knowing your company has the right foundation for security and is geared for growth.[/wgl_custom_text][wgl_spacing spacer_size=”34px”]
