Best Practices for Identity Security

Identity Security Best Practices

The following best practices are crucial in fostering strong identity security:

Use multi-factor authentication wherever possible

Typically, users are asked for a username and password in order to login into their accounts. With multi-factor authentication (MFA), a user must give two or more verification factors in order to access a resource, such as an application or user account, which lessens the chance that a cyberattack will be successful.

Monitor privileged account access

Knowing who is logging into what account, and accessing what resources in your IT environment is a crucial step in identity security. This is particularly challenging when your IT resources are dispersed across numerous platforms, including both on-premise and cloud-based environments. You will need a data-centric auditing solution that can aggregate and correlate event data from a wide range of sources, and identify and respond to anomalous privileged account access in real-time.

Detect and manage inactive user accounts

Accounts for users and computers in Active Directory may become inactive for a variety of reasons, such as prolonged leaves or staff departures from your organization. Your network can be protected from insider threats by disabling/deleting unneeded or outdated user and computer accounts. There are numerous Active Directory cleanup solutions that can automatically detect and manage inactive accounts in AD.

Use secure data communication methods

You want to make sure that communication is done securely when identities are transferred over internal and external networks. There are many ways to do this, but SSL encryption is the most popular. Mutual TLS is a more secure option, although its implementation is more challenging since a certificate is required each time the identity provider needs access to a resource. Likewise, in order to securely communicate with on-premise directory systems like Active Directory, remote users frequently use a VPN.

Train your staff on identity protection

Training your end users is a crucial component of identity security. Almost all end users are well-intentioned, however, despite their best efforts, they are often unsure about what to do to protect their identities. Ongoing training sessions on identity protection should be offered by your company to ensure that employees know what they have to do, and why.

Use unique, long, and complex passwords

Employees frequently use the same passwords on their personal and professional accounts. Even though your IT department may be devoted to maintaining a robust identity security strategy, a compromised consumer site may result in an adversary gaining access to your corporate network.

Any account your employees have, whether it be personal or professional, needs to have a unique password. To ease their burden, encourage them to use a password manager. Passwords also need to be sufficiently long and complex to make them harder to crack. Again, employees can use a password manager to help them create and store a secure password if they are not able to think of one themselves.

Use SSH keys wherever possible

SSH keys are similar to usernames and passwords, although they are primarily used by automated processes and for implementing single sign-on functionality. It is generally a good idea to use SSH keys when accessing your company’s critical infrastructure, especially when using cloud-based services. While it would be great if you could use SSH keys to access all systems, it would be practically difficult to implement as your IT team would be required to store, share, manage and maintain the SSH keys for all systems. That said, many cloud service providers offer SSH key management utilities to simplify the process.

Secure your legacy systems

You should ensure that internal systems like Active Directory and OpenLDAP have several layers of protection. In particular, for on-premise, legacy directory services, make sure the system is protected by a variety of cutting-edge intrusion detection/prevention technologies and is located behind your firewall. As always, any sensitive data you store should be encrypted, both at rest and in transit.

How Lepide Helps Improve Identity Security

Lepide can help organizations improve identity security in a number of ways, including

• Auditing and reporting: Lepide enables auditing and reporting on user activity, which can help companies identify and respond to potential security threats or breaches. Lepide Auditor can provide real-time visibility into user actions and can alert administrators to suspicious activity or potential threats.
• Access control: Lepide can help companies control and monitor user access to company resources and data. This can help prevent unauthorized access or misuse of sensitive information and can alert administrators to potential threats.
• Threat detection and response: Lepide’s solutions can include features for detecting and responding to potential security threats, such as malware or ransomware attacks. These features can alert administrators to potential threats and provide tools for responding to and mitigating the impact of the threat.
• Reducing the threat surface: Lepide can detect inactive users, open shares, stale data, and other areas of risk that administrators can address. Archiving stale data, cleaning up inactive users, and removing open shares can all help to limit the threat surface.

If you’d like to see how Lepide can help prevent identify breaches, schedule a demo with one of our engineers.