Privileged accounts are frequently targeted by cybercriminals. They typically try to gain access to a privileged account either by brute-force-guessing the account password or by obtaining credentials via some sort of phishing/social engineering attack. Once an attacker gains access to a privileged account, they can do a lot of damage, which includes elevating their privileges to gain even more access. As they say, “hackers don’t break in, they log in”, hence why securing identities should be a top priority for all organizations that process sensitive personal data.
Identity security refers to a set of principles, processes, and technologies, that are used to ensure that entities on a given network are who they claim to be. It is also about deciding what resources they are allowed access to, and how those resources can be accessed and used. Identity security is achieved through Identity Access Management (IAM), which is described in more detail below.
What are the main components of Identity Access Management (IAM)?
There are three main components of IAM, which include authentication, authorization, and monitoring. However, we should also include security awareness training for good measure.
Authentication
The purpose of authentication is to ensure that users are who they say they are. A ‘user’ can also be a service account, IoT device, or any other entity that requires its own identity. At the very least, companies should have a strong password policy. However, multi-factor authentication (MFA) should be used whenever possible. MFA requires additional methods of verification, including something you have, or something you know. This might include a passcode sent to your mobile device, a fingerprint scan, a hardware dongle, or some other method of verification.
Authorization
Once a user has successfully authenticated themselves to the network, access controls are used to determine what level of access the user should have. All methods of authorization should strictly adhere to the Principal of Least Privilege (PoLP), which stipulates that users are granted the least amount of privileges they need to perform their role. Of course, organizations must carefully balance security with usability.
Monitoring
Setting up MFA and robust access controls are only the start. You must also ensure that you continuously monitor access to privileged accounts, changes to access controls, and any other relevant user activities. You should use a real-time auditing solution that uses algorithms to learn typical patterns of behavior, which can be tested in order to detect and respond to anomalous events.
Security Awareness Training
Given that phishing and other social engineering attacks rely on tricking unsuspecting employees into handing over credentials, it is crucially important that all employees are sufficiently trained to identify suspicious emails, websites, SMS messages, and phone calls, etc. Likewise, they must be vigilant when it comes to password management. For example, employees mustn’t reuse passwords, use easy-to-guess passwords, or write their password on a post-it note and stick it to their monitor.
What are the benefits of Identity Security?
As you would expect, the main benefit of identity security is to protect sensitive data, whether customer information, employee information, trade secrets, payment information, and so on. However, there are other related benefits that are worth noting.
Compliance
Identity security is also necessary to comply with the data privacy laws that are relevant to your organization, whether GDPR, HIPAA, SOX, PCI-DSS, and so on. For example, under the GDPR, organizations that process personal information belonging to EU citizens are required to take any steps necessary to prevent unauthorized access to their information, and such measures must be demonstrated to the supervisory authorities. A failure to do so could result in hefty fines or lawsuits.
Future-proofing
Another notable benefit of identity security is that it is a relatively future-proof method of securing data. Over recent years, we’ve seen a shift in the way employees are accessing company assets. For example, due to a variety of factors, increasingly more employees are working remotely, and increasingly more companies are switching to cloud-based services. And, it’s likely that this trend will continue for the foreseeable future. In this scenario, the traditional moat/castle approach to securing sensitive data is rendered somewhat obsolete, and the focus is shifting towards a more user/data-centric model, or in other words, identity security is becoming a lot more important.
If you’d like to see how the Lepide Data Security Platform can help you develop, improve or maintain your identity security strategy, schedule a demo with one of our engineers today.