Rethinking Access Control
Breaches and threats are happening at a fast and furious pace
- By Jeff Capone
- Dec 01, 2018
When it comes to access control, it all boils down
to companies trying to determine whether you
are who you say you are, and whether you are
authorized to access certain information. As we
all know, both those are tall orders to fill.
Identities are becoming more complex for organizations to sort out,
given the different types of stakeholders, such as customers, employees,
partners and different types of devices looking for access. Regulations,
such as recent the recent GDPR, reduce access to the ICANN Whois
database, which identifies who owns registered domains. This will
make it more difficult for security professionals to determine whether a
breach has occurred and if so, where it comes from.
There is no doubt that our world has been changing rapidly and it
seems like we are being attacked everywhere—in government and politics,
in business and at home. The breaches and threats are happening
at a fast and furious rate and becoming more complex and insidious. A
recent study from The Information Commission (ICO) found that data
breaches were up 75 percent in the past two years. And, according to an
interview in Tech Republic, IBM Security Vice President Caleb Barlow
said about 200,000 security-type events happen daily at a typical midsized
company. While some of these might be small and inconsequential,
that still is a staggering number to have to address.
Don’t Let Old Thinking
Make You Vulnerable
Old methods of access control are no longer enough keep us safe. Traditionally,
we relied on firewalls and other perimeter-based solutions
as a first line of defense to try keeping confidential information secure,
and we focused on external threats. That, however, is no longer a valid
approach, based on the realities of today’s brave new world:
- The perimeter can’t keep you safe. The proliferation of BYOD,
cloud-based apps and collaborative software has changed enterprise
computing, mostly in positive ways, but they have also made
security much more challenging. In addition to firewalls, Unified
Threat Management (UFM) platforms and Identify Management
& Access Control are also less effective.
- The threats are coming from everywhere and can come from anywhere.
While most companies are focusing on external threats, 43
percent of data breaches are caused internally, according to an
Intel survey. In addition to intentional breaches from disgruntled
employees, there can be accidental breaches that could occur from
sharing documents or information, or devices that have been
hacked or otherwise compromised.
New Technologies Bring New Threats
It is only expected to get worse. AI and machine learning solutions,
while aiding in the identification of attacks, may also be adding to the
problem. Hackers can take advantage of these advanced solutions to
develop more sophisticated attacks.
IoT devices—which will become ubiquitous and are easy to penetrate—
are posing new risks. New malware cocktails are developing a
combination of potent threats. It’s inevitable that as technology continues
to evolve, so too do the opportunities for hackers to improve
their attacks. The challenge remains to find ways to stay one step
ahead of them.
Implement Best Practices
One way is to implement better access control methods. It’s most
effective to rely on one source of access control authentication. If
you overlay another access control layer, which has to be managed
separately from IT central file server, the chances of mis-match permissions
or lagging change control increases tremendously. Instead,
use your existing access control, such as the Active Directory, for all
your applications, including CRM, collaborative software and cloud
access security brokers (CASB).
At the same time, implement SIEM, which logs all activity for auditing,
reporting, and automated orchestration. A SIEM can create
an alert based on suspicious behavior which automatically launches
orchestration activities, and together, SIEM and an orchestration solution,
can look for suspicious activity automatically, disable devices,
or run full anti-virus scans on a suspicious device.
Expand Your Cybersecurity Viewpoint
Another way to strengthen your protection is to look beyond access
control and incorporate other approaches as well. With breaches at
firms like Equifax, which are supposed to protect our identity and
data, it’s clear that we’re in a zero trust world where you can’t trust
any source or count on anything to be safe. In this environment, it’s
virtually impossible to try to stop every single attack from coming in
or to accurately determine everyone’s identity.
So, what can companies do? Instead of solely focusing on verifying
identities, also focus on securing the data—no matter where it is
and no matter where it goes.
That requires encryption all the time, at rest, in use and in transit—
whichever format the data takes—Word document, PDF, etc.
That will protect you against vulnerabilities you may not even be
aware of. For example, when you edit a Microsoft document, you
could be at risk since vulnerability in Microsoft Windows temporary
“tmp” files leaves them unprotected.
Traditional data protection solutions have all been opt-in. Users
had to decide what to protect. Even diligent users make mistakes and
what seems innocent data today could become sensitive tomorrow.
To be most effective, encryption should be opt-out and automatic—
that way you can be assured that is always protecting the data. It also
is important that it is transparent to the end users, so they won’t try
to disable or go around it.
If the security follows the data everywhere, it will also cover derivative
work. It’s often hard to contain data, which like a cold virus can
easily spread everywhere. It’s too easy, for example, for someone to
copy a part of a confidential document and re-purpose it or share it
somewhere else. By encrypting the data itself, no matter where it travels,
you are sure it is secure and you no longer have to worry about
tracking where it spreads.
It is a rough and tumble world out there and
cybersecurity is being challenged by new and stronger
threats every day. By implementing access control
best practices to manage identities and access
and data encryption, you will have strong weapons
in your arsenal to fight cyber threats.
This article originally appeared in the November/December 2018 issue of Security Today.