Rethinking Access Control

Breaches and threats are happening at a fast and furious pace

When it comes to access control, it all boils down to companies trying to determine whether you are who you say you are, and whether you are authorized to access certain information. As we all know, both those are tall orders to fill. Identities are becoming more complex for organizations to sort out, given the different types of stakeholders, such as customers, employees, partners and different types of devices looking for access. Regulations, such as recent the recent GDPR, reduce access to the ICANN Whois database, which identifies who owns registered domains. This will make it more difficult for security professionals to determine whether a breach has occurred and if so, where it comes from.

There is no doubt that our world has been changing rapidly and it seems like we are being attacked everywhere—in government and politics, in business and at home. The breaches and threats are happening at a fast and furious rate and becoming more complex and insidious. A recent study from The Information Commission (ICO) found that data breaches were up 75 percent in the past two years. And, according to an interview in Tech Republic, IBM Security Vice President Caleb Barlow said about 200,000 security-type events happen daily at a typical midsized company. While some of these might be small and inconsequential, that still is a staggering number to have to address.

Don’t Let Old Thinking Make You Vulnerable

Old methods of access control are no longer enough keep us safe. Traditionally, we relied on firewalls and other perimeter-based solutions as a first line of defense to try keeping confidential information secure, and we focused on external threats. That, however, is no longer a valid approach, based on the realities of today’s brave new world:

  • The perimeter can’t keep you safe. The proliferation of BYOD, cloud-based apps and collaborative software has changed enterprise computing, mostly in positive ways, but they have also made security much more challenging. In addition to firewalls, Unified Threat Management (UFM) platforms and Identify Management & Access Control are also less effective.
  • The threats are coming from everywhere and can come from anywhere. While most companies are focusing on external threats, 43 percent of data breaches are caused internally, according to an Intel survey. In addition to intentional breaches from disgruntled employees, there can be accidental breaches that could occur from sharing documents or information, or devices that have been hacked or otherwise compromised.

New Technologies Bring New Threats

It is only expected to get worse. AI and machine learning solutions, while aiding in the identification of attacks, may also be adding to the problem. Hackers can take advantage of these advanced solutions to develop more sophisticated attacks.

IoT devices—which will become ubiquitous and are easy to penetrate— are posing new risks. New malware cocktails are developing a combination of potent threats. It’s inevitable that as technology continues to evolve, so too do the opportunities for hackers to improve their attacks. The challenge remains to find ways to stay one step ahead of them.

Implement Best Practices

One way is to implement better access control methods. It’s most effective to rely on one source of access control authentication. If you overlay another access control layer, which has to be managed separately from IT central file server, the chances of mis-match permissions or lagging change control increases tremendously. Instead, use your existing access control, such as the Active Directory, for all your applications, including CRM, collaborative software and cloud access security brokers (CASB).

At the same time, implement SIEM, which logs all activity for auditing, reporting, and automated orchestration. A SIEM can create an alert based on suspicious behavior which automatically launches orchestration activities, and together, SIEM and an orchestration solution, can look for suspicious activity automatically, disable devices, or run full anti-virus scans on a suspicious device.

Expand Your Cybersecurity Viewpoint

Another way to strengthen your protection is to look beyond access control and incorporate other approaches as well. With breaches at firms like Equifax, which are supposed to protect our identity and data, it’s clear that we’re in a zero trust world where you can’t trust any source or count on anything to be safe. In this environment, it’s virtually impossible to try to stop every single attack from coming in or to accurately determine everyone’s identity.

So, what can companies do? Instead of solely focusing on verifying identities, also focus on securing the data—no matter where it is and no matter where it goes.

That requires encryption all the time, at rest, in use and in transit— whichever format the data takes—Word document, PDF, etc. That will protect you against vulnerabilities you may not even be aware of. For example, when you edit a Microsoft document, you could be at risk since vulnerability in Microsoft Windows temporary “tmp” files leaves them unprotected.

Traditional data protection solutions have all been opt-in. Users had to decide what to protect. Even diligent users make mistakes and what seems innocent data today could become sensitive tomorrow. To be most effective, encryption should be opt-out and automatic— that way you can be assured that is always protecting the data. It also is important that it is transparent to the end users, so they won’t try to disable or go around it.

If the security follows the data everywhere, it will also cover derivative work. It’s often hard to contain data, which like a cold virus can easily spread everywhere. It’s too easy, for example, for someone to copy a part of a confidential document and re-purpose it or share it somewhere else. By encrypting the data itself, no matter where it travels, you are sure it is secure and you no longer have to worry about tracking where it spreads.

It is a rough and tumble world out there and cybersecurity is being challenged by new and stronger threats every day. By implementing access control best practices to manage identities and access and data encryption, you will have strong weapons in your arsenal to fight cyber threats.

This article originally appeared in the November/December 2018 issue of Security Today.

Featured

  • Pragmatism, Productivity, and the Push for Accountability in 2025-2026

    Every year, the security industry debates whether artificial intelligence is a disruption, an enabler, or a distraction. By 2025, that conversation matured, where AI became a working dimension in physical identity and access management (PIAM) programs. Observations from 2025 highlight this turning point in AI’s role in access control and define how security leaders are being distinguished based on how they apply it. Read Now

  • Report: Cyber Attackers Continue to Turn to AI-Based Tools to Avoid Detection

    Comcast Business recently released its 2025 Cybersecurity Threat Report, a comprehensive analysis of 34.6 billion cybersecurity events detected between June 1,2024 and May 31, 2025. Now in its third year, the report offers business leaders a unique perspective into the evolving threat landscape and provides actionable insights to help organizations strengthen their defenses and align cybersecurity with business risk. Read Now

  • Axis Communications Creates AI-powered Video Surveillance Orchestra

    What if cameras could not only see the world, but interpret it—and respond like orchestra musicians reading sheet music: instantly, precisely, and in perfect harmony? That’s what global network technology leader Axis Communications set to find out. Read Now

  • Just as Expected

    GSX produced a wonderful tradeshow earlier this week. Monday was surprisingly strong in the morning, and the afternoon wasn’t bad at all. That’s Monday’s results and asking attendees to travel on Sunday. Just a quick hint, no one wants to give up their weekend to travel and set up an exhibit booth. I’m just saying. Read Now

    • Industry Events
    • GSX
  • NOLA: The Crescent City

    Twenty years later we finds ourselves in New Orleans. Twenty years ago the aftermath of Hurricane Katrina forced exhibitors and attendees to look elsewhere for tradeshow floor space. Read Now

    • Industry Events
    • GSX

New Products

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.