When it comes to risk and compliance, companies will need to have an increased focus on access controls and governance across all of their business assets worldwide.
This is a huge and important topic, so to help break it all down, VMblog reached out to industry expert Rita Gurevich, the CEO and founder of SPHERE.
VMblog: Threat actors are becoming increasingly creative and agile in their tactics. Improper access controls can give these actors unauthorized access to internal systems and sensitive data. What specific threats and attack methods should organizations be aware of in 2022?
Rita Gurevich: A common reason many data breaches occur is an insufficient or improper enforcement of access controls across an organization. Although cybercriminals employ a variety of attack methods to sneak into systems, bypassing access controls is one of the most common methods. In fact, Broken Access Control tops the list of OWASP Top 10 Web Application Security Risks. When implementing Identity and Access Management throughout an organization, IT and security teams should be aware that the attack surface they managed before the pandemic was exceedingly less than what needs to be managed today. This means that companies should not only employ data protection tactics within their security policy (such as Multi-Factor Authentication, encryption and continual system updates), but spearheading internal education programs that make employees aware of steps they can take, as well. Another threat that cybercriminals employ is the use of social engineering tactics to influence those within an organization. Your employees hold the keys to some of your most sensitive data, and tactics such as phishing (when a threat actor sends a fraudulent email that appears legit) and smishing (fraudulent text messages) are easy ways for cybercriminals to manipulate human flaws. Of course, there is always the risk of disgruntled employees working alongside cybercriminals for financial reward. According to a report from Code42, 96% of respondents shared that they have challenges protecting corporate data from insider risk, while only 21% have budgets dedicated to handling this risk.
VMblog: With entire infrastructures moving to the cloud, there is a proliferation of identities and endpoints to manage. How does zero trust security play a role in managing this increase in attack surfaces?
Gurevich: Zero trust security is huge. Not only is zero trust a key mindset, but it is also a tactical and practical strategy when managing an ever-increasing number of endpoints and attack surfaces. A zero trust security strategy stresses that access to resources is not granted by default, rather access is granted only by verifying and validating each entity within and outside of an organization. Like the name suggests, it is “zero trust” by default.
IT security teams should, at the most fundamental level, have visibility into all their access controls and what services they are consuming. Due to the increase of cloud services being adopted, many organizations are unaware of the risk that comes with employees interacting and sharing data both on-prem and in the cloud. Security leaders can address this risk with a zero trust strategy by managing identities and devices consistently across all services and environments, along with determining the attributes that should be leveraged to establish trust.
VMblog: What challenges do large, highly regulated organizations face when rolling out access governance programs as well as the controls that regulate them?
Gurevich: Access governance programs are easy to create. However, cleaning up the decades of permissions mismanagement in order to achieve, maintain and ensure compliance with those programs is another story entirely. This is where the real challenge presents itself. The initial and on-going reporting and cleanup of access controls, permissions and ownership are key requirements to a successful rollout of an access governance strategy. At SPHERE, we break down effective Cyber Hygiene into five core areas:
- Data Collection: Collecting good, clean and accurate inventory, access controls and ownership data at scale.
- Organization: Organizing this data in a way that is meaningful and consumable.
- Actional Reporting: Constantly looking for violations of access controls and policies in a customizable and actionable report.
- Owner Reviews: Reviewing technical permissions and access control management data with non-technical business owners in a way that makes sense to them.
- Automated Remediation: Making the appropriate changes without impacting business critical functions through an automated process.
These challenges each require their own set of unique solutions that Identity and Access Management platforms do not traditionally attempt to solve. This, unfortunately, leaves organizations to struggle on their own to find or create fractional solutions for.
VMblog: What are a few key best practices enterprises should be implementing, when it comes to Identity and Access Management?
Gurevich: A few practical things organizations can integrate within their security programs are Multi-factor Authentication (MFA). This should be a mandatory practice, since it will set up multiple layers that hackers have to bypass in order to break in. The removal of users from a company’s internal systems once they leave the company is a critical best practice, as well. Many breaches of data are interestingly due to the negligence on the part of a former employee. According to a report from Beyond Identity, as many as 1 in 4 employees said they still had access to accounts from past jobs.
Another seemingly simple, yet highly effective, best practice is to adopt is a strong password policy across all teams within the company. Many organizations underestimate the effectiveness of adopting these simple, basic cyber hygiene best practices, but they should be the foundation of your security strategy.
VMblog: What is SPHEREboard 6.0 and how does the recent development update address the challenges enterprises are facing when trying to operationalize IAM within their security strategy? How can increased visibility into permissions, access and ownership help enterprises manage and reduce risk?
Gurevich: SPHEREboard 6.0 is unique in that it transforms the user experience, which is something the team at SPHERE is hyper-focused on at the moment. Large and complex companies struggle with implementing consistent cyber hygiene. When viewing risk across the all their environments, they need an easy-to-navigate dashboard and heightened visibility, so SPHEREboard 6.0 addresses this with granular customizability and increased levels of control.
Our team’s view on ownership centers on giving the reigns to the customer and empowering them to create their own unique Privileged Access Management processes. SPHEREboard 6.0 gives IT and security teams the ability to distinguish account identities and provides them with a range of controls on critical assets across the enterprise. Ultimately, transforming the user experience empowers teams to reduce risk, erasing the inherent complexity that often comes with managing a sea of identities.
VMblog: How important is the level of reporting and the user-experience, when offering state-of-the-art access governance solutions?
Gurevich: Providing reporting insights and actionable data around access controls is not a new idea. Companies have been doing this through third parties and home-grown solutions for decades. However, these solutions and platforms are often extremely labor intensive, not integration friendly and unintuitive to administrators, let alone end-users. Unintuitive workflows or unactionable reporting can often make solutions “shelf-ware.”
New, state-of-the-art access governance solutions must not only be able to pull in data from complex, often inconsistent sources, but also streamline the time to compliance. This means a streamlined user-experience for both administrators and end-users, as well as persona-centered reporting. Solutions must provide actionable and customizable metrics summarized for executive leadership, detailed for security administrators and simplified for end-users. These solutions should not only report on security/compliance violations, but also empower the right users to follow the approved workflows.
For example, reports for company leadership should be centered around decision-making based on priority and updates on progress. Reports for owners should enable feedback of who should have access to their assets. And reports for administrators should be about enabling the discovery of security issues and changes to the environment in a safe and scalable way.
VMblog: What are some key predictions you have for the Identity and Access Management space in 2022 that security/technology leaders should be aware of?
Gurevich: An efficient, expansive and audit-proof Identity and Access Management program relies on a solid foundation quality data – incredibly accurate access, permissions and ownership data. Throughout the last couple of years, IAM teams have had to move quickly to expand coverage of their most important platforms and services within their IAM solution to ensure availability through the pandemic. However, this speed often came at the cost of good, clean and accurate data quality. This has led to gaps in the implementation of IAM solutions without the necessary access control reporting to discover and remediate these issues.
A prediction I have for the industry is an increasing and much-needed emphasis data quality through Cyber Hygiene programs. This is the next step in the maturing Identity and Access Management space in order to ensure continued compliance to Access Governance programs!
##
