Five IGA Essentials that Improve your Cybersecurity Strategy
Modern IGA solutions provide real-time secure access control to manage employees, contractors, and external identities. This enables the implementation of continuous identity risk protection through conditional access and classification of data backed by a cross system access suspension workflow to effectively lock down a user’s access depending on the severity of a potential security breach. Using this type of dynamic approach will ensure that an organization is able to rely on the implemented policies and assure that they comply with relevant industry standards and regulatory authorities, while still providing the correct access to the correct user, at the correct time. We have identified five key areas that will strengthen your cybersecurity strategy.
1. Identity lifecycle management
Support your cyber security policies by ensuring that the workforce has no more and no less access than they need to perform their jobs. Granting access to resources according to defined roles, rules, and policies and the ability to efficiently terminate access across on-premises and cloud-based systems and applications is an essential step in securing your organization.
2. Data classification
Identify and classify the data and information held in different systems, so data can be managed in accordance with appropriate levels of security and compliance. Sensitive data or critical business information can be tagged, so it can be managed accordingly and any access to sensitive data can be monitored efficiently. The tags allow organizations to establish a risk management strategy and apply appropriate risk controls where relevant.
3. Govern privileged access
Having visibility and control of privileged access rights across all business systems throughout an organization is key to ensuring security and compliance. IGA governance processes provide a fine-grained access overview to allow organizations to monitor privileged access rights and determine who has access, why, for how long, who approved it, and set validity periods to ensure access is revoked automatically when no longer needed.
4. Security breach management
In the event of an incident where an organization suspects a security breach, the security team may want to suspend access to one or more identities immediately to prevent the lateral spreading of the breach. Identity security breach processes provide an emergency lockout option which enables an administrator to disable a user’s access to all on-premises and cloud-based systems. Cross-system access suspension limits exposure to further breaches while an investigation is carried out and the user’s passwords are reset.
5. Reconciliation / remediation
To ensure that the desired levels of security and compliance required by the organization are in place and maintained, it is necessary to continuously check that the desired security and compliance state matches the actual access state across systems and applications. In case of a mismatch, the differences need to be rectified to maintain the appropriate security and compliance levels. Reconciliation provides what security practitioners are looking for, allowing them to be confident that security issues are detected and remediated reliably.
1. Identity Lifecycle Management: Implement Least Privilege
A key part of securing an organization’s infrastructure is to ensure that user identities are properly created, changed, and disabled when employees join the company, move departments, get promoted, and leave the company. Identity lifecycle management processes enable the granting of access rights according to defined roles, rules and security policies to ensure employees have the right access levels at any given point in time.
Enable the business with secure access
Identity lifecycle management encompasses all the processes of an identity lifecycle – from starting as an employee or contractor all the way through to termination of employment. This includes all the steps throughout the employee life including name changes, maternity leave, changing departments, leaving and rejoining the organization, and more.
Removing access to systems used in a prior role that is no longer required for a new one ensures that access rights do not accumulate, or creep, over time. Failure to remove access systematically may result in violations of security regulations and compliance policies such as segregation of duty. Further, unneeded access rights often go unmonitored and can be easy targets for attackers.
In an adaptable identity lifecycle management solution, business functions can be matched according to changing business needs. This includes processes for IT and business collaboration, segregation of duties (SoD), and industry specific role and policy models allowing any arbitrary levels of roles, role types, and classifications.
Modern lifecycle management models integrate multiple applications and systems (some identity parts managed within an application like ERP tools, and some in identity stores like Microsoft AD) into logical business applications management for easy application and system resource onboarding, self-service access requests, and governance reporting.
Extend your security defenses
Handling on-boarding, changes, and off-boarding processes not only ensures that someone can fulfill their job role, it also has the benefit that if a user account is compromised, an intruder will only have limited access to systems. The security boundary that these processes create is seen as adding further security to traditional security defenses such as firewalls and intrusion prevention systems and is referred to as the “identity perimeter”.
Identity Lifecycle Management does not just focus on employees. Companies typically also need to manage third parties such as contractors, seasonal workers or business partners, who need access to company resources to work efficiently. If this complete lifecycle was to be managed manually, it would take a significant amount of IT resources to provision and de-provision individual accounts.
The processes under the Identity Lifecycle Management process area are known as the joiner-mover-leaver processes. This is because the process area enables organizations to on-board, change, and off-board identities belonging to employees or contractors.
Common to all the processes is that triggering any of them results in identities being updated in accordance with security levels, business policies, job role, organizational hierarchy, and context.
2. Data Classification: Identity Your Critical Data
Use IGA to improve your cyber defense by identifying your mission critical data, and ensure you have continuous visibility and control of exactly who can see what data.
Control access to mission critical data
Resources need to be managed differently depending on factors such as the type of data being stored, the sensitivity of the information, and any regulations governing their use. Applying classification tags to identities, systems, resources, resource folders, contexts, and other objects means that they can easily be identified when specific company processes need to be applied.
Classification tags and classification tag categories (groups of classification tags) are added to object types to help organizations enforce security and comply with company policies and government data regulations. Data classification tag categories should be defined to match the type of business and national context that the organization operates in.
IGA processes allow the data administrators to create classification tag categories – for example, the category ‘GDPR’ could be populated with the tags ‘personal data’, ‘personal sensitive data’, ‘high-risk data’, ‘medium risk data’ and ‘low-risk data’. These classifications allow the administrator to manage the different types of data according to their security and compliance requirements.
Support risk management
Support the risk management strategy and enforce security policies by taking advantage of classification tags and surveys to identify critical and sensitive data. The tags allow organizations to establish a risk management strategy and put relevant risk controls in place.
When classification tag categories and classification tags have been set up, data objects are tagged using surveys – classification survey, resources classification survey, or system classification survey – depending on what is to be classified. These classification categories and classification tags are used to establish a risk management strategy and put relevant risk controls in place by applying specific policies to them.
3. Govern Privileged Access: Ensure Continuous Control
Few users need administrative rights with wide-spread access, and therefore such privileged accounts should be removed wherever possible. Domain administrator rights for system administrators should also be limited and allocated for a limited time only. If it is easy for a system administrator to move around in a system, it is easy for an attacker to do the same.
Administrator access – a prized possession
Administrator access to application servers, cloud-based CRM or ERP applications, or other business critical systems is a prized possession for both internal and external attackers wanting to breach an organization’s cybersecurity defenses. Compromise of privileged accounts allows criminals to probe multiple systems for confidential business data for extended periods of time.
Compromised privileged accounts not only give attackers access to a broad range of an organization’s data but also allow them to potentially go undetected for months as it is not considered suspicious for administrator accounts to access all areas of the business. As a result, it is critical to ensure that administrator accounts with significant levels of access to business systems are tightly controlled on an ongoing basis so that employees and contractors only have access to the resources they need to administer and no more.
To prevent breaches involving the use of privileged accounts, organizations first need to understand which employees already have administrator access. Once this has been established, these access permissions should be verified, and any unnecessary rights revoked. After gaining control of the privileged accounts, it is necessary for the organization to put governance policies and procedures in place to manage the ongoing granting and revoking of access rights to critical business services.
Visibility and proactive risk control
Having visibility and control of privileged access rights across all business systems throughout an organization is key to ensuring security and compliance. Identity governance processes provide a fine-grained access overview to allow organizations to monitor privileged access rights. and determine who has access, why, for how long, who approved it, and to set validity periods, to ensure access is revoked when no longer needed.
Adding identity lifecycle management and identity governance processes to the privileged accounts gives organizations the power to centrally control such accounts and their entitlements to ensure a high degree of security:
- Manage and gain visibility into entitlements and access permissions
- Automate the granting of privileged access rights based on organizational roles and the ongoing validation of all user entitlements
- Grant temporary privileged access for contractors, members of projects or employees working on time-bound assignments
- Manage segregation of duty policies across standard and privileged accounts to maintain least privileged principles
- Demonstrate compliance and accountability for authorities via advanced reporting and analytics options
4. Security Breach Management: Be Prepared
When an organization suspects that a user’s identity has been compromised, it is important to act quickly to limit any damage. If the company has not automated their identity security breach process, the IT department may end up spending valuable time creating an overview of which access the identity has and locking these down individually in the relevant business system.
Limit breach exposure
In the event of an incident where an organization suspects a breach, the security team may want to suspend access to one or more identities immediately to prevent the lateral spreading of the breach.
IGA provides automated identity security breach processes to perform emergency lockouts which enable the administrator to instantly disable a user’s access to all on-premises and cloud-based systems, and easily enable access when the threat has been mitigated.
Cross-system access suspension limits the organizations exposure to further breaches while an investigation is carried out and the user’s passwords are reset. An emergency lockout procedure can be triggered using an automated incident response process or manually carried out by an administrator.
If an administrator determines that there has been a breach, the administrator can perform a manual emergency lockout and provide a reason for the lockout which will serve as evidence in future security breach investigations and audits.
Identity Security Breach processes:
1. Give administrators the ability to suspend all accounts associated with an identity
2. Allow the administrator to reactivate the access once the situation is under control
Stop an attack
The emergency lockout quickly stops the attacker from continuing to perform any network reconnaissance, stealing confidential or sensitive data, or causing disruption to operations by corrupting data or making critical business systems unusable.
In addition, suspending breached accounts gives the company time to perform a technical investigation and to deal with the non-technical aspects of critical security incidents such as internal and external notifications management, thus protecting the company’s reputation and brand.
The second step ensures that once investigations have established the causes of the breach and the security administrators have taken the necessary steps to ensure the breach will not reoccur, the locked identities can be quickly reactivated so that business operations may continue as before.
5. Reconciliation: Compare, Align, and Take Action
Use reconciliation to check access data deviations, uncover risks, and be able to take immediate action. Automated processes for the comparison and alignment of actual access data in IT systems with the desired permissions, also known as reconciliation, is an essential aspect of IGA and cybersecurity.
Tight, permanent control of access rights
Reconciliation allows the organization’s security team to keep a tight, permanent control of access rights after successful access provisioning. Without reconciliation there is no real access governance. Additionally, reconciliation facilitates the operation of identity management and access governance.
The basis of reconciliation is to collect and capture the actual accounts and access rights data from all connected systems and match these up with the desired state according to business policies, SoD rules, contexts and roles. An IGA solution compares the two states and detects any differences. Mismatches between the actual and desired states are a clear compliance violation and the reconciliation process provides a comprehensive access overview highlighting such violations.
A “short cut” to meeting standards
In addition to compliance reporting tools, organizations need flexible mechanisms to remediate violations of rules and policies. For example, auditors or system owners should be able to kick off attestation workflows to approve or reject the actual access rights, or to designate an owner for an orphaned account. In this way, reconciliation goes far beyond simple risk discovery.
On an operational level, reconciliation is part of the “Plan-Do-Check-Act” cycle described in ISO 27001 where the first step is to plan and define an access management concept, including access policies and request processes. Next, policies and processes are configured in the access governance solution. Then reconciliation can be used to check deviations, uncover risks, taking action by assigning account owners, removing undesired access, or confirm access.
Measure security improvements
Aside from monitoring and removing risk, reconciliation also provides a consolidated overview of the actual access that people in the organization have. It is possible to generate a number of risk reports, which highlight data quality issues and security threats. In an iterative process, the organization can confirm the required accounts and access and remove unwanted objects. With this type of reconciliation, it is much easier to cope with the task of getting to a “managed” state, as at any point in time, the organization can measure the security improvements made, providing important key performance indicators for the governance of the organization.
Managing authorizations in legacy systems
Reconciliation can also be used in cases where organizations want to control systems that lack proper management APIs or where organizations prefer to perform administration manually. An example is legacy applications, which do not provide APIs for managing authorizations and where authorizations requests are often handled manually in the application. For these systems any administrative error or malicious action will lead to a potential security threat. In this scenario, reconciliation can often still be applied by simply downloading existing authorizations on a regular basis, comparing desired and actual states of authorizations and detecting and removing critical situations.
Detect and remediate security issues
Reconciliation provides what security practitioners are looking for to manage access risks, allowing them to be confident that security issues are detected and remediated. The security practitioners get a key concept for a robust, modern IGA system fully aligned with compliance best practices.
