For many CISOs, overseeing identity management represents a significant challenge and a substantial component of their broader security ecosystem. In a nod to its importance, the National Cyber Security Alliance even recently kicked off the first ever Identity Management Day. It is also central to a number of critical issues that urgently need a CISO’s attention, namely data access governance, data loss prevention and cloud application security.
When navigating the vital issue of identity, the top considerations include:
Data Access Governance
Data security spans two areas of organizational risk: unauthorized data use and privacy issues associated with authorized data processes. When evaluating an identity management strategy, it is imperative to start at a high level, which includes data access governance to limit access and meaningfully reduce the risk of loss or theft.
An effective end-to-end approach provides visibility and controls to identify risk and protect sensitive information across cloud and on-premise networks while also keeping digital communications compliant. This approach involves establishing a data governance program, which includes data inventory, data mapping, needs-based permissions and, ultimately, data retention and erasure. Critical components in overall data access considerations include understanding what data is being collected, where and how it is stored, who is accessing that data, protection mechanisms in transit and at rest, and how long the data is being retained.
Proper data access governance is essential to ensuring successful digital transformation as remote/hybrid work continues, both email and cloud apps remain core communication channels, and social media continues to drive business.
Data Loss Prevention
Protecting information both at rest and in motion are important elements of another identity management issue: data loss prevention (DLP). Data is lost due to negligent, compromised, or malicious users and it is important to approach DLP in manageable terms. For example, full data classification and discovery is idealistic for many. Complete reliance on both fronts is hard, if not impossible.
Traditional data loss prevention approaches, such as full data discovery, have arduous requirements and usually involve mandatory outsourcing for development and monitoring. In fact, many CISOs only want to tackle the DLP challenge once in their career.
Fortunately, modern strategies are available to manage DLP efforts that focus on protecting the most sensitive information in terms of content type, context, and user behavior. These include systems that issue accurate alerts, reduce investigation time, and focus security teams on risky user behavior rather than solely on classification violations.
An approach that places an emphasis on user behavior, in addition to classification, is pivotal to identifying compromised accounts and phished users. Data does not lose itself, but proper DLP can stop bad actors and insider risks from siphoning critical assets.
Cloud Application Security
In a Cloud Security Alliance study of 200 IT professionals, 83% indicated that cloud security is a top area for improvement. This is not surprising in our current climate as CISOs are constantly struggling to ensure they have visibility and control over how users access and share sensitive data in the cloud. It only takes one compromised account to expose an organization to significant risk.
For example, according to a 2020 Proofpoint analysis of over 20 million cloud account users and thousands of cloud tenants across North America and Europe, attackers are increasingly abusing legitimate OAuth authorization apps to exfiltrate data and maintain persistence on specific cloud resources after compromising an account.
Over the last year, threat actors targeted 95% of organizations with cloud account compromise attempts, and more than half of organizations were successfully compromised at least once. Discovering cloud apps and reducing shadow-based IT—including third-party OAuth authorization apps—helps limit accessing and sharing data to only authorized users.
Every cloud app security broker (CASB) strategy needs to address how individuals handle data and the threats targeting them. It is imperative that threat visibility and adaptive controls extend to the most attacked people and operate effectively in the cloud.
This includes deployment of multifactor authentication solutions, the ability to detect suspicious login attempts, and user education.
Also, deployed cloud DLP policies need to align with those for email and on-premises file repositories. Finally, DLP incident management should be centralized and span across cloud apps.
The issue of identity management will continue to play a central role in security strategies for years to come. Focusing on data access governance, modern DLP and effective cloud app security can help significantly reduce an organization’s risk.