In the cyber evolution, identity and access management is a key player
Connecting state and local government leaders
By going beyond the basics of IAM, agencies can maintain the level of security that is necessary to protect mission-critical data, without burdening the end user.
The National Institute of Standards and Technology recently announced plans to update to its cybersecurity framework. Updates proposed in version 1.1 of the Framework for Improving Critical Infrastructure Cybersecurity will, among other changes, increase the focus on identity management, a pillar of security that has become more important since the initial version of the framework was released in 2014.
The category, now titled Identity Management, Authentication and Access Control, clarifies the definitions of the terms “authentication” and “authorization,” and includes and defines the term “identity proofing” for the first time.
These updates represent greater awareness of the increasing role that identity and access management (IAM) plays in today’s evolving IT landscape. As connected devices grow in number and digital transformation technologies advance, agencies must focus on user and data security to limit access to sensitive information. Since NIST’s initial cybersecurity framework was put into place, incidents like the breach at the Office of Personnel Management highlight why IAM efforts are more important than ever, warranting framework updates. In many cases, high-profile breaches have led to a better understanding of the basics of IAM, like two-factor authentication.
Yet agencies can do more to improve IAM. Here are three next steps:
Treat privileged accounts with care
As agencies improve how they address the basics of IAM, they must pay close attention to privileged users. Privileged accounts have nearly unlimited access to a wealth of often sensitive data, applications and devices that regular users may seldom see. These types of accounts are prime targets for hackers and other bad actors that know they’re likely to provide access to systems across an enterprise. Taking a least-privilege approach and limiting access to what’s necessary for employees to perform their jobs are important safeguards, particularly for admin accounts.
Privileged users can be granted any elevated access that they may need for a specific purpose by request, receiving unique credentials that are valid for a limited time and entirely tied to the individual request. While using this “superuser” access, user actions are tracked so that in the event of a security incident, its origin can be identified and individual accountability assigned. These tactics ensure security is maintained without limiting productivity.
Ensure efficient provisioning and de-provisioning
As agencies add new employees, modify user rights and remove access for those who have exited the workforce, they must act quickly to ensure both performance and security. Without automated de-provisioning, ex-employees can retain access, potentially to sensitive data, for days or even weeks after their last day. This could lead to improperly shared or stolen information or act as a gateway bad actors can abuse. Provisioning similarly requires appropriate speed to ensure new employees can access precisely the right resources they need to do their jobs from their first day in the office.
Automated enterprise provisioning also helps ensure consistency across all agency identity lifecycle tasks, including group memberships. This level of automation can eliminate redundancies, inefficiencies and other incidents of human error that could unintentionally put information in the wrong hands or impede user productivity.
Record user actions
Maintaining an audit trail is not only required for government reporting and compliance, but it is also key to improving an agency’s security stance. An audit trail provides a level of detailed analysis that allows them to determine the root cause of a breach and then work to troubleshoot and remediate. The ability to pinpoint how a breach occurred can limit damage and reduce the likelihood of similar vulnerabilities in the future. Comprehensive auditing should allow agencies to facilitate compliance in rapidly emerging hybrid environments, maximizing flexibility.
By going beyond the basics of IAM, agencies can maintain the level of security that is necessary to protect mission-critical data, without burdening the end user. As new areas of IT security risk continue to emerge, it is important that agencies take advantage of tools like NIST’s updated cybersecurity framework and implement a holistic approach to IAM.
NEXT STORY: DOD bug bounty programs pay off