Access management: What agencies need to know
Connecting state and local government leaders
A secure and robust identity management structure can improve agencies' visibility into who is accessing their systems, as well as when, how and from where.
Identity has always been a critical component of online communications, even from the first days of America Online. Is the person on the other end of the connection also a basketball fan who likes dogs and lazy Sundays, or is it someone completely different, changing his identity for potential personal gain?
That question has become more serious as the internet has matured. Agencies want to ensure that those who access government information are the right people, getting the right resource at the right time for the right reason.
In fact, the Office of Management and Budget recently released a draft policy to address the implementation of identity, credential and access management (ICAM) for federal agencies.
“Agencies must be able to identify, credential, monitor, and manage user access to information and information systems across their enterprise in order to ensure secure and efficient operations,” the policy stated. “In particular, how agencies conduct identity proofing, establish digital identities, and adopt sound processes for authentication and access control will significantly impact the security of their digital services.”
Of course government agencies, or any organization, want solid ICAM strategies. The challenge is how to get there.
Creating a robust ICAM architecture
At its core, effective ICAM comes down to one basic need: visibility. The problem most agencies face is that the way their systems have been created hampers visibility. Government agencies typically built their systems without a cohesive architecture in place, instead reacting to urgent and immediate needs by integrating point product solutions.
As agencies built out their networks, they did so using different vendors' technologies that were never built to work with one another. When they faced a cybersecurity challenge, technology leaders looked for the best product to fix that issue. Over time, these “fixes” contributed to an enterprise filled with blind spots and coverage gaps that hackers exploit.
Immediate needs outweighed longer term goals, but now agencies find themselves paying for that tactic.
Agencies must take a holistic approach to cybersecurity that focuses on an end-to-end solution where the parts work together to create true visibility. From the start, this strategy should include a comprehensive ICAM program that will improve agencies' understanding who is accessing their systems, as well as when, how and from where.
An end-to-end solution
Government agencies should consider access management as a perimeter they must defend. As such, they should look for certain capabilities that can help deliver secure access. Those include:
Passwordless intelligent authentication. Cloud applications with passwordless intelligent authentication can perform risk analysis and detect location-based anomalies, such as a credentialed employee based in Washington, D.C., who seems to access the network in the middle of the night from Albania.
Data container apps. Agencies must protect and ensure compliance for data that may be moved or migrated from their cloud-based applications onto mobile devices. To this end, they should use data containers that prevent anyone besides a credentialed user from accessing that data. The containerized data should also be protected by policies governing its use, adding additional protection.
Access control with integrated authentication. Agencies need access control systems that not only look at context-based data use, but can also use managed PKI service digital certificates to validate user access. After users log in, agencies can use these tools to create a “step up” policy for web applications that require further security conditions to be met in order to access additional features.
Multi-factor authentication. In addition to integrating authentication into access control systems, agencies must be able to positively identify a user with a dynamic second authentication factor. Verifying users with a wide range of multifactor authentication methods, such as responding to a prompt pushed to their phones or using hard tokens or biometrics can enforce access policies in both on-premises and cloud environments.
Identity management is a major requirement for federal technology leaders, and OMB’s draft ICAM policy gives agencies tremendous guidance. A secure and robust identity management structure can greatly reduce risks, helping to catch nefarious actors before they can even enter the system. With an end-to-end ICAM program, federal agencies can ensure that only the right people access the right information at the right time.