3 steps to improve identity and access management without undermining productivity

Today’s government IT professionals set rules that provide users with access rights, improving workflows while protecting agencies against threats. Unfortunately, the prevalence of mobile devices and cloud-based applications has made it increasingly difficult to establish those controls. This has led to significant security and compliance challenges, particularly surrounding identity and access management (IAM).

Agencies still find themselves dealing with the aftereffects of the bring-your-own-device revolution. Mobile devices and cloud services have increased efficiency and reduced costs, but they’ve also made it tougher for IT teams to get a handle on network activity. Employees are turning to many different applications -- some of which may be considered unsanctioned “shadow IT” apps -- and will often request access rights to get around what they consider security roadblocks. Those rights might be granted by IT managers who don’t have the time or resources to check everyone’s credentials or clearance levels.

Some employees even leave their agencies with access rights still intact. Whether it’s resources leaving for other jobs or a silver tsunami of retirees, it can be difficult to keep track of who still has privileges.

All these factors contribute to an increase in accidental or intentional insider threats that can pose significant risk for data loss. According to a recent SolarWinds federal cybersecurity report, careless or untrained insiders are the largest source of security threats for government agencies.

IT managers must develop IAM policies to protect their agencies without undermining workplace efficiency and productivity. Here are three steps managers can take to gain better control of their agencies’ security postures without impeding their colleagues' workflows.

1. Audit who has access and what they’re accessing. This is virtually impossible to do manually; there’s too much to consider and limited resources with which to work. But automated monitoring can help teams gain a good perspective on which applications are being used and who’s using them.

Managers can start by scanning their Active Directory and file servers to analyze user access to systems, files and data. This process can help identify unknown users and those who have been inadvertently granted access rights to data outside their purview. It can also uncover users who may no longer work for the agency yet still have access rights to the network.

2. Set up role-specific templates aligned with security policies and enforce a policy of least privilege. Inevitably, users will get promoted, move to different teams and increase their responsibilities. In anticipation of these events, IT managers should incorporate an overall policy of least privilege that can be enforced on a case-by-case basis. Does a particular employee still need access to a specific application? Does that IT staffer really need access to all of the agency’s servers, or just the 10 for which she's responsible? Providing access privileges for only what’s necessary can go a long way toward keeping things under control.

Setting up role-specific templates aligned with the agency’s security policy is a good way to manage this process. For example, a CIO might have widespread access to various applications and tools, but a senior manager might be granted more restricted access. Whenever employees' roles change, their access must also change to reflect their new responsibilities. This helps ensure access privileges correspond with the agency’s security policies.

3. Shine a light on shadow IT. It’s not just users IT needs to worry about; it’s also the applications they’re using. Monitoring can also shine a light on the applications users might be accessing without knowledge of the IT department. Applications posing risks can be disallowed, while those deemed safe can continue to work yet be closely monitored to ensure they remain secure. Or, applications that may once have been deemed questionable, but have proved helpful for some users, can be reassessed and authorized if they pose no threat.

IT professionals can’t secure what they can’t see. Shining a light on all of the applications being used can offer a clear understanding of what’s going on, so they can better secure their networks. This is particularly important for file-sharing services that could increase the risk of data loss.

Avoiding unwanted friction and preserving productivity

Managers can be forgiven for perhaps wanting to take an “all-or-nothing” security approach and block wide swaths of applications, users and devices. Yet that's not a practical approach -- it can lead to unwanted friction between government employees and IT staff and undermine agencies’ ability to take advantage of the many benefits provided by cloud-based applications.

Creating a solid IAM program is a much better option. It ensures the right users have the right access to the right applications without compromising security. That’s a win-win for everyone.