How identity and access management enabled county's remote work
Connecting state and local government leaders
To accommodate the switch to remote work, Ramsey County, Minn., expanded its virtual-private network and remote connection capabilities and made multifactor authentication mandatory.
Ramsey County, Minn., is willing to take the risk that it is over-securing user access, said Dean Morstad, its identity and access management manager.
Before the COVID-19 pandemic, county offices provided services in person, and employees made minimal use of multifactor authentication, but that changed last year, when everyone shifted to remote work, Morstad said Nov. 30 during SailPoint’s “5th Annual Government Identity Security Summit.” Within 30 days he and his team had expanded the virtual-private network and remote connection capabilities – and they revamped security, making MFA mandatory.
“We worked diligently to review all of the outstanding gaps that we had -- to protect our perimeter from a security perspective -- making sure we had the right tools in place, making sure that we were protecting all of our assets as well as all of our data, and then also moving and improving on our identity and access management,” Morstad said.
The county does still have a perimeter – “a clearly defined separation that we need to protect” – but he recognizes that it’s blurring as the county adopts cloud platforms in support of the new work environment. “We’ve had to extend our access management into that as well, moving into federation and using SAML authentication … as well as understanding all of those cloud endpoints where we have access,” Morstad said, adding that the goal is “to secure as much as possible and take the risk that we might be over-securing.”
Data protection is particularly important for the county, which must comply with multiple government regulations ranging from the Criminal Justice Information Services to the Health Insurance Portability and Accountability Act.
“It’s a challenge to make sure that as a county we’re doing our due diligence to protect all the people that we have, and through that process also making sure that we’re not detracting from, taking away from the ability to serve our clients,” Morstad said.
To avoid that pitfall, the county performs gap analyses to ensure that existing data and regulations are covered while staying on top of new rules and cyber threats.
Morstad said that he’s exploring ways to help the county manage maintenance of all the IT changes, especially in light of staffing shortages. One approach is offloading work to vendors as managed services. Another is to automate systems so that the county can get the most out of its investment by letting automation handle routine activities while human workers focus on more critical areas.
Unlike Ramsey County, Carnegie Mellon University was well situated to handle remote work and access management during the pandemic, said Mary Ann Blair, chief information security officer at the university. That’s because students, faculty and administrators have been bringing their own devices onto the university’s campuses for years and expecting to connect.
“We’ve got international campuses, so folks have always been remote as well as bringing their own devices,” Blair said. “When the pandemic hit, we were right in the midst of spring break and we transitioned. We extended spring break by a few days and transitioned all of our learning to online formats through the use of video platforms and pretty much continued on without missing a beat.”
She shared some access best practices, starting with getting the right tools in place to facilitate the aggregating of access and attesting to it, and putting governance in place to develop roles that the university can support and mapping those roles to what users are entitled to access.
“When you look at systems like email, for example, where the content within that generalized system may have come from your participating in various roles over time, that is an area of great challenge for us. When you’re changing jobs, but you still have the email content from the last job in your inbox somewhere, what do we do with that?” Blair said. “There are new areas that we’re exploring at the university: To make sure that we have continuity of service for our affiliates but that we’re securing the historical data as much as we’re securing data that you should have access to now.”
She also recommends doing a retrospective after any cyberattack, even if your agency wasn’t the victim. “Security is a point in time,” Blair said, so it’s important to have and validate a trust model, and to expect and plan for a time when security will fail.