Who are you? Rising to the data protection challenge

Whatever normal looked like in March 2020, it sure doesn’t look like that now. Just about everything in our lives has changed, from how we educate our kids to how we work, travel, bank and buy groceries. It has pushed IT departments to create widespread changes in an incredibly short time, and nowhere is this pressure being felt more than in government IT shops.

Yet, even as local, state and federal agencies have heroically changed course to meet the needs of hundreds of millions of Americans who need services, how those agencies maintain data security must also be reimagined. With so much digital transformation taking place, hackers see plenty of opportunity to find and exploit weaknesses -- and they are bold; the recent breach of cybersecurity monolith SolarWinds shows that they are willing to take on major targets.

The good news is that mainframes, which power many government functions at all levels, are perfectly suited for the increased challenge.

There is no magic bullet that is going to make data secure. Government CIOs can force employees to change their passwords and rely on facial recognition to verify user identities, but those approaches don’t protect large amounts of sensitive data that hackers relentlessly try to access and manipulate. What is needed is a multi-pronged approach that will eliminate common ways that account data is compromised.

The first approach is known as zero trust. Simply put, it is a security model structured around the assumption that anyone trying to get into a system has bad intentions unless and until they can prove otherwise. Zero trust bases authentication on multiple factors, including location, device and user validation. If any of these factors change (such as a login from a new location), the user risk is reevaluated to assess whether access should still be allowed. This layered series of controls provides protection by verifying and validating access on an ongoing basis; trust is never just assumed.

Approaches like information rights management have become commonplace, but they are not truly zero-trust policies because they only protect sensitive information at one point in the chain. The overwhelming majority of data breaches are caused by attackers entering a system and finding very few obstacles once they get inside the firewall. Zero trust addresses this by making system entry just one barrier of many, which is one of the reasons it’s listed as one of the best practices for universal data protection by the Department of Defense.

The second approach that every government IT department should consider is multifactor authentication. Just about every agency uses passwords to protect data and restrict access, but hackers can crack many passwords in under a minute.

What is needed is a radical reimagining of data security to include multiple requirements to gain access. This is already being deployed in the financial services world, but government agencies seem to be a bit behind the curve. Something as simple as sending users a verification text to verify their identity can go a long way to ensuring that only authorized users can have access to data systems.

This is where mainframes play a critical role, because of their ability to handle massive numbers of transactions quickly and efficiently, thus preventing the bottlenecks that some security measures cause during times of peak usage.

The third approach, privileged user access, is more focused on internal staff than the general public. Most IT systems restrict access based on role, but this doesn’t go far enough -- there are often few restrictions on who can access specific kinds of data, or even specific files, within organizations. This flaw made national news some years ago when a number of hospital workers were fired for looking at George Clooney’s medical records after he had a motorcycle accident. All those employees were legitimate system users, but they should not have had access to Clooney’s files.

Privileged user access doesn’t have to just be a blanket policy: IT directors and managers can require their team members to request access to specific files on a case-by-case basis before they can access the data. The capabilities exist on the mainframe for enabling dynamic privilege escalation so that users can be in a privileged state temporarily, thus supporting the principles of least access. The National Institute of Standards and Technology has some great ideas on how to make this a reality, and mainframes are especially well suited to supporting these kinds of controls without requiring additional capacity.

All of these security approaches are currently in use across government, but they are inconsistent from state to state, and from department to department. As everyone knows, a security system is only as good as its weakest link, and all it takes is one security breach to inflict incalculable damage.

By implementing zero trust, MFA, and privileged user access as standard practice, government agencies can significantly reduce the risk of an external hack or an internal data breach. And organizations using mainframes won’t even have to break a sweat to make it happen.