Protect your data with IAM

July 2012 Cyber Security, Access Control & Identity Management

Jaroslav Cerny
Jaroslav Cerny

If knowledge is power, then data is currency in today’s world. Cybercrime has become more lucrative than the drug trade, and businesses understand that security is of the utmost importance in protecting their data. However, protecting from external threat is no longer enough.

An increasing number of information crimes are being committed from within organisations, behind the firewall where the perpetrators are already inside the security systems. This makes protecting data from the inside, managing access and permissions and verifying the identity of those accessing data, a critical item on the corporate security agenda.

Impending legislation of the Protection of Personal Information (POPI) Bill means that information security is a topic of discussion and debate around boardroom tables throughout South Africa. At its most basic, POPI aims to regulate the privacy of client data. This Bill has been driven by the pressing need to prevent increasing numbers of cases of identity theft, which can have devastating impact on the lives of the people who fall victim to it.

One of the core principles of POPI requires that all personal information be kept secure against the risk of loss, unauthorised access, interference, modification, destruction or disclosure. Once POPI comes into effect, companies by law will have to ensure that client information is adequately protected. Identity and access management (IAM) has thus become critical in ensuring that unauthorised individuals cannot gain access to sensitive information, and that permission is granted to access data on a need-to-know basis.

However, the need for identity and access management to secure data is not only a matter of compliance, but a vital aspect of any comprehensive organisational security plan.

Database protection

Database security without permissions, access parameters and identity verification is vulnerable to exploitation internally. Even the most stringent external controls can be compromised by an individual inside the network who is able to access, copy and remove data that they should not have access to. As an example, not every employee needs to have access to the human resources or financial data of an organisation. In the same vein, not everyone who requires access to this data needs to be able to copy it onto an external device such as their laptop or a flash drive.

While IAM is the next step in protecting organisations from data breaches, leaks and compromised information, the concept is not new. It is well known that limiting the number of people who can access sensitive data and controlling permissions as to what they can do with this data based on identity management narrows the potential for this data to be leaked. This in turn lowers risk. However, the evolution of the Internet and the growth of the mobile workforce and mobile devices necessitate that systems be opened up to outside use.

Security is no longer a matter of locking out the outside world and providing a username and password. This means that identity management itself has evolved to include roles, rules and parameters for each individual. This in itself, however, is a delicate balancing act since permissions and roles that are too rigid can inhibit business productivity, and permissions and roles that are too lax can once again introduce risk.

No rules

Further complicating this matter is the fact that there are no hard and fast rules regarding the optimal balance. This differs entirely depending on the organisation, the industry it operates in and its internal culture, amongst other things. Security touches on every system, every process and every person in an organisation. Because of these complexities and because of the need for certain external controls and best practices, it is often a good idea to outsource certain aspects of security, including database security elements such as IAM.

While security can never be entirely outsourced, especially for control purposes, partnering with an outsourced provider offers a measure of continuity. If handled completely in-house, this can never be internally guaranteed, since employees may leave an organisation and take their knowledge with them. Outsourced providers often have far greater aggregated experience and specialised knowledge with implementing specialised database security solutions such as identity and access management.

The database is mission critical to the majority of organisations, and if security implementations are implemented incorrectly, they can wreak havoc and even shut down entire systems when they go live. Outsourced specialists bring the necessary experience, shorten implementation times, have a knowledge of best practices and can provide a practical road map of what needs to be done and when in order to reach security goals.

As the threat landscape has evolved, so too has security, but the fact remains that criminals will always single out the weakest targets. Without sophisticated tools such as IAM in place to protect databases, organisations are left vulnerable to fraud, compromised data and corporate espionage. Added to this, the impending passing of the POPI Bill into law means that security is no longer just a matter of good practice but of compliance as well. To remain competitive in an increasingly regulated, data driven and threat riddled market, databases need to be protected, inside and out.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Exploiting the global pandemic
Issue 7 2020 , Cyber Security
Cyber criminals targeting remote work to gain access to enterprise networks and critical data reports FortiGuard Labs.

Integrated security is key to Huawei Mobile Services
Issue 7 2020 , Cyber Security
To ensure sufficient mobile device security, the technology giant incorporates security into its chip, device and cloud capabilities.

Cybersecurity becomes key enabler of sustainable business growth
Issue 7 2020 , Cyber Security
The adoption of rushed digital transformation strategies has left many facing unintended complexities and challenges.

Challenges healthcare is facing
Issue 6 2020 , Cyber Security
The healthcare industry has been forever changed by digital transformation, but cybercriminals are targeting the healthcare sector now more than ever.

Secure IoT devices and networks
Issue 6 2020, Technews Publishing , Cyber Security
Check Point Software’s IoT Protect solution secures IoT devices and networks against the most advanced cyber-attacks.

SentinelOne Protects the AA
Issue 6 2020 , Cyber Security
National provider of 24-hour motorist assistance stays on the road thanks to accelerated, AI-powered threat prevention, detection and response.

Protecting database information
Issue 6 2020 , Cyber Security
SearchInform has officially released Database Monitor, a solution for the protection of information stored in databases.

Wireless access control technology
Residential Estate Security Handbook 2020, Salto Systems Africa , Products, Access Control & Identity Management
SALTO has released the NEO Cylinder for doors where fitting an electronic escutcheon is not possible or required.

Secure touchless access
Residential Estate Security Handbook 2020, Suprema , Products, Access Control & Identity Management
Suprema’s facial biometric terminals bring no-touch access into secure residential estates, high-rise apartments and luxury homes. Secure touchless access.

Frictionless fingerprint access
Residential Estate Security Handbook 2020, IDEMIA , Products, Access Control & Identity Management
The MorphoWave Compact acquires four fingers in 3D for maximum accuracy, with one pass of the hand over the sensor.