Protect your data with IAM

July 2012 Information Security, Access Control & Identity Management

Jaroslav Cerny
Jaroslav Cerny

If knowledge is power, then data is currency in today’s world. Cybercrime has become more lucrative than the drug trade, and businesses understand that security is of the utmost importance in protecting their data. However, protecting from external threat is no longer enough.

An increasing number of information crimes are being committed from within organisations, behind the firewall where the perpetrators are already inside the security systems. This makes protecting data from the inside, managing access and permissions and verifying the identity of those accessing data, a critical item on the corporate security agenda.

Impending legislation of the Protection of Personal Information (POPI) Bill means that information security is a topic of discussion and debate around boardroom tables throughout South Africa. At its most basic, POPI aims to regulate the privacy of client data. This Bill has been driven by the pressing need to prevent increasing numbers of cases of identity theft, which can have devastating impact on the lives of the people who fall victim to it.

One of the core principles of POPI requires that all personal information be kept secure against the risk of loss, unauthorised access, interference, modification, destruction or disclosure. Once POPI comes into effect, companies by law will have to ensure that client information is adequately protected. Identity and access management (IAM) has thus become critical in ensuring that unauthorised individuals cannot gain access to sensitive information, and that permission is granted to access data on a need-to-know basis.

However, the need for identity and access management to secure data is not only a matter of compliance, but a vital aspect of any comprehensive organisational security plan.

Database protection

Database security without permissions, access parameters and identity verification is vulnerable to exploitation internally. Even the most stringent external controls can be compromised by an individual inside the network who is able to access, copy and remove data that they should not have access to. As an example, not every employee needs to have access to the human resources or financial data of an organisation. In the same vein, not everyone who requires access to this data needs to be able to copy it onto an external device such as their laptop or a flash drive.

While IAM is the next step in protecting organisations from data breaches, leaks and compromised information, the concept is not new. It is well known that limiting the number of people who can access sensitive data and controlling permissions as to what they can do with this data based on identity management narrows the potential for this data to be leaked. This in turn lowers risk. However, the evolution of the Internet and the growth of the mobile workforce and mobile devices necessitate that systems be opened up to outside use.

Security is no longer a matter of locking out the outside world and providing a username and password. This means that identity management itself has evolved to include roles, rules and parameters for each individual. This in itself, however, is a delicate balancing act since permissions and roles that are too rigid can inhibit business productivity, and permissions and roles that are too lax can once again introduce risk.

No rules

Further complicating this matter is the fact that there are no hard and fast rules regarding the optimal balance. This differs entirely depending on the organisation, the industry it operates in and its internal culture, amongst other things. Security touches on every system, every process and every person in an organisation. Because of these complexities and because of the need for certain external controls and best practices, it is often a good idea to outsource certain aspects of security, including database security elements such as IAM.

While security can never be entirely outsourced, especially for control purposes, partnering with an outsourced provider offers a measure of continuity. If handled completely in-house, this can never be internally guaranteed, since employees may leave an organisation and take their knowledge with them. Outsourced providers often have far greater aggregated experience and specialised knowledge with implementing specialised database security solutions such as identity and access management.

The database is mission critical to the majority of organisations, and if security implementations are implemented incorrectly, they can wreak havoc and even shut down entire systems when they go live. Outsourced specialists bring the necessary experience, shorten implementation times, have a knowledge of best practices and can provide a practical road map of what needs to be done and when in order to reach security goals.

As the threat landscape has evolved, so too has security, but the fact remains that criminals will always single out the weakest targets. Without sophisticated tools such as IAM in place to protect databases, organisations are left vulnerable to fraud, compromised data and corporate espionage. Added to this, the impending passing of the POPI Bill into law means that security is no longer just a matter of good practice but of compliance as well. To remain competitive in an increasingly regulated, data driven and threat riddled market, databases need to be protected, inside and out.





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
Upgrade your PCs to improve security
Information Security Infrastructure
Truly secure technology today must be designed to detect and address unusual activity as it happens, wherever it happens, right down to the BIOS and silicon levels.

Read more...
Open source code can also be open risk
Information Security Infrastructure
Software development has changed significantly over the years, and today, open-source code increasingly forms the foundation of modern applications, with surveys indicating that 60 – 90% of the average application's code base consists of open-source components.

Read more...
DeepSneak deception
Information Security News & Events
Kaspersky Global Research & Analysis researchers have discovered a new malicious campaign which is distributing a Trojan through a fake DeepSeek-R1 Large Language Model (LLM) app for PCs.

Read more...
Biometric security key for phishing-resistant MFA
Products & Solutions Access Control & Identity Management
New FIDO-compliant USB, Bluetooth, and NFC BioKeys with biometric login and centralised management for phishing-resistant, passwordless multifactor authentication (MFA) for enterprise users.

Read more...
SA’s strained, loadshedding-prone grid faces cyberthreats
Power Management Information Security
South Africa’s energy sector, already battered by decades of underinvestment and loadshedding, faces another escalating crisis; a wave of cyberthreats that could turn disruptions into catastrophic failures. Attacks are already happening internationally.

Read more...
Almost 50% of companies choose to pay the ransom
News & Events Information Security
This year’s Sophos State of Ransomware 2025 report found that nearly 50% of companies paid the ransom to get their data back, the second-highest rate of ransom payment for ransom demands in six years.

Read more...
Survey highlights cost of cyberdamage to industrial companies
Kaspersky Information Security News & Events
The majority of industrial organisations estimate their financial losses caused by cyberattacks to be over $1 million, while almost one in four report losses exceeding $5 million, and for some, it surpasses $10 million.

Read more...
Digital economy needs an agile approach to cybersecurity
Information Security News & Events
South Africa is the most targeted country in Africa when it comes to infostealer and ransomware attacks. Being at the forefront of the continent’s digital transformation puts South Africa in the crosshairs for sophisticated cyberattacks

Read more...
SIEM rule threat coverage validation
Information Security News & Events
New AI-detection engineering assistant from Cymulate automates SIEM rule validation for SecOps and blue teams by streamlining threat detection engineering with automated testing, control integrations and enhanced detections.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.