Protect your data with IAM

July 2012 Information Security, Access Control & Identity Management

Jaroslav Cerny
Jaroslav Cerny

If knowledge is power, then data is currency in today’s world. Cybercrime has become more lucrative than the drug trade, and businesses understand that security is of the utmost importance in protecting their data. However, protecting from external threat is no longer enough.

An increasing number of information crimes are being committed from within organisations, behind the firewall where the perpetrators are already inside the security systems. This makes protecting data from the inside, managing access and permissions and verifying the identity of those accessing data, a critical item on the corporate security agenda.

Impending legislation of the Protection of Personal Information (POPI) Bill means that information security is a topic of discussion and debate around boardroom tables throughout South Africa. At its most basic, POPI aims to regulate the privacy of client data. This Bill has been driven by the pressing need to prevent increasing numbers of cases of identity theft, which can have devastating impact on the lives of the people who fall victim to it.

One of the core principles of POPI requires that all personal information be kept secure against the risk of loss, unauthorised access, interference, modification, destruction or disclosure. Once POPI comes into effect, companies by law will have to ensure that client information is adequately protected. Identity and access management (IAM) has thus become critical in ensuring that unauthorised individuals cannot gain access to sensitive information, and that permission is granted to access data on a need-to-know basis.

However, the need for identity and access management to secure data is not only a matter of compliance, but a vital aspect of any comprehensive organisational security plan.

Database protection

Database security without permissions, access parameters and identity verification is vulnerable to exploitation internally. Even the most stringent external controls can be compromised by an individual inside the network who is able to access, copy and remove data that they should not have access to. As an example, not every employee needs to have access to the human resources or financial data of an organisation. In the same vein, not everyone who requires access to this data needs to be able to copy it onto an external device such as their laptop or a flash drive.

While IAM is the next step in protecting organisations from data breaches, leaks and compromised information, the concept is not new. It is well known that limiting the number of people who can access sensitive data and controlling permissions as to what they can do with this data based on identity management narrows the potential for this data to be leaked. This in turn lowers risk. However, the evolution of the Internet and the growth of the mobile workforce and mobile devices necessitate that systems be opened up to outside use.

Security is no longer a matter of locking out the outside world and providing a username and password. This means that identity management itself has evolved to include roles, rules and parameters for each individual. This in itself, however, is a delicate balancing act since permissions and roles that are too rigid can inhibit business productivity, and permissions and roles that are too lax can once again introduce risk.

No rules

Further complicating this matter is the fact that there are no hard and fast rules regarding the optimal balance. This differs entirely depending on the organisation, the industry it operates in and its internal culture, amongst other things. Security touches on every system, every process and every person in an organisation. Because of these complexities and because of the need for certain external controls and best practices, it is often a good idea to outsource certain aspects of security, including database security elements such as IAM.

While security can never be entirely outsourced, especially for control purposes, partnering with an outsourced provider offers a measure of continuity. If handled completely in-house, this can never be internally guaranteed, since employees may leave an organisation and take their knowledge with them. Outsourced providers often have far greater aggregated experience and specialised knowledge with implementing specialised database security solutions such as identity and access management.

The database is mission critical to the majority of organisations, and if security implementations are implemented incorrectly, they can wreak havoc and even shut down entire systems when they go live. Outsourced specialists bring the necessary experience, shorten implementation times, have a knowledge of best practices and can provide a practical road map of what needs to be done and when in order to reach security goals.

As the threat landscape has evolved, so too has security, but the fact remains that criminals will always single out the weakest targets. Without sophisticated tools such as IAM in place to protect databases, organisations are left vulnerable to fraud, compromised data and corporate espionage. Added to this, the impending passing of the POPI Bill into law means that security is no longer just a matter of good practice but of compliance as well. To remain competitive in an increasingly regulated, data driven and threat riddled market, databases need to be protected, inside and out.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

NEC XON shares lessons learned from ransomware attacks
NEC XON Editor's Choice Information Security
NEC XON has handled many ransomware attacks. We've distilled key insights and listed them in this article to better equip companies and individuals for scenarios like this, which many will say are an inevitable reality in today’s environment.

iOCO collaboration protection secures Office 365
Information Security Infrastructure
The cloud, in general, and Office 365, in particular, have played a significant role in enabling collaboration, but it has also created a security headache as organisations store valuable information on the platform.

Gallagher Security launches Augmented Reality Training in Australia
Gallagher Training & Education Access Control & Identity Management
Gallagher Security has announced the latest addition to its innovative suite of training solutions, Augmented Reality Training, demonstrating its continued commitment to innovation and improving access to security training opportunities.

Fluss launches the next wave of IoT solutions
IoT & Automation Access Control & Identity Management News & Events
Fluss has announced its newest IoT product; Fluss+ continues to allow users to manage access from anywhere globally and brings with it all the advantages of Wi-Fi connectivity.

Cybercriminals embracing AI
Information Security Security Services & Risk Management
Organisations of all sizes are exploring how artificial intelligence (AI) and generative AI, in particular, can benefit their businesses. While they are still figuring out how best to use AI, cybercriminals have fully embraced it.

The future of digital identity in South Africa
Editor's Choice Access Control & Identity Management
When it comes to accessing essential services, such as national medical care, grants and the ability to vote in elections to shape national policy, a valid identity document is critical.

A strong cybersecurity foundation
Milestone Systems Information Security
The data collected by cameras, connected sensors, and video management software can make a VMS an attractive target for malicious actors; therefore, being aware of the risks of an insecure video surveillance system and how to mitigate these are critical skills.

Surveillance and cybersecurity
Cathexis Technologies Information Security
Whether your business runs a security system with a handful of cameras or it is an enterprise company with thousands of cameras monitoring sites across a multinational organisation, you must pay attention to cybersecurity.

Cyber-armour for a healthcare industry under attack
NEC XON Information Security Healthcare (Industry)
Malicious actors have exploited compromised credentials, a clear and present danger when healthcare providers' reliance on remote access software allows adversaries to disguise themselves as legitimate users and gain unauthorised access to critical environments.

Cybersecurity and AI
AI & Data Analytics Information Security
Cybersecurity is one of the primary reasons that detecting the commonalities and threats of what is otherwise completely unknown is possible with tools such as SIEM and endpoint protection platforms.