Using tomorrow’s tools to solve ­today’s security problems

Access & Identity Management Handbook 2019 Access Control & Identity Management, Information Security, Integrated Solutions

Organisations that do not have a clear longer-term security roadmap in place are putting themselves at risk of being compromised. The companies are already investing in tomorrow’s tools to solve today’s problems that will survive the ongoing onslaught to circumvent security solutions. This is the view of Jon Tullett, research manager – IT Services for sub-Saharan Africa at International Data Corporation (IDC).

Jon Tullett.
Jon Tullett.

“The first step in creating this roadmap is to start getting their security under control,” he says. “This includes using analytics for behaviour anomaly detection at both a network and user level, gathering the data to do baseline profiling. While that is the type of thing we are already doing today, many organisations are still not doing it with a long-term view in mind.”

To get their security under control, organisations must consider technologies that play to the cloud and be prepared to evolve with the technology. User awareness and training also remain key fundamentals that are receiving enough attention. “At the moment, training budgets are horrifically small and that must be addressed. Start by spending the money, but more importantly, evolve that training over time.

“Today, the breach is a credential theft or phishing attack. Companies that tackle that, and really invest in training, see tremendous reductions. A good example of this is Google, which combined good training with two-factor authentication for all their internal services and, since they’ve done that they’ve had zero phishing cases, but now they’ve moved on,” says Tullett.

Granular access rights

He says once organisations have this under control and have done the risk assessments required, they must start devolving those rights. “Break it up and create far more granular access controls. Create accounts which can only do very specific tasks, so that if they are compromised, the damage the hacker can do is limited. That also means that you have to start evolving the technologies that you’re using to ones that support this. While it can be a pain to do it on some platforms, it is usually baked into modern cloud platforms. The key here is to ensure that should you need to revoke access on mass, you can do it.”

The next step is to roll out two-factor authentication much more aggressively. “For users that may mean a token, mobile authentication or something similar and for system accounts it will probably mean digital certificates. Whatever it may be, start to improve your authentication. Once you have that in place, you really want to be on top of activity management. So, looking at what accounts are doing what.

You can’t really do this until you have your accounts consolidated and organised, but you want to know everything that an account does in a very standard format. That allows you to feed the information into an engine and get an activity report back when something goes wrong, so that you can identify any anomalies and address them quickly.

Cloud evolution

He believes that within the next two years, most of this type of anomaly detection will be happening largely out of the cloud. “This is going to happen alongside your evolution to cloud. The AI platforms in the cloud are maturing very fast, so within the next couple of years we’re expecting to see an awful lot of cloud services just plugging AI in because they can. So, there will be a lot of machine learning happening and, further down the line, we will see people looking at how they can use that to optimise and automate,” says Tullett.

“In the longer-term, organisations will also start looking at automation, where an anomaly will be detected, and automatically investigated and remediated. While it will take a couple of years for this to happen, organisations must include this in their security roadmaps. Today’s problems are that you need to start getting your identities under control and doing better analytics, but tomorrow that same platform is going to be your machine learning platform and is going to be a complex, better managed identity platform that will do a lot more things.”

He points out that the criminals also have a roadmap and it is often more advanced than those of organisations. “They know what technologies are coming, they are getting the required skills in place and are already looking at how to use the technology for various purposes. They are following a roadmap and if you are not doing the same, they are leaving you behind.

“You must remember that these are career criminals, this is what they do for a living, and so, if you make it impossible for them to phish, they are going to find something else to compromise. What they are doing will evolve in response to you. If we can eradicate phishing, that’s great, but that threat is going to move to something else and you must be willing to keep following that path.”





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Data security and privacy in global mobility
Security Services & Risk Management Information Security
Data security and privacy in today’s interconnected world is of paramount importance. In the realm of global mobility, where individuals and organisations traverse borders for various reasons, safeguarding sensitive information becomes an even more critical imperative.

Read more...
Sophos celebrates partners and cybersecurity innovation at annual conference
News & Events Information Security
[Sponsored] Sun City hosted Sophos' annual partner event this year, which took place from 12 to 14 March. Sophos’ South African cybersecurity distributors and resellers gathered for an engaging two-day conference.

Read more...
Future trends for electronic safety and security in mining
Fang Fences & Guards Mining (Industry) Integrated Solutions AI & Data Analytics
The mining industry is ever evolving, driven by technological advancements and the growing need for enhanced safety and security measures, with significant innovation seen in turnkey electronic security for mining operations.

Read more...
Unlocking enhanced security for mining
Mining (Industry) Integrated Solutions
In the dynamic landscape of African mining, security remains of paramount concern as threats evolve and challenges persist, and mining companies seek innovative solutions to safeguard their operations, assets, and personnel.

Read more...
A constant armed struggle
Technews Publishing XtraVision Editor's Choice Integrated Solutions Mining (Industry) IoT & Automation
SMART Security Solutions asked a few people involved in servicing mines to join us for a virtual round table and give us their insights into mine security today. A podcast of the discussion will be released shortly-stay tuned.

Read more...
The CIPC hack has potentially serious consequences
Editor's Choice Information Security
A cyber breach at the South African Companies and Intellectual Property Commission (CIPC) has put millions of companies at risk. The organisation holds a vast database of registration details, including sensitive data like ID numbers, addresses, and contact information.

Read more...
AI augmentation in security software and the resistance to IT
Security Services & Risk Management Information Security
The integration of AI technology into security software has been met with resistance. In this, the first in a series of two articles, Paul Meyer explores the challenges and obstacles that must be overcome to empower AI-enabled, human-centric decision-making.

Read more...
Milestone Systems joins CVE programme
Milestone Systems News & Events Information Security
Milestone Systems has partnered with the Common Vulnerability and Exposures (CVE) Programme as a CVE Numbering Authority (CNA), to assist the programme to find, describe, and catalogue known cybersecurity issues.

Read more...
Defending against SIM swap fraud
Access Control & Identity Management
Mobile networks must not be complacent about SIM swap fraud, and they need to prioritise the protection of customers, according to Gur Geva, Founder and CEO of iiDENTIFii.

Read more...
Access Selection Guide 2024
Access Control & Identity Management
The Access Selection Guide 2024 includes a range of devices geared specifically for the access control and identity management market.

Read more...