Security
Tese are effective ways to protect against ransomware – and great proof points for auditors to demonstrate progress.
Create visibility across identity profiles You can build upon the findings from your initial discovery process with ongoing, real-time visibility into the access (and actions) of identities across your organisation. Tis is where it’s essential to look beyond siloed categories of
controls or tools. We recommend an integrated identity security approach, where the underlying solutions can share information, act on insights and provide a unified view of audit data across all forms of human and non-human access. With this approach, you can gain a comprehensive view of who has
privileges and authorisation to what resources, with capabilities for discovering, adjusting, certifying and revoking access.
Assisting overburdened security teams Research shows that the mean time for organisations to identify a data breach is 204 days, despite the SEC now requiring public companies to report attacks within four days of determining an incident is ‘material’. How do you account for the limitations that many organisations have regarding time, bandwidth and staffing? Organisations can gain back time and potentially save money by
applying automated capabilities to replace resource-intensive, manual tasks that oſten bog down security teams. Tis includes automating governance processes to ensure checks and balances are in place for maintaining compliance. Some examples of these automatable processes include recurring access reviews to continuously enforce least privilege rules, or regularly discovering which identities have access to specific privileged accounts and sensitive resources.
innovate. A CyberArk analysis of the three major cloud service providers shows that a user can access approximately 1,400 native services that, collectively, have over 40,000 access controls. As part of their compliance programs, security teams should lean
into cloud complexities and discover issues like over-permissioned IAM roles, unmanaged shared accounts, and hard-coded credentials for developers working in the cloud. In many cases, it’s up to you to interpret compliance requirements and guidelines in the context of new identities, environments and threats (these variables won’t necessarily be mentioned by name in a 100-page regulatory document). In other cases, the direction may be clear-cut, calling out specific areas like virtual infrastructure. Regardless, high-risk access – in all its shapes, forms and locations – requires fierce protection.
Implementing controls to secure identities As mentioned, securing high-risk access demands more than just passive adherence to regulatory guidelines. You must demonstrate that you have strong controls in place to reduce risk and build organisational resilience against attacks. Organisations must implement robust controls, such as
stringent password policies, just-in-time access and multi-factor authentication to demonstrate that they are securing privileged access properly. Embracing emerging identity security principles like zero standing privileges can further fortify organisational resilience against evolving threats.
www.pcr-online.biz
Earning trust from auditors To build trust with auditors, compliance strategists must integrate visibility and controls effectively in a way that can be communicated to auditors, and this requires a structured approach. Firstly, you can only secure and protect what you know; engaging relevant teams early on to understand their workflows and documenting their systems and access can be a big step towards building a successful compliance strategy. Te next step is implementation and rollout. If external auditors
have called out gaps in controls, focus your implementation on a combination of prioritising critical systems, reducing complexity and employing automation for recurring access certifications. Finally, expand and communicate; you can’t do everything on day one, but in the same breath, attackers only need one gap to breach and wreak havoc. A proactive approach means building a clear plan for bridging gaps in your discovery process, and creating an implementation roadmap to bridge gaps, track progress and engage regulators openly. Combining strong identity security and proactive compliance
strategies is vital for manoeuvring through today’s regulatory environment. Embracing a comprehensive approach to identity management enables organisations to reduce risk, bolster operational resilience and build confidence with auditors and stakeholders. With regulations constantly changing and threats increasing, the significance of prioritising identity security within compliance efforts is clear.
July/August 2024 | 37
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52
