GSN Dec 2015/Jan 2016 Digital Edition

More documents

Recommendations

Info

Campbell on Crypto Insider Threats: Why passwords aren’t enough By Shawn Campbell The rise in hacking from hostile agents or rogue nations is of growing concern to IT professionals. But the threat is not just from the outside. Unauthorized access to local corporate networks by employees or contractors has created the notion of “insider threat” – which is now part of almost every discussion on cyber security. The definition of “insider threat” is broad. It can refer to everything from malicious, covert actions of individuals within or connected to an organization, to the accidental compromising of data when an end-user device is lost. How pervasive is the damage caused by unauthorized access? The Gemalto Breach Level Index reports that nearly 44,000,000 records have been breached by a malicious insider as of November <strong>2015</strong>, with the majority the result of identity theft. Targets have included organizations in US, South Korea, Mexico and the UK, to name a few. Although general end-users can pose a threat to an organization, the most significant data breaches often can be traced back to users with administrative privileges. When it comes to controlling insider threats, it is not effective to rely on simple passwords to access data. A multi-factor approach to authentication and access is the only The Gemalto Breach Level Index reports that nearly 44,000,000 records have been breached by a malicious insider as of November <strong>2015</strong>, with the majority the result of identity theft. real way to minimize the danger of insider threats. The ineffective password 22 Many administrative users in an organization have elevated privileges, because they need access to a wide range of applications, networks and systems. To keep it simple to access the infrastructure, administrators often fall back on a one-factor authentication method, such as a password. Unfortunately, passwords are not enough to protect your organization from insider hack and malware. They will not adequately protect employee computers and privileged workstations. Because each system and application requires its own password, administrators have to track and manage numerous passwords just to do their job on a daily basis. That’s a significant administrative burden, and often passwords are stored in unsecure locations where they easily can be lost, stolen or compromised. Furthermore, it is challenging to match a password to a user’s identity. Anyone with access to a password can pose as the password’s owner/user – and access any system for which the user has privileges. So, one-factor authentication is ineffective at securing access to an organization’s networks. To improve
Access Control, ID, Insider Threats security dramatically, organizations should utilize two or even three forms of authentication. Beyond the password: Multi-factor authentication Multi-factor authentication is vital to both securing access to networks and protecting users’ identities. After all, the more factors used to determine a person’s identity, the greater the trust of authenticity. With multi-factor authentication, an organization can be sure that users are who they claim to be. Because multi-factor authentication security requires multiple means of identification at login, it is widely recognized as the most secure method for authenticating access to data and applications. The best way to achieve multifactor authentication is by using a combination of the following factors: • Something You Know – password or PIN • Something You Have – token or smart card (two-factor authentication) • Something You Are – biometrics, such as a fingerprint (threefactor authentication) A strong authentication solution that validates the identities of users and computing devices that access the non-public areas of an organization’s network is the first step in building a secure and robust information protection system. How to put strong authentication to work Practically speaking, there are two aspects to follow when putting strong authentication to work: • Consider all access points • Ensure the solution reduces IT administrative and management overhead Consider all access points. Organizations need to be sure that they authenticate access to all sensitive information, whether that information is on premise or in the cloud. When it comes to the cloud, the same security mechanisms should be in place as in remote network access. Additionally, organizations should deploy security mechanisms to make sure that users are securely authenticated when accessing network resources from their mobile consumer devices (such as tablets and smart phones). Ensure the solution reduces IT administrative and management overhead. Authentication environments have to offer convenience and transparency for end users and administrators alike. 23 Administrators need to be able to manage all users across all devices and resources. That requires automation, central management, and visibility into user access across multiple resources. To ensure users have an optimal experience, administrators need to be equipped with granular controls and comprehensive reporting capabilities. On the end-user side of things, organizations should be able to offer users the type of authentication device that most suits their role and security profile. Organizations can offer users several authentication methods, ranging from contextbased authentication, through SMS, phone tokens or hardware tokens. This improves user acceptance and compliance with security requirements. Multi-factor authentication is not particularly complicated, but it surpasses passwords by a considerable margin when protecting your infrastructure and information from being compromised – especially from insider threats. Shawn Campbell, a nationally recognized cryptology expert, is VP of Product Management, SafeNet Assured Technologies. He can be reached at Shawn.Campbell@safenetat.com
Page 1 and 2: Government Security News DECEMBER 2
Page 3 and 4: NEWS AND FEATURES Battelle plans de
Page 5 and 6: Security Career Option #47: Critica
Page 7 and 8: Is proud to introduce two exciting
Page 9 and 10: other interdisciplinary needs of th
Page 11 and 12: cally underserved populations in th
Page 14 and 15: Trump’s Muslim immigration policy
Page 16 and 17: Coalition’s Legal Brief urges Sup
Page 18 and 19: Airport police support legislative
Page 20 and 21: FAA announces user-friendly aircraf
Page 24 and 25: Access Control, ID, Insider Threats
Page 32 and 33: “Working Together to Foster Safet
Page 34 and 35: “Working Together to Foster Safet
Page 36 and 37: Texas Observer: corruption, insuffi
Page 38 and 39: Coming Attractions - 2016 January P
Page 40: Secure access to cloud, data and do

GSN Dec 2015/Jan 2016 Digital Edition

Create successful ePaper yourself

Delete template?

Save as template?