PARTNER
Why identity security is the future of cybersecurity
By SailPoint
Interview with Frank Briguglio, Public Sector Strategist, SailPoint.
Indeed, security systems need to properly tell allies from enemies to be effective. This message extends to digital governmental systems, which require the accurate identification of users to prevent malicious users from gaining access.
Frank Briguglio, Public Sector Strategist for SailPoint, explores common cybersecurity challenges for governments and how identity can be the key to greater protection.
Identity replaces the perimeter
Like the Gileadite guards, making sure people are who they say they are is the basis of identity security. “The perimeter as we know it has dissolved and the identity has become the center of all cyber strategies,” says Briguglio.
The ultimate goal of identity security is having confidence that organisations are granting access to the appropriate people. This should be done “in a timely and efficient manner” while maintaining security objectives, he says.
Detecting the identity of a user or device that enters a digital network means taking into account their role within the organizations, geolocation, and the status of the device.
One example of the identity security approach was an agency that started using contextual data like employee type, employee contract and program data to better understand “risky users,” Briguglio shares.
The agency created watchlists of users within 30 days of leaving the project or agency. This allowed the behaviour analytics system to monitor users to prevent unauthorised data theft.
Zero Trust and least privilege
Singapore Minister for Communications and Information S Iswaran said that Singapore should take on a “Zero Trust” cyber model earlier this year, reported The Business Times.
It came after concerns were raised about the SolarWinds attack, which saw criminals target cybersecurity software, and gain access to thousands of government agencies and companies. But how can Zero Trust help?
Zero Trust assumes a firm stance that users should not be granted access unless they are identified. Controls are lifted only for authorised personnel, and features a robust identification vetting process, Briguglio says. This creates a defense system of “least privilege.”
Identity plays a critical role in Zero Trust and least privilege. Agencies must allow appropriate users to have convenient and fast access to ensure efficiency while maintaining security and privacy protections, says Briguglio.
The challenges that Covid-19 brings
Covid-19 presented security challenges as businesses across the world had to shift to remote working, says Briguglio. For example, employees had to access sensitive information from home networks and personal devices, he explains.
The challenge of issuing company security cards was also identified. Difficulties emerged as IT teams had to rely on in-person vetting as a critical aspect of verifying identity before issuing security cards, explains Briguglio.
He also says that enabling remote collaboration services presents issues. While many companies were able to transition to remote working successfully, work remains for companies that had to implement ad-hoc systems of access. They will need to audit and certify granted permissions to make sure they are still necessary, he says.
Covid-19 inspired many businesses to change their structure, providing an opportunity to rethink cybersecurity principles. Identity security and its role in Zero Trust systems are being adopted by governments to understand the future of cybersecurity.