Hackers Love Poor IAM Strategies
Identity and Access Management (IAM) strategies are designed to protect systems from malicious activities, but new technologies are allowing hackers to launch more sophisticated attacks. Many businesses fail to detect and address weaknesses in their systems in time to prevent breaches from occurring, and this failure is leaving the door wide open for devastating attacks.
IAM Strategies: The Good and the Bad
Continued reliance on outdated IAM methods is one of the biggest problems with system security. Over 80 percent of breaches are the result of weak, default or stolen passwords, which is hardly surprising when you consider over 60 percent of people use the same password for multiple websites or services. In a business setting, reusing passwords across platforms makes it easy for hackers to gain access to any application and the data it handles.
The problem gets worse if routine security audits aren’t carried out and enforcement of proper provisioning and deprovisioning is poor. As employees’ responsibilities change, they require new privileges and often aren’t restricted from accessing the data and applications required for their previous positions. Known as “privilege creep“, this process leaves security loopholes through which hackers can infiltrate large portions of the network with a single set of stolen credentials.
Companies seeking to strengthen their approach to IAM are investing in more advanced authentication protocols, such as multi-factor authentication (MFA), one-time passwords, federated identities, and single sign-on (SSO). Many of these changes are being implemented using centralized cloud-based IAM tools designed to automate and simplify the IAM process.
Recent Incidents Highlight Hackers’ Prowess
Although some businesses are getting savvy with new security strategies, many techniques still fall short. Part of the difficulty lies in a lack of resources. Only 3 percent of organizations have the technology to defend against modern attacks, and only 10 percent have employees with the proper skill sets. These dismal numbers make it clear how 74 percent of the U.S. companies hacked in 2017 were ignorant of the breaches at the time they occurred.
Phishing and malware remain some of the most common tools used by hackers and contributed to the 60 percent increase in business email compromise. Hackers are employing automation and social networking to make their tactics more believable, and no business is immune to attack.
One of the most notable and unsettling breaches targeted journalists and activists working in the Middle East and involved a technique used to undermine the apparently reliability of two-factor authentication. Hackers used fake Google and Yahoo security alerts to trick users into clicking a link to reset their passwords and subsequently phished both the passwords and the associated “secret” codes. Through automation, they were able to compromise the accounts of over 1,000 people, proving a second form of authentication doesn’t always guarantee security.
Modernizing Your Approach
Your business must perform two types of audits to determine the state of your IAM strategy and what steps must be taken to improve protection for your systems:
• Security audit – Reveals weak points in security protocols
• IAM audit – Highlights instances of privilege creep, and uncovers outdated or dormant accounts
Conducting these audits on a regular basis prevents problems with access control and helps your IT department stay on top of crucial security updates. To maintain security between audits, implement a tool to track and monitor user activity. Modern tracking applications incorporate machine learning (ML) technology to distinguish normal behavior patterns from malicious aberrations, thereby providing smarter solutions for access control.
Integrating tracking tools with a centralized IAM solution makes it easier to manage changing access needs and ensure permissions are granted and revoked as needed. Your IAM platform should include tools for onboarding, offboarding and automating provisioning to maintain the minimum amount of access necessary for each employee. As you add applications to your suite of business tools, make sure they’re designed to integrate with what you already have in place so that you can make use of stronger security options, such as federated identities and SSO.
Regardless of how advanced your IAM strategies are, ongoing employee education remains a critical part of security maintenance. A single weak or compromised password can facilitate system intrusions, and a lack of knowledge regarding phishing and malware scams leaves systems open to hackers. Train your employees in the proper management of credentials, and take steps to ensure everyone understands how to recognize an email scam or spoofed website. Protecting your network in the midst of rapidly changing security requirements means remaining diligent and adaptable. By modernizing your approach to IAM, you make your business network more flexible and able to handle new threats.
Commit to routine auditing, ongoing education and continued security improvements to maintain strong and reliable IAM policies capable of thwarting hackers before they infiltrate your systems. Identity Management Institute offers various training programs.
