Individuals in the information security (infosec) space invaded Vegas for the 2018 BSides Las Vegas, Black Hat USA, and Defcon annual events. These events attract attendance from around the world with professionals who network and discuss the latest in information security research, development, and the cyber threat landscape.
The briefings during the week of August 6-10 covered a wide array of topics of interest but there was no way to take in everything that was available. Like many attendees, I focused on my own particular areas of interest, identity and access management solutions, and how they fit into the boarder infosec space. From the sessions I attended and conversations with our technology partners and other attendees, I walked away with some key themes:
1. You need to protect your data.
2. The IT perimeter isn’t what it used to be.
3. A holistic security strategy is needed.
During the keynote address, Jeff Moss expressed “Attackers have strategies but defenders only seem to have tactics.” A broad array of specialized security products and solutions showcased in the business hall focused on tactical areas of protection in an organization. Although all of these tools are built to help organizations add layers of protection to their environment, it clearly isn’t just about tools anymore. Emphasis needs to be put on combining technologies into a cohesive layer of protection. Organizations should be looking to implement solutions to help deploy a prevention strategy (Identity and Access Management Solutions) and data protection (Encryption) within their environment.
Zero-trust security approach with IAM products
Some briefings that particularly interested me explored the approach of a ‘zero-trust’ security approach. The notion of zero-trust security first surfaced five years ago in a Forrester Research report prepared for the National Institute for Standards and Technology (NIST). “The zero-trust model is simple,” Forrester posted then. They suggest that organizations “must eliminate the idea of a trusted network (usually the internal network) and an untrusted network (external networks). In zero-trust, all network traffic is untrusted.”
The increased adoption of cloud applications blurs the previously defined network perimeter lines and places applications outside of controlled corporate environments, a ‘zero-trust’ security approach is intended to address the challenges that this presents. What struck me is that the approach being explored is not just to examine the network traffic, but to evaluate the source or device the access request is coming from and validating the user who is making the request.
Combining Existing Technologies with Cloud Access Management Solutions
To solve the problem of a blurred perimeter, companies and technology partners are looking towards strong authentication and access management solutions to complement and enhance their existing infrastructures supporting a ‘zero-trust’ security model.
Many organizations have a combination of different technologies which make up their security posture. A comprehensive access management solution with multiple integration points enables these technologies to be consolidated and adds access controls and multi-factor authentication which increases the overall protection of a network.
If you consider a use case wherein an access management solution is layered with a next-generation firewall the result is that within the environment there is validation of user identities and the network traffic is secured which increases the security of the environment supporting the overall concept behind a ‘zero-trust’ security model.
Changing Security with Identity Management
Changing the security approach is not devoid of challenges. Users have been reliant on their trusted password for access for the majority of their working lives. Shifting to a solution which changes users’ day to day operation is often meet with resistance. The solution to this is implementing a culture of security within your organization and adopting a multi-factor authenticator that is easy to use and easy to implement.
The struggle to balance usability with security is something that any organization needs to overcome to ensure a successful deployment of a solution. The benefit of access management solutions is that they offer the user a single sign-on experience, with comprehensive context-based access policies that can increase security requirements when sensitive resources are being used without compromising the user experience.
If you find yourself considering if an Access Management solution is right for you to check out our Considering Access Management resource for important things to take into account. Also, review our SafeNet Trusted Access page for more information on Gemalto’s IDAAS solutions to support an access management implementation.
