Protecting intellectual property and trade secrets has been a key driver of competitive advantage; however, protecting these vital assets has become more challenging as technology has evolved. In the age of Digital Transformation, it is simple to copy, duplicate, and distribute data making it extremely difficult to protect proprietary information. Even more challenging is the fact that the majority of digital assets have no built-in mechanism that prevents the duplication and distribution of this data without permission. When digital protections do exist, such as Digital Rights Management, clever attackers frequently defeat the security measures that are designed to keep intellectual property secure. During COVID-19, organizations rapidly moved workers to remote access with limited VPN connections, and, new access control requirements have compounded the difficulty in protecting digital assets.

So how can we hope to keep up with these challenges? Enter Identity Governance and Administration (IGA). IGA solutions are designed to evaluate and enforce security policies for the enterprise at a granular level, offering new capabilities to manage user access and protect sensitive information. 

[feature_box style="10" only_advanced="There%20are%20no%20title%20options%20for%20the%20choosen%20style" alignment="center"]

Before you continue reading, how about following us on LinkedIn?

lang: en_US

[/feature_box]

Identity Governance Administration solutions provide a central authority for policy development and enforcement. These policies begin by establishing the worker’s role in the organization and what they are entitled to do (access and actions). In addition, IGA products support the CIA Triad (Confidentiality, Integrity, and Availability) of data by employing foundational security concepts such as Least Privilege and Segregation of Duties. Using these capabilities, IGA products can fully enforce access to any and all digital resources under their supervision. From a technology perspective, many IGA practitioners can define access to the infrastructure (Devices, Directories, Databases, Applications, APIs, etc.) based upon attributes and roles specific to those users requesting access. 

Here are a few things to consider when leveraging IGA platforms to improve information protection as part of your information security program:

1. Defining Identity Governance Policies and Procedures for enforcing regulatory and contractual trade compliance.
2. Define a business process of how access to proprietary Technical Data and how information will be requested and approved.
3. Define the actors and the roles for ownership and approval workflows.
   • Resource Owner – responsible for and approves requests based upon operational needs
   • Compliance Officer – responsible for audit and access reviews to ensure organizational compliance with policy and regulations.
4. Leverage IAM/IGA tools to identify resources (systems, databases, APIs, applications, folders, and stored documents) that require access approval and identify and apply relevant access policies.
5. Establish regular recertification/attestation campaigns to validate access to systems and applications; which includes a review of Groups, in particular:
   •  Group Memberships – Review and validate that the users and/or nested groups listed as members represent the current set of users using the group’s assigned permissions
   • Group Permissions – The permissions assigned to the group are reviewed and validated to assure that they conform to the Least Privileges model. That is, the group permissions are only those needed for group members to accomplish their work-related tasks and provide no additional access,
   • Group Validation– Validate that the group is still necessary for business purposes. Groups with no current purpose should be deleted or disabled (if possible)
6.  Assume all resources require compliance until they are identified as not requiring compliance (follows least privilege model). 
7. Develop regular training and communication programs to inform end-users of corporate policies.

The purpose of information security is to protect IT resources from security breaches, whether external, internal, deliberate, or accidental. Information security begins by validating user identities, developing and applying policies, and then granting the appropriate level of access to complete the user’s job duties while enforcing controls such as Segregation of Duties. IGA solutions provide a platform to better manage access while improving efficiency, ensuring policy compliance, and mitigating the risk of data exfiltration.

Learn more about IGA with these articles and resources:

• Bell Powers Ahead with IGA Assessment and Roadmap
• Seven Goals for Identity Governance Success
• Five Identity Governance Best Practices

This post was written by Ron Bowron, Director of IAM at Idenhaus Consulting. 

Follow @Idenhaus on Twitter and subscribe to our Identity Management biweekly or our healthcare IT biweekly newsletter.

Learn how Identity and Access Management can help secure your organization in our book, Reimagining Identity Management: How To Design, Choose And Implement The Right IAM Solution For Your Business.

Idenhaus is honored to be featured in the Top 10 Identity Governance and Administration Consulting/Service Companies of 2019.

By going to work quickly to solve the most challenging cybersecurity and identity management problems, Idenhaus takes the pain out of securing corporate information and assets for companies that aspire to maximize their potential in this digital age. Click here to contact us