Who should have access to your company’s information? How do you know that those who want to obtain entry have been given access? When is it necessary to refuse admission to a user with access privileges?
Your organization’s access control policy must answer these (and other) questions to protect your data effectively. The following is a primer on access control: what it is, why it’s necessary, the organizations need it most, and the challenges security professionals can face.
What is access control?
Access control is a way of ensuring that users are who they claim to be and have permission to access company data.
At its most basic level, access control is the selective restriction of data access. According to Daniel Crowley, head of research for IBM’s X-Force Red, which focuses on data protection, it consists of two key components: authentication and authorization.
Authentication is a way of ensuring that someone is who they think they are. Crowley points out that authentication isn’t enough to keep data secure. An additional layer, authorization, is required to decide if a user should be permitted to access data or complete the transaction they are attempting.
Data protection is impossible without authentication and authorization, according to Crowley. “Access controls are among the first policies investigated in any data breach,” says Ted Wagner, CISO of SAP National Security Services, Inc. “Whether it’s the Equifax hack, where sensitive data was exposed by a public-facing web server running with a software loophole, or the inadvertent disclosure of sensitive data inappropriately protected by an end-user, access controls are a critical component. The consequences of improper implementation or maintenance may be disastrous.”
Any company today with workers who link to the internet—that is, every organization—requires some access control. “This is particularly true for companies with workers who operate remotely and need access to company data, resources, and services,” says Avi Chesla, CEO of cybersecurity firm empower.
To put it another way, if your data has any meaning to someone who doesn’t have the proper permission to access it, Crowley says the company requires strict access control.
Another reason for solid access control: Access mining
On the dark web, the compilation and sale of access descriptors are becoming more popular. One crypto mining botnet, Smominru, for example, mined not only cryptocurrency but also sensitive details such as internal IP addresses, domain information, usernames, and passwords, according to a recent study from Carbon Black. The researchers at Carbon Black believe it’s “extremely likely” that this threat actor sold this information on an “access marketplace” to others who could then use remote access to conduct their attacks.
According to the authors of the study, these access marketplaces “provide a fast and simple way for cybercriminals to buy access to systems and organizations… These systems may be used as zombies in large-scale attacks or as an entry point to a targeted assault.” For example, Ultimate Anonymity Services (UAS) has 35,000 credentials for sale, with an average selling price of $6.75 per credential.
According to the Carbon Black researchers, cybercriminals will expand their use of access marketplaces and access mining since they can be “extremely lucrative” for them if compromised user credentials have higher privileges than required, the risk to an organization increases.
Access control policy: Key considerations
The majority of security professionals recognize the importance of access control in their organization. However, according to Chesla, not everyone agrees on how access control should be implemented. “In a complex environment without conventional boundaries, access control necessitates the implementation of permanent policies,” Chesla says. The majority of us operate in hybrid environments. Data transfers from on-premises servers or the cloud to workplaces, houses, hotels, vehicles, and coffee shops with free wi-fi hot spots, making access control challenging to implement.
Check Out: How I hacked Tinder accounts using Facebook’s Account Kit and earned $6,250 in bounties
“Adding to the danger is that connectivity is accessible to an increasingly wide range of devices,” according to Chesla, including PCs, laptops, smartphones, tablets, smart speakers, and other IoT devices. “Because of this variety, establishing and securing persistency in access policies is a real challenge.”
Access control methodologies were mainly static in the past. According to Chesla, “today, network access must be dynamic and fluid, promoting identity and application-based use cases.”
According to him, a sophisticated access management policy can be dynamically changed to respond to changing risk factors, allowing a business that has been hacked to “isolate the appropriate employees and data resources to mitigate the damage.”
According to Chesla, companies must ensure that their access management systems are “supported reliably across their cloud assets and applications and that they can be easily migrated into virtual environments such as private clouds.” “Access management rules must adapt depending on the risk factor, which means security analytics layers based on AI and machine learning must be deployed on top of current network and security configurations. They must also detect threats in real-time and automate access control rules in response.”
Four (4) Types of access control
According to Wagner, organizations must decide the access control model to use based on the type and sensitivity of their processing data. Older access models include discretionary access control (DAC) and mandatory access control (MAC); currently, the most popular model is role-based access control (RBAC); and the most recent model is attribute-based access control (ABAC) (ABAC).
Read Also: What Is Permission Marketing | Permission Marketing Definition
Discretionary access control (DAC)
The data owner decides on access in DAC models. DAC is a method of granting access rights based on user-defined laws.
Mandatory access control (MAC)
People are given access to MAC based on an information clearance created using a nondiscretionary model. A MAC policy is one in which access rights are granted based on central authority regulations.
Role-Based Access Control (RBAC)
RBAC implements key security principles like “least privilege” and “separation of privilege” by granting access based on a user’s position. As a result, someone attempting to gain access to data can only do so if it is considered appropriate for their job.
Attribute-Based Access Control (ABAC)
According to Wagner, each resource and user in ABAC is assigned a set of attributes. “A comparative evaluation of the user’s attributes, including the time of day, place, and location, is used to decide on resource access in this dynamic method.”
It’s critical for businesses to determine which model is best for them based on data sensitivity and operational data access criteria. Wagner advises organizations that process personally identifiable information (PII) or other sensitive data types, such as HIPAA or Controlled Unclassified Information (CUI) data, to make access control a key capability in their security architecture.
Access control solutions
A variety of technologies can support the different access control models. According to Wagner, multiple technologies may be necessary to achieve the desired degree of access control in some instances.
“The reality of data distributed through cloud service providers and SaaS applications, linked to the conventional network perimeter, necessitates orchestration of a secure solution,” he says. “Several vendors provide privilege access and identity management solutions that can be built into Microsoft’s standard Active Directory structure. Multifactor authentication is a component that can be used to improve security.”
Why authorization remains a challenge
According to Crowley, most organizations have mastered authentication, especially with multifactor authentication and biometric-based authentication (such as facial or iris recognition). Security professionals have taken the need for multifactor authentication more seriously in recent years, he says, as high-profile data breaches have resulted in the sale of compromised password credentials on the dark web.
Crowley believes that security professionals continue to make errors in the field of authorization. For instance, assessing and constantly tracking who has access to which data services, how they should access them, and under what conditions they should be given access can be complex. Inconsistent or unreliable authorization protocols, on the other hand, can lead to security bugs that must be detected and fixed as soon as possible.
According to Chesla, access control must be continuously checked, both in terms of alignment with the corporate security policies and operationally, to find any possible security gaps, regardless of how the company decides to enforce it. “You should conduct a governance, risk, and compliance analysis regularly,” he advises. “You should conduct recurring vulnerability scans on any application that performs access control functions, and you should compile and tracklogs for policy violations on each access.”
Access control in today’s dynamic IT environments must be viewed as “a living technology infrastructure that uses the most advanced tools, represents changes in the work environment such as increased mobility, understands changes in the devices we use and their inherent threats, and takes into account the increasing transition toward the cloud,” according to Chesla.