With horror stories of cyber attacks in the headlines everyday, the risk of a cyber breach has moved from the hypothetical to being a very real and ever-present threat to Australian enterprises and their clients. In fact, according to Identity Defined Security Alliance (IDSA), 84% of organisations globally have experienced an identity-related breach in the last year.
In light of this, every Aussie business must ask itself whether it is adequately protected from the financial and reputational risks associated with a security breach. Firms today can house thousands, or millions of identities from employees and contractors to machines, across on premises, cloud and hybrid environments. With millions of potential access points, securely connecting the right people to the right data has moved well-beyond human capacity.
Annual, or even quarterly, organisational access review campaigns to verify that only the correct users have access to the right information are not only outdated, but are leaving companies open to costly attacks and breaches. When it comes to the number of businesses that are adequately prepared to face a cyber attack, the results are alarming.
A recent survey by Intelligent Business Research Services (IBRS) commissioned by SailPoint found that only 36% of companies are being forward thinking in their Identity Security efforts to prevent any unknown future risks. Considering that the right identity is extremely valuable to cyber attackers as it can be used to break into a network and facilitate all manner of fraud and identity theft, Identity Security needs to become a greater priority for Aussie businesses.
What are the risks of not planning for the unexpected?
Although most organisations are hyper aware of the need to develop a solid cybersecurity posture, Identity Security is not something that is being prioritised. Organisations need to place Identity Security at the core of any enterprise security strategy. This is not a one-off project to be ticked off but is something that can make or break an organisation, as cyber attacks can cause business disruptions, damage of reputation and financial loss.
Settling for something that is not good enough, is akin to doing nothing at all. No business can afford to allow access to its resources and systems without wrapping each access point with clear Identity Security controls outlining who should have access, for how long and how deep the access should go. Deep identity intelligence is required, alongside the right level of automation, to ensure the decisions can, and are, keeping pace with the velocity of change.
The shift towards SaaS
Although there has been a strong shift in the last three years towards SaaS for identity Security, our study shows that there are still many firms (46%) using single vendor platforms and on-premise tools, leaving businesses exposed to inconsistencies and human errors.
SaaS delivered identity solutions should be prioritised by Australian businesses for the vast benefits, such as automating time-consuming, error-prone manual SaaS tracking and audit management tasks, access risk intelligence in real-time with continuous monitoring, and visibility across usage, security, spend, and compliance, which includes shadow IT discovery.
Automation is a key aspect to a more efficient Identity Security program as it streamlines identity processes and decisions, like access requests, role modelling, and access reviews.
It frees employees to focus on innovation, collaboration, and productivity as it continuously analyses the organisation’s identity program to spot risky behaviour and easily connect and control access to every system holistically. Automation also makes it simple to enforce access controls and fine-grained entitlements that prevent conflicts of interest, information theft and compliance violations, enabling an effective, and compliant cyber security posture.
A zero-trust strategy
As firms recognise the increasingly volatile digital landscape and the security challenges they face, a strategic approach to cybersecurity has become imperative. Zero Trust’s approach builds a defense through a firm’s identity infrastructure, rather than the network perimeters.
With the increase in remote workers and third parties like contractors, vendors and suppliers accessing a corporate network, the concept that no one inside or outside of the network should be trusted until their identity has been verified, will enable firms to defend against attacks. This is why Identity Security is a vital element of an effective zero trust strategy.
Also, with the rise of non-human identities at the workplace, it is not recommended to trust a user simply by whether they are part of an organisation or the password they provide. It is essential to look at user attributes and behaviour patterns to understand who’s trying to gain access, how they are gaining access, and what they will do with that access.
Finally, as more organisations continue to shift from on-premise data centres to cloud applications, data authentication is more crucial than ever. In the cloud environment, applications are often hosted via third-party cloud service providers, which are an easy way for attackers to infiltrate, and this is where a zero trust approach is vital as it understands the identity of the user and device, and ensures all access is secure and appropriate.
Yet, despite its effectiveness, our survey shows that only 25% of ANZ firms have established a zero trust strategy. Developing a comprehensive zero trust framework starts with robust identity and access management, and this must become a priority for Australian businesses.
It is crucial for Aussie businesses to have complete visibility of all user types and their related access, including all permissions, entitlements, attributes, and roles so they can ensure employees receive the right access to the right resources to do their job when they need it.
In addition, Australian organisations can start with a current-state assessment to gauge the capabilities of their existing security technologies and their zero trust readiness so they can develop the right strategy to ultimately meet their business and organisational goals.
Nam Lam is the ANZ Country Manager at SailPoint.
