| | March 2022ENTERPRISE SECURITY8IN MY OPINIONBy Benjamin Corll, VP, Cyber Security and Data Protection, CoatsIdentity and Access Management - Why Is It Still So Hard? When it comes to granting appropriate access to a company, network, or computing system, one has to question: how do we do this and do it securely? History, and tradition, will say that one gets a set of credentials to prove that they are an authorized person. This generally means a set of username and a password will be provided to a person. Ideally this would be a unique account for each person for them to prove their identity. There are still systems or reasons for a shared account, yet those should truly not be used for everyday activities or BAU (business as usual) activities as they lose the ability to track activities back to a single user. Granted, there are some built-in administrative accounts which should be the emergency or "in case of emergency, break glass" type of accounts. For instance, when all else fails, use the root account. The usage should be restricted and logged. There are a couple of issues when it comes to user and identity management. These range from how we truly identify or authenticate a user and goes down to how we grant access to said user. Granting access isn't the hard part, the hard part is doing it in a way that is both convenient for an end user yet difficult for an attacker to usurp or take advantage of. First Part - Authentication: One of the main issues we have is how we identify the user. A simple username and password has been an accepted practice since before I started in the IT industry back in the mid-90's. Unfortunately, this simply isn't adequate any longer. Why? Because it doesn't protect the account or truly verify a user. If the credentials are lost, there is no telling who is using it. To combat this, or rather, to enhance this solution, there have been a couple of solutions. A popular solution is the implementation of multi-factor or two-factor authentication (MFA | 2FA). Traditionally this is who you are (username), what you know (password), and what you have (token, SMS code, biometric such as fingerprint). What this prevents is attacks such as brute-force attacks (which is where an
< Page 7 | Page 9 >