Identity Access Management or IAM in short refers to the policies and technology put in place by IT managers to manage employee or user access to applications and information within a business. With the alarming increase in cyber threats, it is crucial that businesses implement Identity Access Management solutions to ensure that sensitive systems and data is protected.
In the past, IT managers kept track of who had access to key applications and information manually, this made organisations extremely vulnerable to internal and external threats. Nowadays, there are automated Identity Access Management solutions that enable a high level of control for managers to ensure that data and information remain secure. For example, managers can maintain an audit trail of every employee and user who has accessed a certain application or information in the past, this allows them to maintain compliance with regulations and track any suspicious activity back to the respective employee or user.
Automated IAM solutions also provide security managers with the ability to effectively allocate information and application access to employees based on their job description and role. As an employee's role changes, their accesses can be easily revoked or added to ensure that only authorised individuals have access to sensitive information and data within an organisation.
Identity Access Management can be performed in many different ways, below is three solutions that are commonly used.
An Identity Access Management System plays a crucial role in maintaining information security, it enables a business to keep track of employee activity. Ensuring that systems and networks are accessed by authorised employees as per their role, helps in reducing the risk of cyber attacks or breaches, internal or external and strengthens the overall security and operational programs of the organisation. An Identity Access Management System also helps security teams detect any suspicious activity, communication, or issues that otherwise might go undetected.
The stakes are high in Australia: StickmanCyber’s analysis of OAIC data breach reports found that the vast majority of the country’s mega data breaches were the result of compromised credentials. Restricting administrative privileges and multi-factor authentication are also two of the eight mitigation strategies in ASD’s Essential Eight.
Identity Access Management helps protect against cyberattacks by enabling security teams to automate numerous user account-related tasks. This includes the ability to increase the efficiency for onboarding employees via an automated workflow, granting access to systems and applications they are authorised to access to, based on their role. It also improves the ability to remove employee access from all systems they were granted access to through the IAM platform, via a single button, making sure once an employee leaves the organisation, he or she no longer has access to sensitive information and systems.
Identity Access Management solutions help businesses meet industry compliance requirements and help them save costs by streamlining the way user account-related issues are dealt with. Identity and access management standardises and automates critical aspects of managing identities, authentication, and authorisation, therefore saving time and money while reducing risk to the business. The many benefits of protection offered by IAM solutions go a long way in uplifting a business's cybersecurity program.
Privileged Access Management (PAM) is a subset of Identity Access Management that focuses exclusively on protecting privileged accounts—accounts granted to a small number of users who need access to backend systems, databases, and other places where highly-sensitive information is stored. Whereas IAM safely authorises any user who needs access to a system, PAM limits access rights to the absolute minimum number of users necessary to perform authorised business activities.
In practice, PAM covers the strategies and technologies an organisation uses to control privileged access and permissions across its IT environment, for people as well as service accounts, processes and systems. Giving each employee only the level of access their role genuinely requires greatly reduces the damage a cyber attack can do, whether it starts with an external attacker or an internal mistake.
While there are a plethora of strategies that can be implemented when an organisation is considering privileged access management, a key concept that dictates these strategies is, the concept of least privilege. Least privilege is defined as the strict assignment of access rights and permissions for users, accounts, applications, systems, devices and computing processes, to the absolute minimum so that assigned organisational activities can be carried out.
Implementation of PAM in your organisation is a huge undertaking that is essential to uplifting the overall cybersecurity posture.
Privileged Access Management falls under the umbrella term Identity & Access Management or IAM. In coordination, both these activities enable an organisation to control credentials and privileges, by providing them with visibility and auditability. IAM controls help organisations authenticate user access ensuring that the right employees are given access at the right time, whereas PAM refers to the ability of an organisation to fine-tune its control, visibility and auditability of identities and activities.
The term Privilege refers to the authority a given account or process has over making or performing functions on a computer system or network. For example, a user requires access to make any security-related changes such as configuring networks/systems. Although assigning privileges to serve an important operational purpose that is essential for employees to be able to complete the tasks assigned to them, there is a huge security risk where privileges can be misused or abused by malicious internal or external actors to cause damage to an organisation.
The majority of employees operate in an environment of least privilege, there are two common types of non-privileged accounts or least privilege accounts, they are standard accounts or guest accounts. Standard accounts have restricted privileges associated with internet browsing, access to applications such as the Microsoft Office Suite or access to company resources, all this is dependent on the role and responsibilities assigned to the employee. A guest account on the other hand is heavily restricted to basic application access and limited browsing on the internet.
So what is a privileged account? A privileged account is an account that offers additional privileges in comparison to the accounts explained above. An example of a privileged account is a superuser account, these types of accounts are typically used by certain employees in the IT or administrative departments, who have unrestricted privileged access to make changes and execute commands within networks and systems. The common vernacular for superuser accounts on a Windows system is ‘Administrator’ and ‘Root’ for Unix/Linux systems.
The best way to enforce the least privilege is to eliminate all privileges across the entire business environment and then create a system that elevates privileges depending on specific actions and when these privileged activities are accomplished, privileges are then removed. There are a number of factors that need to be considered when implementing least privilege:
As a part of a privileged access management system organisations need to implement privilege separation measures, for instance, organisations need to separate administrative account functions from standard account requirements, separate auditing capabilities within admin accounts and separate system functions like read, edit, write, execute etc. By ensuring that each privileged account only has privileges designed to perform a unique set of tasks and eliminating overlap between different accounts, an effective privilege access management system can be established.
Employees should implement the following best practices when it comes to password management:
System and network segmentation achieve a separation amongst users and processes based on factors like levels of trust and needs. Security controls should be customised so that they are of a higher level when it comes to systems and networks that are of a higher trust level. By introducing segments it reduces the chance of attacks or breaches spreading beyond a single segment.
Organisations need to implement what is known as privileged session management or PSM, which consists of the activities of every privileged user, including third-party vendors, being managed and monitored from the time they launch a privileged session to when that session ends. By doing this any suspicious activities can be identified and eliminated in a prompt manner. Auditing activities can involve capturing keystrokes and live screens so that users are accountable for any security incidents or breaches that occur.
StickmanCyber’s managed infrastructure security service covers identity controls alongside patching, backup and filtering, and is designed to safeguard against internal and external threats to your cybersecurity. Our teams help establish different levels of access for different users, endpoints and systems; effective password management; and separating standard and high-value networks and systems. All this is aimed at preventing cyberattacks or minimising the impact and response time to any potential attack.
Privileged identity management (PIM) controls when and how users activate privileged roles, rather than leaving administrator rights permanently assigned. Microsoft, for example, describes Privileged Identity Management in Microsoft Entra ID as a service to manage, control and monitor access to important resources, with just-in-time and time-bound access, approval and multi-factor authentication to activate roles, and regular access reviews.
At Maturity Level One, ASD’s Essential Eight expects requests for privileged access to be validated when first requested, privileged users to have a dedicated privileged account, and privileged accounts to be prevented from accessing the internet, email and web services unless explicitly authorised. Maturity Level Two adds expiry: privileged access is disabled after 12 months unless revalidated, and after 45 days of inactivity.
Multi-factor authentication is essential but not enough on its own. ASD’s Essential Eight requires multi-factor authentication for privileged users from Maturity Level Two, and it must be phishing-resistant, because attackers can steal authentication tokens to get around weaker methods. Combine it with least privilege, separate administrator accounts and monitoring of privileged sessions.
Just-in-time access grants elevated privileges only when a user needs them for a specific task and removes them automatically afterwards, instead of leaving standing administrator rights in place. This shortens the window in which a stolen or misused privileged account can cause damage. Tools such as Microsoft’s Privileged Identity Management offer just-in-time and time-bound role activation.
The Privacy Act 1988 doesn’t prescribe specific technology, but Australian Privacy Principle 11 requires organisations covered by the Act to take reasonable steps to protect the personal information they hold. The OAIC’s guide to securing personal information says limiting internal access to those who need it to do their job is an important security mechanism, and asks whether administrative privileges are limited to staff who require them.