Johannesburg, 01 Jun 2012
If knowledge is power, then data is currency in today's world. Cyber crime has become more lucrative than the drug trade, and businesses understand that security is of the utmost importance in protecting their data.
However, protecting from external threat is no longer enough. An increasing number of information crimes are being committed from within organisations, behind the firewall where the perpetrators are already inside the security systems. This makes protecting data from the inside, managing access and permissions and verifying the identity of those accessing data a critical item on the corporate security agenda.
Impending legislation of the Protection of Personal Information (POPI) Bill means that information security is a topic of discussion and debate around boardroom tables throughout South Africa. At its most basic, POPI aims to regulate the privacy of client data. This Bill has been driven by the pressing need to prevent increasing numbers of cases of identity theft, which can have devastating impact on the lives of the people who fall victim to it.
One of the core principles of POPI requires that all personal information be kept secure against the risk of loss, unauthorised access, interference, modification, destruction or disclosure. Once POPI comes into effect, companies by law will have to ensure that client information is adequately protected. Identity and access management has thus become critical in ensuring that unauthorised individuals cannot gain access to sensitive information, and that permission is granted to access data on a need-to-know basis.
However, the need for identity and access management to secure data is not only a matter of compliance, but a vital aspect of any comprehensive organisational security plan. Aside from identity theft, the rise in occurrences of data leaks for financial gain, corporate espionage, fraud and other data-related crimes highlights the importance of protecting data not just from external threat, but internally as well.
Database security without permissions, access parameters and identity verification is vulnerable to exploitation internally. Even the most stringent external controls can be compromised by an individual inside the network who is able to access, copy and remove data that they should not have access to. As an example, not every employee needs to have access to the human resources or financial data of an organisation. In the same vein, not everyone who requires access to this data needs to be able to copy it onto an external device such as their laptop or a flash drive.
While identity and access management is the next step in protecting organisations from data breaches, leaks and compromised information, the concept is not new. It is well known that limiting the number of people who can access sensitive data and controlling permissions as to what they can do with this data based on identity management narrows the potential for this data to be leaked. This in turn lowers risk. However, the evolution of the Internet and the growth of the mobile workforce and mobile devices necessitate that systems be opened up to 'outside' use.
Security is no longer a matter of locking out the outside world and providing a username and password. This means that identity management itself has evolved to include roles, rules and parameters for each individual. This in itself, however, is a delicate balancing act since permissions and roles that are too rigid can inhibit business productivity, and permissions and roles that are too lax can once again introduce risk.
Further complicating this matter is the fact that there are no hard and fast rules regarding the optimal balance. This differs entirely depending on the organisation, the industry it operates in and its internal culture, among other things. Security touches on every system, every process and every person in an organisation. Because of these complexities and because of the need for certain external controls and best practices, it is often a good idea to outsource certain aspects of security, including database security elements such as identity and access management.
While security can never been entirely outsourced, especially for control purposes, partnering with an outsourced provider offers a measure of continuity. If handled completely in-house, this can never be internally guaranteed, since employees may leave an organisation and take their knowledge with them. Outsourced providers often have far greater aggregated experience and specialised knowledge with implementing specialised database security solutions such as identity and access management.
The database is mission critical to the majority of organisations, and if security implementations are implemented incorrectly, they can wreak havoc and even shut down entire systems when they go live. Outsourced specialists bring the necessary experience, shorten implementation times, have a knowledge of best practices and can provide a practical roadmap of what needs to be done and when in order to reach security goals.
As the threat landscape has evolved, so too has security, but the fact remains that criminals will always single out the weakest targets. Without sophisticated tools such as identity and access management in place to protect databases, organisations are left vulnerable to fraud, compromised data and corporate espionage. Added to this, the impending passing of the POPI Bill into law means that security is no longer just a matter of good practice, but of compliance as well. To remain competitive in an increasingly regulated, data driven and threat riddled market, databases need to be protected, inside and out.
Share