Identity management circumvents security threats

In a business environment that is increasingly dependent on technology, small and medium businesses in South Africa face the same security risks as larger organisations.

Hackers are universally seen as a peril to security and there are an increasing number of hackers who no longer operate for "fun" but for financial gain. Professional hackers are commissioned by competitor businesses to steal financial information or private customer data which can bring normal service levels to a standstill, or even result in penalties from governing bodies.

Faced with consequences for breached security and tough regulatory bodies many organisations are taking the threat of security seriously.

"Although the security risks are the same for small and medium businesses, smaller businesses, often suffer a more devastating effect as they do not have the capital to recover from a breach in security," says Michael Ansley, business development manager for TuringSMI Africa, a leading global provider of IT service management.

According to Ansley one way of combating security risks, is for all businesses, regardless of size to put identity management and security solutions into place. These solutions provide accurate management of users in the environment, ensuring that information passing through an organisation and the people who have access to the infrastructure, can only access the components which are essential to their specific roles.

"This removes any risk associated with inappropriate access. For example when an employee is dismissed organisations automatically retrieve office keys and access discs, but the same revoked rights need to apply to the IT infrastructure," says Ansley.

When users in an organisations environment request authorisation access, the identity management solution first asks "who the users are", "what they have access to", "who authorised the access" and "what are they intend doing with the access", making it virtually impossible for an unauthorised user to gain access.

Ansley maintains that although all businesses need to be constantly aware of emerging security threats and update their security solutions accordingly, security cannot be achieved by technology alone. "Technology and best practice needs to come together to enable the security risks within a business to be reduced or removed. These best practices ensure that the customer is always getting the best security to suit their individual requirements which fit in with their existing infrastructure. In IT security there is no single approach which fits all, rather each organisation needs to find an individual fit"

Although 100% security is possible in theory, Ansley says this degree of security would probably restrict accepted levels of service expected from business processes. "Businesses need to first understand the level of risk which is acceptable within their operating model and then level security accordingly. Identity management and security solutions go a long way in enabling businesses to reduce risk in their environments, whilst they strive to optimise their business and enable new business routes to market."