Skip to main content

NEWS

PATECCO and One Identity Reinforce Together the PAM processes in WM Gruppe

Over the past few years Privileged Access Management, has become one of the most relevant areas of Cyber Security associated with Identity and Access Management, that deals with identifying, securing and managing privileged credentials across the Organization’s IT environment.

In its practice, PATECCO acts as a vendor neutral provider of value-added services and implements PAM solutions deploying products of market-leading PAM vendors such as One Identity. PATECCO develops, implements and manages PAM as an information security and governance tool to support finance companies in complying with legal and regulatory compliance regulations.

While WM Gruppe isn’t a bank, it provides banks and other financial services companies with data on financial markets and instruments. And with its systems hooking up to those of customers via application programming interfaces (API), it must ensure its cybersecurity is as robust as that of its clients.

  • Challenges of WM Gruppe

With regulatory requirements increasing, WM Gruppe wanted to reinforce privileged account management (PAM) to counter cybercriminals while improving operational efficiency. Privileged accounts are known to be vulnerable to attack, resulting in catastrophic consequences when hacked. PAM processes in WM Gruppe were home-grown, meaning they’d evolved over time as the company expanded.

Unfortunately, PAM processes at WM Gruppe were manual and time-consuming to operate, posing security risk across its 800 applications and multiple privileged accounts. It was easy for procedures like password changes to be delayed if a member of the IT infrastructure team responsible for making the changes was out-of-office or otherwise engaged. Plus, reporting on who had access to what servers and applications, and when, was a constant concern due to data inaccessibility.

  • The solution

WM Gruppe looked for a PAM solution as part of a wider cybersecurity review across the entire organization. It chose One Identity Safeguard for Privileged Passwords for a couple of key reasons. It fully automated PAM processes, removing password management, and it made PAM fully auditable. The company worked closely with PATECCO and its partner – One Identity, which supported WM Gruppe with the initial deployment of Safeguard. The result was closure of any potential holes in PAM processes while saving hours of work through automation and improving auditing capabilities.

Why WM Gruppe chose PATECCO and One Identity?

  • PATECCO was able to implement both a PAM and an IAM solution which enables the customer to get the full Identity Management package from one supplier.
  • PATECCO developed the integration of the IAM IT Shop to the USU ITSM (IT Service management) and was adapted to the customer’s requirements.
  • WM Gruppe saw a 100 percent improvement in PAM using Safeguard. The solution raised PAM to a new level without increasing its workloads.
  • One Identity Safeguard strengthened privileged account controls and saved hours of work and increased protection.
  • Using the workflow engine in Safeguard drastically reduced the window of opportunity if a password gets hacked.

Info source: One Identity

How to Solve Compliance Challenges with IAM

As experts in identity and access management, we noticed that many of our clients face different issues with access control. In particular, we find that most business owners and managers do not have the proper identity access management measures. Based on our long-term experience in Identity and Access Management, we guide and support clients on meeting the access control measures governing their industries.

In this article, we will discuss the key challenges that most of our clients face. We will also guide you on ways to prevent them and ensure compliance using different IAM tools.

  • Common Access Control Issues Facing Industries


As technology progresses, companies are now handling their tasks using digital systems. While this helps, controlling who can access certain information gets more complicated. Besides, a great number of employees are currently working remotely, which makes it challenging to oversee all their activities.

One issue most companies are facing is Sarbanes Oxley compliance. This law mainly applies to the financial industry. It focuses on protecting investors from fraudulent activities by such institutions. When checking if companies are abiding by this law, PATECCO experts find that most do not have enough measures to control access to data. This is because they focus on meeting financial regulations and neglect access control.

More common compliance issues faced by institutions in different sectors are:

• Meeting PCI requirements

• SOC compliance

• FFIEC compliance

The healthcare industry is another one facing different compliance challenges. One common issue in this field is meeting HIPAA requirements. As most facilities focus on improving their technology, they fail to develop measures to limit access to sensitive information.

Most data control issues in the healthcare industry revolve around creating various security measures to protect medical documents. Such include multi-factor authentication and single sign-on protocols. ISO 27001 and ISO 27002 are other security standards that most brands do not know how to meet. Without the proper measures, managing information security is tricky. This issue then makes it hard to pass audits and safeguard data from people without authorized access.

  • Ensuring Access Control Through Provisioning and Reviews

After learning about the issues faced when meeting different regulations, you may be concerned how to avoid them. Implementing access control policies helps reduce the risk of data breaches. It also makes it hard for unlicensed people to access sensitive information.

One way you can solve such issues with Identity and Access Management is through provisioning. This process involves assigning specific employees to systems with sensitive information. It also includes issuing them with IDs that allow them to access protected files.

When provisioning with IAM, you should have complete control over access rights. If an employee leaves your company, you should delete their account or deactivate it to withdraw their rights. This way, you will prevent breaches and feel confident that your data is safe. After putting in place measures to limit access, it is also advisable to review them regularly. We also recommend to check if all your employees have the proper access based on their job roles. Besides, confirm that they are not abusing this power or using the information for personal activities.

You should also take into account that in most cases reviewing access may be tricky without the right tools. For example, recording the results of each assessment is time-consuming, but IAM tools are able to simplify this process by automating compliance assessment. These programs then produce a report to help you identify ways to improve access control.

  • Ensuring Compliance with Privileged Access

Controlling access goes beyond having security measures and reviewing them. It also involves tracking the employees that have permission to view or use specific files. Still, most companies find it hard to manage employees with such privileges.

For example, after shifting from one system to another, you can forget to change your admins. This means that they will still be able to access files in the other program. If a data breach happens, it will not be easy to pinpoint its source. By using IAM tools, you can quickly identify the employees using specific systems. It is also possible to simplify tracking privileged access. These programs also allow you to set security measures to limit access.

Getting IAM solutions to limit access of your current and past employees is the best way to abide by different regulations. These come with various tools to help you secure privileged accounts. With such features, it is simpler to revoke access and avoid security threats.

Types of IAM Solutions Available Today

The most suitable IAM solution for your company may vary depending on your needs. For instance:

  • Privileged Access Management is one of the most common IAM solutions. This one focuses on protecting privileged accounts. If around 20 of your employees have access to different systems with IAM protocols, you can use PAM to protect the most sensitive ones. This solution is mainly helpful in meeting NERC compliance needs.
  • User provisioning IAM tools are another subset you can use to ensure all accounts have the correct permission. With these solutions, it is possible to control the access rights of all your employees. The compliance needs you can meet with the tool are GLBA, NERC, GDPR, and HIPAA. An important aspect to look into when adopting access control tools is the role of each employee. Besides, determine the entitlement they have to sensitive data. You should also consider the cost and compare it against the benefits of getting the software.
  • Data governance IAM solutions protect sensitive information using measures like SSO. Its main drivers are FERPA, PCI-DSS, HIPAA, and FERPA.

More IAM solutions you can find in the market today, and their driver compliances are:

• Access controls- HIPAA, SOX, NERC, and GDPR

• Identity governance- SOX and GLBA

• Multi-factor authentication tools- GDPR, PCI-DSS, and GLBA

Since each of these IAM solutions has unique features, you should understand the needs of your firm. Taking this measure makes it easier to pick a tool that addresses them and helps you stay compliant.

Why Segregation of Duties is Important for Information Security

When we talk about IT security, the first things that come to mind are programs such as firewalls or malware detection software. However, security is as much about the organization systems and process your company has in place as anything else. Of those organizational structures, one of the most important matter is how companies assign responsibility for certain IT-related tasks. This is called Segregation of Duties.

What is Segregation of Duties

Segregation of Duties is an internal control that prevents a single person from completing two or more tasks in a business process. Separation of Duties, as it relates to security, has two primary objectives. The first is the prevention of conflict of interest, the appearance of conflict of interest, wrongful acts, fraud, abuse and errors. The second is the detection of control failures that include security breaches, information theft and circumvention of security controls. Organizations require Segregation of Duties controls to separate duties among more than one individual to complete tasks in a business process to mitigate the risk of fraud, waste and error (for example in financial enterprises).

SoD processes break down tasks, which can be completed by one individual, into multiple tasks. The goal is to ensure that control is never in the hands of one individual, either by splitting the transaction into 2 or more pieces, or requiring sign-off approval from another party before completion.

Breaking tasks down prevents risks, however, it doesn’t come without other costs. For one, it can negatively impact business efficiency. Payroll management, for example, often faces error and fraud risks. A common SoD for payroll is to ask one employee to be responsible for setting up the payroll run and asking another employee to be responsible for signing checks. This way, there is no short circuit where someone could pay themselves or a colleague more or less than they are entitled to.

The Importance of Segregation of Duties

The concept behind Segregation of Duties is that the duty of running a business should be divided among several people, so that no one person has the power to cause damage to the business or to perform fraudulent or criminal activity. Separation of duties is an important part of risk management, and also relates to adhering to SOX compliance.

Segregation of Duties is recommended across the enterprise, but it’s arguably most critical in accounting, cybersecurity, and information technology departments. Individuals in these roles can cause significant damage to a company, whether inadvertently or intentionally. Therefore, finance and security leaders should pay attention to separation of duties. It is important to build a role with IT security capabilities so that no one can abuse it.

Segregation of Duties in IT security

The issue of separation of duties is of a great importance. A lack of clear and concise responsibilities for the CSO and chief information security officer has fuelled confusion. It is imperative that there be separation between the development, operation and testing of security and all controls. Similarly, if one individual is responsible for both developing and testing a security system, they are more likely to be blind to its weaknesses.

To avoid these situations, responsibilities must be assigned to individuals in such a way as to establish checks and balances within the system. Different people must be responsible for different parts of critical IT processes, and there must be regular internal audits performed by individuals who are not part of the IT organization, and report directly to the CEO or board of directors. SoD in the IT department can prevent control failures that can result in disastrous consequences, such as data theft or sabotage of corporate systems.

An important part of SoD implementation is the principle of least privilege, as well. Everyone should have the minimum permissions they need to perform their duties. Even within a certain IT system, individuals should only have access to the data and features they specifically require. Permissions should be regularly reviewed, and revoked in case an employee changed role, no longer participates in a certain activity, or has left the company.

SOD in risk management

Segregation of Duties is a fundamental internal accounting control prohibiting single entities from possessing unchecked power to conceal financial errors or misappropriate assets in their specific role. SOD controls require a thorough analysis of all accounting roles with the segregation of all duties deemed incompatible. For example, someone responsible for inventory custody can’t also oversee transactional recordkeeping regarding inventory.

SOD policies can also help manage risk in information technology by preventing control failures around access permission. By segregating workflow duties, your team ensures the same individual or group isn’t responsible for multiple steps in the access permission process.

When it comes to risk management in Governance Risk and Compliance, effective SOD practices can help reduce innocent employee errors and catch the not-so-innocent fraudulent filings. Both can elevate compliance risk by violating regulations like the Sarbanes Oxley Act of 2002, penalizing companies for filing incorrect financial information capable of misleading investors

Including a Segregation of Duties control component in your risk management strategy helps reduce risks that can be costly to your organization – whether it’s financial, damage to your brand, or the stiff penalties imposed for regulatory infractions. By segregating duties to minimize errors and potential fraud, your organization can remain at or below its desired risk threshold.  Working with experienced cybersecurity experts is crucial for companies of all sizes, across all industries. That is why businesses have to take charge of their own protection and implement strategies designed to limit the damage a single attack is capable of.

How to Manage Security in a DevOps Environment

In recent years, DevOps has been gaining a great popularity among IT decision-makers who have realized the benefits that it offers. DevOps is based on automation and cross-functional collaboration. However, not many IT executives are aware of the security risks in a DevOps environment. This article reviews the basic concepts of a DevOps pipeline and suggests several ways for securing it.

What Is DevOps?

The standard DevOps model focuses primarily on development and operations. It represents a collaborative or shared approach to the tasks performed by a company’s application development and IT operations teams.

While DevOps is not a technology, DevOps environments generally apply common methodologies. These include the following:

– continuous integration and continuous delivery or continuous deployment (CI/CD) tools, with an emphasis on task automation;

– systems and tools that support DevOps adoption, including real-time monitoring, incident management, configuration management and collaboration platforms; and

– cloud computing, microservices and containers implemented concurrently with DevOps methodologies.

A DevOps approach is one of many techniques IT staff use to execute IT projects that meet business needs. DevOps can coexist with Agile software development, IT service management frameworks, such as ITIL, project management directives, such as Lean and Six Sigma, and other strategies. In a DevOps security culture, all team members play an active role in securing software. It allows teams to test early and often throughout the software creation process. This enables them to analyze their software as they build it, reducing the likelihood they release buggy software.

How to Secure the DevOps Environment:

The following tips from this article can help you address DevOps environment’s security risks and ensure that any vulnerabilities are handled properly.

  • Establish Credential Controls

Security managers need to make sure that the controls and access to different environments is centralized. To achieve this, managers have to create a transparent, and collaborative environment to ensure that developers understand the scope of their access privileges.

  • Consistent Management of Security Risks

Establish a clear, easy-to-understand set of procedures and policies for cybersecurity such as configuration management, access controls, vulnerability testing, code review, and firewalls. Ensure that all company personnel are familiar with these security protocols. In addition, you should keep track of compliance by maintaining operational visibility.

  • Automation

Security operations teams need to keep up with the fast pace of the DevOps process. Automation of your security tools and processes can help you scale and speed up your security operations. You should also automate your code analysis, configuration management, vulnerability discovery and fixes, and privileged access. Automation simplifies the process of vulnerability discovery and identification of potential threats. Moreover, automation enables developers and security teams to focus on other tasks by eliminating human error and saving time.

  • Privileged Access Management

You should limit privilege access rights to reduce potential attacks. For instance, you can restrict developers and testers access to specific areas. You can also remove administrator privileges on end-user devices, and set up a workflow check-out process. Additionally, you should safely store privileged credentials and monitor privileged sessions to verify that all activity is legitimate.

Problems Addressed

DevOps solves several problems, such as:

  • Reduced errors: Automation reduces common errors when performing basic or repetitive tasks. Besides, automation is valued for preventing ad hoc changes to systems, which are often used instead of complete documented fixes. In the worst case the problem and solution are both undocumented and the underlying issue is never actually fixed, and is not much more than the fleeting memory of the person who fixed the issue in a panic during the last release.
  • Speed and efficiency: Here at PATECCO we talk a lot about “reacting faster and better” and “doing more with less”. DevOps, like Agile, is geared towards doing less, better, and faster. Releases occur more regularly, with less code change between them. Less work means better focus, and more clarity of purpose with each release. Again, automation helps people get their jobs done with less hands-on work.
  • Bottlenecks: There are several bottlenecks in software development: developers waiting for specifications, select individuals who are overtasked, provisioning IT systems, testing, and even processes (particularly synchronous ones, as in waterfall development) can all cause delays. The way DevOps tasks are scheduled, the reduction in work being performed at any one time, and the way expert knowledge is embedded into automation, all act to reduce these issues. Once DevOps is established it tends to alleviate major bottlenecks common to most development teams, especially the over-burdening of key personnel.
  • Security: Security becomes not just the domain of security experts with specialized knowledge, but integrated into the development and delivery process. Security controls can be used to flag new features or gate releases — within the same set of controls you use to ensure custom code, application stacks, or server configurations, meet specifications.

The fundamental value of DevOps is speed to market. However, companies that do not incorporate security into every stage of their development and operations environment risk losing the value of DevOps. To ensure a secure environment, you need to adopt a DevOps model, enable privileged access management, and secure your software supply chain.

What is the Difference Between Role-based Access Control and Attribute-based Access Control

Nowadays, especially in this modern digital workspace, working together successfully as a team is a great challenge and depends on a good collaboration. As part of that collaboration, it’s critical for team members to have access to the files and programs they need to do their jobs. But that access should be easily revocable when employees change job positions or leave the company. This is could be achieved through access control which defines who is allowed to access what.  In this post, we will look at the comparison of two of the most popular access control models: role-based access control (RBAC) versus attribute-based access control (ABAC). We’ll also briefly discuss how RBAC contribute to secure monitoring best practices.

Role-based access control (RBAC) and attribute-based access control (ABAC) are the two most commonly used access control tools used for authorization and permissions systems. Most developers have heard them and may have a sense for what they mean, but many aren’t clear on how to think about RBAC and ABAC as tools for modelling permissions in their apps. Understanding the differences between the two is key for choosing between RBAC vs. ABAC for your system.

RBAC versus ABAC

  • What is RBAC and how does it work?

Role-based access control (RBAC), also known as role-based security, is a mechanism that restricts system access. It includes setting permissions and privileges to enable access to authorized users. Most large organizations use role-based access control to provide their employees with varying levels of access based on their roles and responsibilities. This protects sensitive data, limit the risk of data leaks and and ensures employees can only access information and perform actions they need to accomplish their tasks.

In addition to restricting access, the company assigns a role-based access control role to every employee; the role determines which permissions the system grants to the user. Likewise, the right to access a file is based on the role of the user. Moreover, it is also possible for a single user to have multiple roles. The main advantage of RBAC is that this policy does not need to change when a certain person with the role leaves the organization. It is also easier to activate a role on a new employee.

The Benefits of RBAC include:

– Security. RBAC uses the principle of least privilege to lower the risk of a data breach. It also limits damage should a breach occur.

– Ease of Use. RBAC connects employees to the data and systems they need and reduces administrative overhead for IT.

– Compliance Readiness. Administrators can more easily prove that data and sensitive information have been handled according to privacy, security, and confidentiality standards.

  • What is ABAC and how does it work?

ABAC stands for Attribute Based Access Control. In this method, the access to a resource is determined by a collection of several attributes. It considers user attributes (subject attributes), resource attributes (object attributes) and environmental attributes. In practice, attributes can include everything from the position of employees to their departments, IP addresses, devices, and more. By using ABAC, the organizations can simplify access management and reduce risks due to unauthorized access. Furthermore, it helps to centralize auditing.

  • Key benefits of ABAC include:

– Granularity: it uses attributes rather than roles to specify relationships between users and resources, administrators can create precisely targeted rules without needing to create additional roles. 

– Flexibility: ABAC policies are easy to adapt as resources and users change.

– Adaptability: ABAC makes adding and revoking permissions easier by allowing admins to modify attributes. This simplifies onboarding and offboarding as well as the temporary provisioning of contractors and external partners.

– Security: ABAC allows admins to create context-sensitive rules as security needs arise so they can more easily protect user privacy and adhere to compliance requirements.

  • RBAC versus ABAC: differences between the two access control models

One key distinction between RBAC and ABAC is their static versus dynamic nature, as implied in their respective models — RBAC permits access based on roles, which are generally fairly static within an organization, where ABAC relies on attributes, which can be dynamic — changing, for example, when a user attempts to access a resource from a different device or IP address.

This brings us to the benefits and downsides of each model: ABAC can be automated to update permissions, and — once everything is set up — requires less overall administration. It’s also secure when set up correctly. In terms of downsides, ABAC can be quite complex and environment-specific, and complicated attribute sets can be hard to scale.

RBAC, on the other hand, is highly efficient and can streamline the compliance process. While any form of access control comes with a degree of complexity, RBAC is transparent enough that you can see how individuals interact with resources based on their roles.

One major downside of RBAC is if your environment has a multitude of different roles, each with its own complex set of permissions, which can make management difficult. In contrast to ABAC, RBAC can’t be automated, so the more complex your environment, the more manual the access management control becomes.

  • RBAC or ABAC: The best access model depends on company size and security needs

RBAC and ABAC are both effective ways to control access to data in your system. Which one works best for you will be based on a few factors:

– How big is your company? RBAC tends to not scale well because as more people and resources are added, more roles are created to define more detailed permissions. If you work at a big enterprise, ABAC is probably the right approach.

– How complex does your authorization strategy need to be? In general, you should try to do the least complex form of access control possible. If RBAC will cut it, this would be the right choice. If you need more detailed permissions or to look at variables that fall outside of roles (like device type, location, or time), you’ll need to use ABAC.

The good news is that you can use both RBAC and ABAC in tandem. A common model is to begin with RBAC and keep it as an overarching access model, then slowly add ABAC on top to fine-tune security for various users, resources, and operations.

How to Successfully Conduct Recertification of Access Rights

From our practice, we know that every company has employees that have been there from the beginning and worked in different departments. They know everything about the company’s processes, and it makes them valuable employees. But at the same time, they can also access sensitive data, and that makes them dangerous and a periodic user access review can mitigate this danger.

The user access review, otherwise known as access recertification, is an essential part of access management and is an important practice for each organisation. As a critical component of your Identity and Access Management strategy, this control mechanism ensures that your Information System users have legitimate and consistent access rights to your systems and applications.

In this article, we discuss the definition and importance of user access recertification and review the best practices to make the process fast and effective.

What is Access Recertification?

As said above, recertification, is a key component of your IAM strategy, closely linked to identity lifecycle management and to account and rights provisioning. The goal is to ensure that information system users have the access rights they should have, and to certify them, or – if necessary – carry out remediation operations in the event of non-compliance with the company’s authorisation policy.

This IAM element helps provide good governance and authorisations control, in order to ensure the expected compliance guarantees. It allows companies not only to achieve compliance with their security policy and to limit operational risks, but also to meet a wide range of regulatory challenges, including those relating to regular audits by the parent company or by official auditors.

If not reviewed periodically, privileged access can fall into the hands of bad actors, whether on purpose or on accident. The risks involved with the wrong person having access can be great and potentially disastrous for an organization and its reputation.

Why is it important to review access rights?

The ultimate aim of a user access review is to reduce the risk of a security breach by limiting access to critical data and resources. To prevent situations such as security breach or data theft, is one of the reasons to conduct a recertification. It also eliminates threats such as the following:

  • Excessive privileges. In a perfectly secure world, access privileges can be granted only to users that need them only to do their jobs. In reality, permanent access is often granted when an employee needs access just once or may (or may not) need it in the future. A timely review helps to revoke unneeded user access rights.
  • Access misuse and employee mistakes. According Data Breach Investigations Reports, 15% of data breaches happen because of access and data misuse. A user access review helps to limit access and, therefore, reduce the possibility of a costly mistake.
  • Insider threats. The key danger of insiders comes from the fact that they have access to sensitive data and know about security measures implemented in the organization. Insider threats can be partially mitigated by revising and restricting access according to the principle of least privilege. However, the best practice is to couple reviews with the creation of an insider threat policy and deployment of user monitoring, access, and identity management software.

Figure 1: Functions of recertification

Which best practices should be followed for effective recertification?

To mitigate the potential risks and keep your access management routine efficient and secure, it’s in your organization’s best interest to conduct periodic user access reviews. And if you don’t have regular access recertification done already, here are some user access review best practices to help you set up an efficient process.

  • Develop a user access review policy

Developing a user access review policy is crucial for any organization’s security. A thorough policy can help save an organization time and money while mitigating cybersecurity risks and protecting sensitive information. It’s best to consider policy development as the information-gathering stage of the process, with a lot of asking questions and finding answers. For example: Who has access to what? What is the most important information that needs protecting? Who and what is most vulnerable to risk? What software exists to mitigate those risks?

The development of a user access review policy should always be geared toward achieving a Zero Trust policy, meaning, a policy that allows users access to only the bare minimum needed for job duties.

  • Implement role-based access control (RBAC)

This access control model allows for creating user roles for positions instead of configuring each user’s account individually. Each role is assigned a list of access rights. RBAC speeds up a user access review because, with this model in place, you can review roles instead of separate profiles.

In PATECCO, role-based access is easy to set up and manage: you can add users with similar privileges to groups and manage their privileges in a few clicks.

  • Implement the principle of least privilege

The principle of least privilege dictates that users should have access to data only if they absolutely need it. The fewer privileges a user has, the less time you need to spend reviewing them.This principle is easily implemented with PATECCO: new users have a minimum number of access rights or privileges by default. An administrator can assign a user to a privileged user role by adding them to a specific group or can provide constant or temporary access to resources.

  • Provide temporary access instead of permanent

During an access review, revoking such access rights takes a lot of time. Whenever possible, one of the best practices is to use features like one-time passwords instead of assigning a user a new role or granting permanent access rights. Another option for providing temporary access is to implement privileged access management (PAM). This approach is based on granting access only when users need it to complete their jobs and revoking it when the task is finished.

Conducting a user access review is an important part of the access management process. It reduces the risk of a data breach and reduces a wide range of security issues. With the support of PATECCO, you can take your access management to a higher level, as this solution provides:

What is the Role of Blockchain in Improving Identity and Access Management?

The digitization of the business organisations leads to the digitization of identity. From personal information to professional certifications, the need for identity information and credentials is constantly increasing. Usually, identity information is monitored and verified by third parties, whether government or the private sector. But faltering confidence and new tools challenge these structures.

Many companies from the public and private sectors, believe that blockchain can add value to their operations. It offers transparent visibility and an immutable, time-stamped record of contracts. Each “block” of information in a chain is stored across a wide array of networked computers — a full blockchain never exists in its entirety on any single device — making it nearly impossible to falsify information in a blockchain.

What is a Blockchain and how it is related to IAM?

According to our partner, IBM, Blockchain is a shared, immutable ledger that facilitates the process of recording transactions and tracking assets in a business network. An asset can be tangible (a house, car, cash, land) or intangible (intellectual property, patents, copyrights, branding). Virtually anything of value can be tracked and traded on a blockchain network, reducing risk and cutting costs for all involved.

Identity management with blockchain works in a different way. There is no centralized database, instead, information is stored over a peer-to-peer type environment, by adopting a decentralized framework. The data is stored immutably in publicly owned blocks over the network. This solution provides flexibility, security and privacy for data management with reliable authentication and integrity check.

The Role of Blockchain in Identity and Access Management

The role of blockchain in identity management is to provide a means to verify identities, control access, and ensure the integrity the data and transactions. Everything stored in the database is publicly owned and immutable. Traditionally, effective IAM has been a challenge for large corporations for several reasons. Firstly, digital credentials are frequently a target of fraud and other cybercrime. Furthermore, siloed data creates a high potential for error, unnecessary overhead, and increased vulnerability to fraud. These issues are only exacerbated by the fact that traditional IAM measures are incredibly difficult to scale.

It is essential for business leaders to understand that balancing easy information access with strong, scalable security measures requires a highly dynamic system — one that blockchain is ideally positioned to power. Blockchain offers several major advantages over traditional means of IAM:

  • Improves Identity and Access Management

While we are fully aware that employee error is the primary cause of credential theft which are centrally stored and managed, the technology can store credentials on the blockchain in a decentralized manner reducing system intrusion risks and access fraud as hackers will have to attack multiple points of entry to access the data.

  • Track changes

Blockchain can help ensure that data is not changed without authorization or stolen. If you change any part of the blockchain, it is permanent, and you can’t remove it from the database. Furthermore, changes or new data will not remove or replace old data but rather will be recorded at the top of the blockchain with ownership and a time stamp which makes it trackable in case of an attack to trace back to the source.

  • Ensure redundancy

A blockchain is distributed and omni-present. Because various computers store a copy of the blockchain data, in case of accidental and intentional tampering, you can find the original information in other sources.

  • Prevent cyberattacks

DDoS attacks are common cyberattacks which aim to bring business systems down and make them unavailable by flooding requests. DDoS attacks are easy because parts of the domain name system (DNS) is store centrally and is susceptible to attacks and theft which can be used to bring systems down. Decentralized blockchain will prevent DNS theft and prevent DDoS attacks. Also, since any block change in the blockchain must be verified with the remaining of the blocks, attacks will be detected quickly and contained by keeping bad data out of the system.

How to Secure Privileged Access in the Cloud

In times of increased cyber threats, securing privileged access is a critical step to establishing security assurances for business assets in a modern enterprise. The security of most or all business assets in an organization depends on the integrity of the privileged accounts that administer and manage IT systems. Cyber-attackers are targeting these accounts and other elements of privileged access to rapidly gain access to targeted data and systems using credential theft attacks. Protecting administrative access against determined adversaries require you to take a complete and thoughtful approach to isolate these systems from risks.

Privileged Access Management (PAM) combines the most current and comprehensive defence strategies against malicious third parties executing cyber-attacks with increased efficiency and the support of greater resources. Constantly updated and evolving Privileged Access Management manages to be efficient in terms of protecting your data, including cloud security.

Establishing Cloud Security with Privileged Access Management

Since it is quite difficult to be protected against the vulnerabilities and risks of cloud technologies with standard safety precautions, data access security should be established via innovative approaches such as Privileged Access Management. This is one of the most effective ways to create a more productive security ecosystem for digital services such as cloud technologies. Some of the steps to establish cloud security via Privileged Access Management include:

  • Use of Zero Trust

All cloud service providers utilize management consoles to manage accounts, configure services and troubleshooting. Cyberattacks commonly target these consoles in order to access various data. Cloud-based service providers should carefully monitor users with privileged access rights and privileged access requests. Authorized accounts must be taken under control in order to prevent attacks and data leaks via various controlling tiers such as privileged session manager.

Modern privileged access management starts with an assumption that every user is a remote user for an organization. Zero trust building blocks of continuous authentication and verifying the user, context-based privileges are required to secure modern privileged access.

Zero trust follows the principle of “never trust, always verify” policy and least access/privilege model that focuses on identity-based authentication and access controls to ensure bad actors cannot use easily compromised credentials to gain privileged access, move around the network, and extract sensitive and valuable data. As organizations move to adopt zero trust, we are also finding organizations adopting a zero standing privilege posture, where no one has access rights or privileges permanently assigned; rather, access is granted just in time for a limited duration to reduce the attack surface and eliminate the potential for malicious actors accessing any infrastructure, even if they are able to compromise existing credentials.

  • Use of Multifactor authentication

Virtual servers, data storages, and other cloud resources are common targets for cyberattacks. Malicious third parties may try to utilize automatic provision tools in order to initiate attacks and cause downtime. Therefore, service providers should establish strong security systems and applications such as two-factor authentication (2FA) or multi-factor authorization in order to prevent unauthorized access to cloud automation command files and provision tools. The use of multifactor authentication for all privileged user access to cloud environments should be mandatory, and this likely could have prevented the initial compromise of Code Spaces’ console. Many providers offer a variety of different forms of multifactor access, including certificates on the endpoint, hard and soft tokens from leading multifactor providers, and SMS codes – which are not as secure, but still better than nothing at all.

  • Use of APIs

Cloud applications commonly use APIs in order to halt and initiate servers or conduct other environmental changes. API access authorization data such as SSH keys are generally coded built-in to the applications and placed in public storages such as GitHub. Then, they become targets for malicious third parties. Therefore, enterprises should remove built-in SSH keys from applications and make sure only the authorized applications to access through areas with encrypted infrastructures that act as digital safe, such as dynamic password controller. Such Privileged Access Management steps ensure efficient protection of cloud technologies, which are so hard to be protected via only legacy security software or firewalls.

Security is always best deployed in layers. While traditional security controls are necessary at the perimeter, we need to constantly think about how to prevent malicious privileged access, assuming that the bad actors are already on the inside and may already have access to credentials. Privileged accounts, credentials and secrets are found in devices, applications and operating systems allowing organisations to secure the infrastructure and applications, run business efficiently and maintain the confidentiality of sensitive data. In the wrong hands, privileged credentials can be used to cause catastrophic damage to a business. This is why they must be protected, managed and monitored.

For more information about Privileged Access Management, download the Whitepaper below:

Why Security Orchestration, Automation and Response (SOAR) Is an Essential Cybersecurity Tool?

The SOAR acronym first appeared back in 2017, and it stands for Security, Orchestration, Automation, and Response. SOAR represent a rise in automated incident response and management platforms. This technology allows organizations to collect relevant data regarding security operations by applying automation and orchestration. Gartner predicted that this technology will be a turning point in the cyber world, as more and more organizations have realized the immense value of SOAR.
With the evolution and increase in cyber attacks every day, SOAR gained popularity among security analysts for its core feature of handling repetitive tasks. By helping to plan and orchestrate responses to security incidents, SOARs offer critical functionality that extends beyond that provided by security incident and event management (SIEM) platforms, a more conventional type of security tool.


Security Orchestration, Automation and Response in detail

Let’s break down the term SOAR to get a better understanding of what it actually involves:

  • Security automation

This is the automatic execution of security operations-related tasks – such as scanning for vulnerabilities or searching for logs – without human intervention. Information is automatically retrieved from advanced detection systems and Security Information and Event Management (SIEM).

  • Security orchestration

This refers to the way all security tools are connected. Even disparate security systems are integrated. In this layer, SOAR streamlines all security processes.

  • Security response

This means automation helps to define, prioritise and execute default incident response activities based on predefined policy rules. Incident response processes may be completely automated, completely manual, or a combination of both to mirror an organization’s unique business processes.

Benefits of using SOAR as an Effective Cybersecurity Tool

  • Enhancing incident response

Rapid response is vital in order to minimise the risk of breaches and limit the vast damage and disruption they can cause. SOAR helps organisations to reduce mean time to detect (MTTD) and mean time to respond (MTTR) by enabling security alerts to be qualified and remediated in minutes, rather than days, weeks and months.

SOAR also enables security teams to automate incident response procedures (known as playbooks). Automated responses could include blocking an IP address on a firewall or IDS system, suspending user accounts or quarantining infected endpoints from a network.

  • Improve security operations center management with standardized processes

Using a centralized security operations center (SOC) management system, your organization can maintain better internal and regulatory compliance. Plus, using an automation platform specifically built with SOCs in mind, allows you to better prioritize and optimize alert remediation.

  • Faster detection and resolution of known and unknown threats

Responding to cyber threats in real-time requires a great deal of preparation, and with today’s evolved data threats, combating incidents without the help of AI automation is virtually unthinkable. In that regard, SOAR helps managed security service providers (MSSPs) respond to these threats quickly and effectively. Furthermore, AI-enhanced technologies are used to evaluate real-time threats, search for trends, utilize historical data to detect patterns, and isolate confirmed threats or any types of suspicious activities in a rapid-response fashion.

It’s very important to note that cyber attacks are moving at a rash speed, and cyber criminals are utilizing agile development and machine learning to strike any weaknesses and evade detection, and leaving traces. And only SOAR offers that kind of instant readiness that allows MSSPs to quickly respond in a preventive manner and learn consistent pattern behaviors.

  • Automated Security Reporting

In addition to automating security incident detection and response, SOAR platforms usually provide automated reporting features that record what happened, who did what and which steps ultimately mitigated the threat.

This data is crucial for tracking trends in security risks and response over time. It may also be useful for auditing and compliance purposes in cases where businesses are required to document their security operations.

  • Vulnerability management

SOAR platforms may also provide cataloguing of assets for a clearer visibility of their security. If any asset is vulnerable to a cyber threat, timely patching of vulnerabilities will reduce the risk of cyber-attacks on those assets. SOAR also offers integration with tools that automate the process of vulnerability management, in addition to directly fetching information about vulnerabilities by integrating with threat intelligence.

  • Unification of security tools

In order to achieve optimal efficiency, SOAR allows a swift integration of both workforce and tools, and that exact integration allows SOAR to handle tasks and processes without the need for human intervention. Machine learning is also applied to automate specific tasks, and that automation is usually applied via playbooks.

Is SOAR right for your organization?

To select a suitable SOAR solution for your business, you need to think about a variety of factors. Gartner advises that before choosing a SOAR solution, it is essential to make an assessment of the need of your security team, analyze which areas of your security operations need strengthening, and find out which SOAR solutions offer the kind of features that match your actual needs. Implementing SOAR can reduce threat response times, improve security performance and resource allocation, and create a more positive, productive environment for security professionals.

The Growing Importance of Machine Learning in Cybersecurity

The need for increased data security was recently put as a top priority on the global cybersecurity agenda by the EU General Data Protection Regulation (GDPR). This regulation imposes all companies having access to the personal data of the EU citizens to adopt more secure approaches to managing customer data, protecting against its accidental loss or illegal destruction, theft, and unauthorized disclosure. According to a number of cyber security reports, more than 50  percent of enterprises across the world have at least one incident of a major data breach or network attack annually. As more innovations in digital technologies end up in wrong hands, hacker attacks become more and more sophisticated and disastrous. That is why more companies rely on the AI/ML cybersecurity innovation. However, how can Machine Learning actually be leveraged to improve cybersecurity and data security, in particular? This article will explain the answer in details.

What Is Machine Learning and why it is so important?

Our partner IBM defines Machine Learning as a branch of Artificial Intelligence (AI) and computer science which focuses on the use of data and algorithms to imitate the way that humans learn, gradually improving its accuracy. The machine learning process begins with observations or data, such as examples, direct experience or instruction. It looks for patterns in data so it can later make inferences based on the examples provided.

ML has proven valuable because it can solve problems at a speed and scale that cannot be duplicated by the human mind alone. With massive amounts of computational ability behind a single task or multiple specific tasks, machines can be trained to identify patterns in and relationships between input data and automate routine processes. Machine learning models are able to identify data security vulnerabilities before they can turn into breaches. By looking at past experiences, machine learning models can predict future high-risk activities so risk can be proactively mitigated.

Use of Machine Learning in Cyber Security

Cybersecurity is a set of technologies and processes designed to protect computers, networks, programs and data from attack, damage, or unauthorized access. In recent days, cybersecurity is undergoing massive shifts in technology and its operations in the context of computing, and data science is driving the change, where machine learning (ML), a core part of Artificial Intelligence can play a vital role to discover the insights from data.

Machine learning helps automate the process of finding, contextualizing, and triaging relevant data at any stage in the threat intelligence lifecycle. This could mean anything from finding dark web forum posts indicating a data breach, to detecting suspicious network activity in real time. To better understand previous cyber-attacks, and develop respective defence responses, ML can be leveraged in various domains within Cyber Security to enhance security processes, and make it easier for security analysts to quickly identify, prioritise, deal with and remediate new attacks.

The following points are just a few examples how Machine Learning can be used to aid security:

  • Automating Tasks

A great benefit of ML in cyber security is its capacity to automate repetitive and time-consuming tasks, such as triaging intelligence, malware analysis, network log analysis and vulnerability assessments. By incorporating ML into the security workflow, organisations can accomplish tasks faster, and act on and remediate threats at a rate that would not be possible with manual human capability alone. Automating repetitive processes means that clients can up or down scale easily, without changing the manpower needed, thus reducing costs in the process.

  • Threat Detection

Machine learning algorithms are used in applications to detect and respond to attacks. This can be achieved by analysing big data sets of security events and identifying patterns of malicious activities. ML works so that when similar events are detected, they are automatically dealt with by the trained ML model. In the case of security, by analysing millions of events, ML technologies learn to identify deviations from established norms. Instead of countering the latest threats after they have been identified like traditional systems do, ML can identify anomalies as they emerge. Against the background of quickly evolving threats, it’s not hard to see how valuable this is for protecting against data breaches and maintaining uptime and business continuity.

  • Increasing the speed of detection and response

AI and machine learning can easily analyze massive amounts of data in seconds, making it far faster than manually detecting threats. What’s more, they can implement patches and remediate threats in near real-time, dramatically improving response times. With the ability of today’s cyberattacks to quickly penetrate an organization’s infrastructure, razor fast detection and response is key to success.

  • Fraud Identification

Within the banking and finance industries, AI and ML models are being used as effective tools in identifying and preventing advanced attempts at fraud. Through predictive forecasting, models can build threat profiles to prevent fraud before it happens.

  • Provide endpoint malware protection

Algorithms can detect never-before-seen malware that is trying to run on endpoints.  It identifies new malicious files and activity based on the attributes and behaviors of known malware.

  • Protect data in the cloud

Machine learning can protect productivity by analyzing suspicious cloud app login activity, detecting location-based anomalies, and conducting IP reputation analysis to identify threats and risks in cloud apps and platforms.

  • Improving your overall security posture

With AI and machine learning, cybersecurity gets stronger over time as more data is analyzed and these technologies learn from past patterns to become more proficient at identifying suspicious activity. They also protect an organization’s infrastructure at both the macro and micro levels, creating more effective barriers than can be achieved using manual methods.

Cybersecurity is an essential consideration for any organization – especially as the world progresses digitally so fast. Cyber attacks are getting more sophisticated, requiring companies to up their game and respond in the same way. Whether preventing a future attack or analyzing why and how one happened in the past, using AI and ML models creates a faster, more comprehensive cybersecurity response.