Massive volumes of data on the web are making online identity protection increasingly difficult, according to cloud security vendor Bitglass.
The company’s Chief Technology Office, Anurag Kahol, says there is much to reflect on when considering how companies and consumers can protect their digital identities and ensure that data remains secure. Security elements include password risks, regulatory compliance and identity and access management (IAM) best practices.
Every user and entity in today’s connected world has a unique digital identity based upon their online presence. This may include social media activity, healthcare and financial records, demographics, login credentials, web history, and more.
In parallel with any physical form of identification, digital identities must be protected at all costs to prevent identity theft or fraud.
“Unfortunately, the massive volumes of data on the web have made this increasingly difficult, and the acceleration of digital transformation efforts this past year also introduced new opportunities for sophisticated threat actors,” says Kahol. “As technology continues to advance, securing sensitive data must be a top priority for organisations.”
Last year, Marriott suffered a data breach after a threat actor hacked into two employee accounts and accessed the personally identifiable information (PII) of 5.2 million hotel guests.
This data breach stands amongst countless other security incidents that resulted from account compromise. In fact, more than 80 percent of hacking-related breaches are tied to misplaced or stolen credentials.
Enforcing regular password resets might seem like the ideal solution to the problem, but this would serve only as a temporary fix as users would likely use their new passwords across other accounts.
Password reuse has become a common malpractice since memorising numerous, complex passwords is both difficult and inconvenient. Stronger authentication controls can help organisations to keep sensitive data secure and maintain compliant with increasing regulations.
For companies like Marriott that collect and store massive volumes of customer information, data security and brand reputation are interrelated. Every business carries a responsibility to its customers to protect their data, whether it is to gain their trust or to remain compliant with regulations.
Some privacy laws like the European Union’s General Data Protection Regulation (GDPR) and Australian data privacy legislation have been in place for some time now.
There has also been recent discourse about a national privacy law in the United States that would hold all states equally accountable for the misuse of consumer data. The implementation and discussion of new laws highlights the ongoing data privacy dilemma. Enterprises that fail to comply with these regulations can face steep fines and could even risk losing their businesses forever.
Best practices
To keep up with the evolving security landscape, consumers and businesses must work together to ensure that corporate and personal data remains secure. No matter what their size, complexity, or uniqueness might be, passwords will always pose a risk.
Companies must rethink their cyber security strategies to mitigate threats efficiently and stay in line with data privacy regulations, while streamlining the entire login process. Here are some identity and access management (IAM) tips to ensure employee and customer identities are properly verified.
- Enable multi-factor authentication (MFA) and single sign-on (SSO)
Memorising dozens of long passwords is impractical. Fortunately, solutions exist today that can reduce the risk of account compromise while enabling a seamless login experience for users.
MFA enables an added layer of security; for example, through an SMS token sent via text message or through a third-party app like Google Authenticator. Without a second form of authentication, the user will not be verified and won’t be granted access to the account. Through SSO, users can access a variety of independent cloud resources by logging into a single portal.
- Know your users
To confirm that a user is truly who they claim to be online, it’s critically important for organisations to monitor their employees’ network activity and behaviour continuously to detect any abnormalities.
For instance, if an employee signs in at 9 am every Monday through Friday from their home IP address, but suddenly logs in at 10 pm on a Saturday night from a different location, this behaviour would be deemed suspicious.
Through context-based, step-up authentication, organisations can confirm users’ identities as needed depending on their locations, devices and day-to-day activities. This will also give companies greater security for data access no matter where it occurs.
- Stay informed
Even with all the right solutions in place, a security strategy is incomplete without educational resources. Companies must enforce cyber security training programs for all employees to inform them about rising threats, and also teach them how to manage their data effectively and safeguard their digital identities (as well as those of their customers, by extension).
With all these considerations in mind, organisations can defend proactively against unauthorised access and protect all sensitive data stored across their modern IT ecosystems.
Beyond company policies, consumers must take it upon themselves to stay up-to-date on the latest identity management trends and cyber risks. Now that our daily lives revolve around the internet, identity management awareness has never been more critical.
