Five steps to an effective access management strategy

Posted on Jul 15 2013 - 4:52pm by Contributing Writer

By  Jeff Castillo,  Country Managing Director of Fortinet Philippines

Jeff Castillo

Jeff Castillo

Access management is a crucial function for every organization with an Internet connection and it’s a lot harder these days. The explosion of remote workers and mobile devices has complicated and confused once-rudimentary access management functions, while the popularity of social media and other Web 2.0 sites have added a more challenging dimension to the work environment.

With this in mind, here are a few tips for access management that might ease the process.

Do Inventory. Organizations need to have strong, robust user access policies, and IT administrators need to assess and answer fundamental questions: Who should access to what?

The CEO and top brass will have more permissions to access data than those working in the mailroom. Drilling down, organizations may give user groups permissions related to their job functions. Marketing and sales personnel will benefit from unrestricted access to social media sites, while other groups – janitorial, for example – might be limited to social media during lunch or off-work hours.

A blanket “No YouTube” policy will only thwart users leveraging work-related videos for training. Sweeping bandwidth restrictions will frustrate users requiring video-conferencing apps to conduct meetings with multiple users from around the globe.

Determining the appropriate level of permissions takes research into what users need to be most efficient. A little homework on the front end will save organizations time figuring it out by trial and error.

READ:  HP unveils high-performance storage system for SMBs

Communicate policies clearly, and be flexible. Once the appropriate policy levels are in place, the organization must communicate them to the user. This means educating users about what they’re allowed and/or prohibited from doing on their work network.

But, organizations also need to be flexible. A user or group of users might have a specific data access need that no one considered. Also, users’ access needs can change: Employees get promoted, change roles and acquire new job functions. Any change will entail a new level of access.

Staying on top of users’ access needs and communicating related policies will save organizations time and headaches in enforcement. Once users are made aware, it’s likely they will want to comply with the rules.

Monitor, monitor, monitor. You don’t know what you don’t know. While certain restrictive access policies may be in place, it’s doubtful one set will apply to the entire organization 100 percent of the time. There will be exceptions. With myriad disparate permissions and policies, things will fall through the cracks. It behooves users to invest in tools to monitor and analyze users’ network behavior. Comprehensive monitoring allows IT administrators to determine whether a user is sapping bandwidth by streaming music or video files; whether an insider is accessing unauthorized information, either accidentally or intentionally; or if users are visiting illicit sites during work hours.

More information gives organizations the ability to act in a way that best aligns with their business objectives. Let’s face it: Most organizations want to be as efficient and productive as possible. Monitoring gives IT administrators and management insight into how the network is being used so they can better tailor policies going forward.

READ:  PH’s first DDoS attack scrubbing center goes live

Manage remote workers. Most organizations agree it would be easier for network management tasks to be confined to the physical walls of the organization. These days, with the dearth of mobile, remote and contracted workers, that’s seldom the case.

IT administrators need to ensure these workers and their devices are on the same page in terms of policies and permissions. Organizations need to ensure they have a robust VPN solution in place, and that all tools related to access and application control, firewall, IDS and IPS, antivirus, antispam and spyware extend to remote workers.

Account for BYOD or Bring Your Own Device. Once upon a time, IT administrators were tasked with keeping tabs on the network and all that resided inside it. These days, users don’t have to access questionable sites or sensitive data from their desktop computers, but they can access whatever they want from their mobile devices.

Personal mobile devices leveraged for work-related functions will contain sensitive, business-critical information. This leaves an organization vulnerable to data theft and malware attacks when those same mobile devices also access Web sites that contain malware.

IT administrators and other decision-makers will want to determine how far access management policies should extend onto users’ personal devices. To what degree is dependent on the needs, goals and culture of the organization.

Related Posts

Tips on how to improve your safety online For many of us, the Internet is an extension of how we live our lives every day. But sometimes the things we enjoy most online — share photos, pay bil...
Cybercriminals make ATMs spill out lots of cash wi... Without inserting a credit card into the ATM slot, a gang of cybercriminals enter a combination of digits on the ATM’s keyboard, make a call to receiv...
Thousands of software security positions currently... The U.S.'s fast-rising demand for software talent is creating shortages and demand-supply imbalances for specific  skill sets for countless companies ...
Barracuda swims into local IT security market with... Barracuda Networks, Inc., a provider of cloud-connected security, storage and application delivery appliances, has appointed security and network solu...
Latest Trend Micro software strengthens your priva... “Everything we do online leaves behind a digital footprint that can lead cyber criminals back to us,” warned Trend Micro during the launch of the late...
Kaspersky’s new security products protect multi-pl... Designed to protect users of Windows, OS X and Android-based devices, the newly launched Kaspersky security products which incorporate new technologie...
IPC launches first webinar series for 2016 IP Converge Data Services, Inc. (IPC) has launched a series of free webinars for the first quarter of 2016. In its commitment to help enterprises succ...
It’s double trouble for companies with a vir... Companies with a virtual infrastructure may have to double their regular spending in case they are attacked by cybercriminals. A special report on ...
New WatchGuard appliance protects the ‘new&#... WatchGuard Technologies recently announced the WatchGuard Firebox T10 Unified Threat Management (UTM) solution, a network security appliance that allo...
New Symantec technologies fight evolving targeted ... Symantec has introduced new solutions intended to help organizations defend themselves from targeted attacks at the gateway, on the endpoint and in th...
About the Author

Leave A Response