Five steps to an effective access management strategy

Posted on Jul 15 2013 - 4:52pm by Contributing Writer

By  Jeff Castillo,  Country Managing Director of Fortinet Philippines

Jeff Castillo

Jeff Castillo

Access management is a crucial function for every organization with an Internet connection and it’s a lot harder these days. The explosion of remote workers and mobile devices has complicated and confused once-rudimentary access management functions, while the popularity of social media and other Web 2.0 sites have added a more challenging dimension to the work environment.

With this in mind, here are a few tips for access management that might ease the process.

Do Inventory. Organizations need to have strong, robust user access policies, and IT administrators need to assess and answer fundamental questions: Who should access to what?

The CEO and top brass will have more permissions to access data than those working in the mailroom. Drilling down, organizations may give user groups permissions related to their job functions. Marketing and sales personnel will benefit from unrestricted access to social media sites, while other groups – janitorial, for example – might be limited to social media during lunch or off-work hours.

A blanket “No YouTube” policy will only thwart users leveraging work-related videos for training. Sweeping bandwidth restrictions will frustrate users requiring video-conferencing apps to conduct meetings with multiple users from around the globe.

Determining the appropriate level of permissions takes research into what users need to be most efficient. A little homework on the front end will save organizations time figuring it out by trial and error.

READ:  NEC Philippines launches new retail point-of-sale solution

Communicate policies clearly, and be flexible. Once the appropriate policy levels are in place, the organization must communicate them to the user. This means educating users about what they’re allowed and/or prohibited from doing on their work network.

But, organizations also need to be flexible. A user or group of users might have a specific data access need that no one considered. Also, users’ access needs can change: Employees get promoted, change roles and acquire new job functions. Any change will entail a new level of access.

Staying on top of users’ access needs and communicating related policies will save organizations time and headaches in enforcement. Once users are made aware, it’s likely they will want to comply with the rules.

Monitor, monitor, monitor. You don’t know what you don’t know. While certain restrictive access policies may be in place, it’s doubtful one set will apply to the entire organization 100 percent of the time. There will be exceptions. With myriad disparate permissions and policies, things will fall through the cracks. It behooves users to invest in tools to monitor and analyze users’ network behavior. Comprehensive monitoring allows IT administrators to determine whether a user is sapping bandwidth by streaming music or video files; whether an insider is accessing unauthorized information, either accidentally or intentionally; or if users are visiting illicit sites during work hours.

More information gives organizations the ability to act in a way that best aligns with their business objectives. Let’s face it: Most organizations want to be as efficient and productive as possible. Monitoring gives IT administrators and management insight into how the network is being used so they can better tailor policies going forward.

READ:  Cyber threats in PH increased by 48%, says Trend Micro

Manage remote workers. Most organizations agree it would be easier for network management tasks to be confined to the physical walls of the organization. These days, with the dearth of mobile, remote and contracted workers, that’s seldom the case.

IT administrators need to ensure these workers and their devices are on the same page in terms of policies and permissions. Organizations need to ensure they have a robust VPN solution in place, and that all tools related to access and application control, firewall, IDS and IPS, antivirus, antispam and spyware extend to remote workers.

Account for BYOD or Bring Your Own Device. Once upon a time, IT administrators were tasked with keeping tabs on the network and all that resided inside it. These days, users don’t have to access questionable sites or sensitive data from their desktop computers, but they can access whatever they want from their mobile devices.

Personal mobile devices leveraged for work-related functions will contain sensitive, business-critical information. This leaves an organization vulnerable to data theft and malware attacks when those same mobile devices also access Web sites that contain malware.

IT administrators and other decision-makers will want to determine how far access management policies should extend onto users’ personal devices. To what degree is dependent on the needs, goals and culture of the organization.

Related Posts

Business execs staying in ‘Darkhotels’... For at least four years already, a "Darkhotel" espionage campaign has been lurking in the shadows stealing sensitive data from selected corporate exec...
Study: 41% of online fraud victims never got their... About 41% of users who lost their money as the result of financial cyber-fraud failed to get a single cent returned to them, according to the Kaspersk...
Thousands of software security positions currently... The U.S.'s fast-rising demand for software talent is creating shortages and demand-supply imbalances for specific  skill sets for countless companies ...
Wireless networks ranked as most vulnerable IT inf... Information Technology decision makers (ITDMs) believe wireless networks to be the most vulnerable element of the IT infrastructure, according to a ne...
Hackers see your smartphone as a vulnerable entry ... The proliferation of mobile devices is providing cyber criminals with additional launch points for targeted attacks, spurring demand for mobile endpoi...
Malware trends for businesses in 2014 Govind Rammurthy, MD & CEO, eScan By Govind Rammurthy, MD & CEO, eScan Another year comes to an end, but not without leaving a trail of...
Kaspersky tool remotely blocks and wipes out data ... Image captured from Kaspersky video on Kaspersky Mobile Security Android-based smartphone and tablet users need not worry about the information stor...
Security expert warns of mass attacks on online ba... Kaspersky Lab has recorded several thousand attempts to infect computers used for online banking with a malicious program that its creators claim can ...
Kaspersky’s free QR scanner warns users of m... Fraudsters are constantly coming up with new tricks to lure users to their malicious sites. One dodge that has become popular recently is to encrypt a...
IoT attacks, new evasion techniques to dominate em... Fortinet and its threat research division, FortiGuard Labs, have made their annual predictions of the most significant trends in malware and network s...
About the Author

Leave A Response