Solutions Review Sites
Enterprise Cloud Strategy
Solutions Directories
Identity Governance & Administration
Biometric Authentication
Vendor Map
Access Governance and the Remote Employee by Dean Wiech
Posted on November 7, 2017 by Jeff Edwards in Best Practices, Featured
By Dean Wiech
The work-at-home phenomenon is no longer a trend, but a movement. An effort that took hold in earnest at the beginning of the 21st century as the web and internet connection allowed for remote capabilities, for nearly 20 years, working remotely is the reality of the day for organizations large and small. Likewise, the vast majority of desktop applications have moved to the cloud and workspaces are virtualized, meaning they are easily accessible for remote employees. This means the number of remote systems and applications to manage such conditions is growing rapidly.
The challenge here is that these cloud applications are not likely connected to the internal network, so default Windows credentials will not work. For most of the applications, employees will have different credentials. It should be as easy for IT and system administrators to grant and revoke access to cloud services, as it should be for end users to access them. As the management of the credentials and rights for these applications becomes more complex, the demand for single sign-on (SSO) portals increases.
Single Sign-On Portals
Single sign-on portals let users log in once. What follows is the obtainment of automatic access to multiple applications and all appropriate network resources. After confirming an employee's identity, access policies can be established to allow or deny application access, policies that determine which systems and applications should be displayed within the user's SSO portal.
Convenient for users, but this may create potential risks, making systems less secure than they otherwise could be. With these applications being accessible remotely, higher levels of authentication are required. This higher level of authentication, called strong authentication, can be achieved with the following:
· Something that somebody knows: username or password
· Something that somebody owns: cell phone or token
· Something that somebody is: biometric, including fingerprints or facial recognition
If you combine two or more of these methods during the authentication process, an extra layer of security is added, known as two-factor authorization or multi-factor authentication.
Attribute Based Access Control
For even additional security is to include attribute-based access control (ABAC) or role-based access control (RBAC). Not only one's identity itself and the employee's role has within the company determines the access the individual receives within the portal. Additionally, such solutions like the type of device being utilized, the geo-location the portal is being accessed from and the time of day are added to the calculation. For example, the user could be prevented from accessing financial systems from their smartphone after 5 p.m. This kind of security can lock down remote applications even though the application itself does not support it.
Federated Identity
To ensure and secure the communication between the single sign-on portal and the application a federated identity can be used. With a federated identity, you're able to share identity and account information between organizations and applications so that users only have to log in once to target applications. The Security Assertion Markup Language (SAML) can be used as authentication mechanism between the single sign-on portal and the application. This is a data format for exchanging authentication and authorization data between websites.
Reporting and Auditing
Everything that happens within a single sign-on portal should be logged and this information used for reporting and auditing purposes. Likewise, with such information, it's possible to calculate when, how often, from where and by who certain applications are accessed.
Thus, while the expanding workplace brings with it a certain level of risk and complexity, single sign-on and two-factor authorization offers efficiency without compromising security.
Dean Wiech is managing director of Tools4ever.
Follow Jeff
Editor, Cybersecurity at Solutions Review
Jeff Edwards is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large.He holds a Bachelor of Arts Degree in Journalism from the University of Massachusetts Amherst, and previously worked as a reporter covering Boston City Hall.
Latest posts by Jeff Edwards (see all)
17 Cybersecurity Podcasts You Should Listen to in 2019 - January 3, 2019
What's Changed: Gartner 2017 Magic Quadrant for Identity Governance and Administration (IGA) - January 28, 2018
Crossmatch Integrates Keyboard Capture to Identity Management Software - November 27, 2017
Previous Previous post: RSAC '17: Unsticking Your Privileged Access Management Program
Next Next post: Survey Reveals Widespread Mismanagement of Privileged Accounts and Access
to Solutions Review on YouTube
2020 Buyer's Guide Identity Management
Vendor Map Report Identity Management
The 10 Best Free and Open Source Identity Management Tools
17 Cybersecurity Podcasts You Should Listen to in 2019
The Top 6 Password Strength Checkers and Validation Tools
The Top 7 Password Attack Methods (And How to Prevent Them)
Identity and Access Management Solutions Directory
Privileged Access Management Solutions Directory
Five Privileged Access Management Vendors to Watch in 2020
IAM Insight Jam 2December 10, 2020
Solutions Review brings all of the technology news, opinion, best practices and industry events together in one place. Every day our editors scan the Web looking for the most relevant content about Identity & Access Management and posts it here.
SIEM | Information Security
Free IAM Buyer's Guide
Solutions Review - Identity and Access Management | Privacy Policy | Do Not Sell My Info