Month: September 2022

The Context

In the era of digitalization, data is generated, stored, and processed every day in a huge batch size for computational and administrative purposes. 

Furthermore, a growing number of organizations are managing their workloads in hybrid IT environments. And in a typical enterprise IT environment, there are hundreds of end-users, standard IT users, super users, privileged IT users, and several IT administrators accessing various types of IT resources every now and then.

As a result, data of different patterns, such as generic data, critical data, or highly confidential data, is generated. However, do organizations keep track of such data patterns? Do organizations follow a data storage methodology category-wise, or importance-wise? How do organizations know which data is exposed to security vulnerabilities? 

In this backdrop, if we consider the IT security perspective, isn’t it crucial for an organization to understand the data contextuality? If there is no segregation methodology to understand who, where, what, and when of data usage, then it could definitely invite complex data security vulnerabilities within the IT environment. 

In order to make sense of every bit of data, there has to be a contextualization of data. To overcome this challenge, Data Intellect, which is a component of ARCON | Endpoint Privilege Management (EPM), streams every bit of data in an organization into an AI/ML model to understand the contextual patterns of data. 

The use case

Let us think of a scenario. 

A typical organization has various departments like finance, administration, marketing, HR, and IT. To segregate deeper, the IT department has a host of software developers, software analysts, programmers, quality assurance teams, etc. Every user from every team accesses different systems or applications for different tasks at different hours and generates a considerable amount of data every day. Does the organization perform any analysis of this accumulated data? Also, what about the data that is processed consistently?

Here we come to know the importance of data analysis and data contextualization. From a security perspective, the first and foremost question that comes to our mind is why does a developer from the IT department need access to the sensitive data of marketing or finance? Isn’t that an unnecessary access? It automatically broadens the risk of unauthorized access.

By not having data intellect model, an organization risks: 

• Misuse and abuse of data 
• Exposing data 
• Loss of data 
• Illegitimate access to data 
• No classification of data based on its importance 

Today, while we write and discuss a lot about secure access control, security of digital identities, endpoint protection, cloud access security, at the same time, data assessment, data segregation, and contextualization of data are equally important to building the foundation of a comprehensive IT security infrastructure. Without knowing who is accessing what and not building a solid ring fence around data, the insider threat vector intensifies.

 If we do not track what has happened with a specific set of data (like who has accessed it, when and why), then we might end up exposing the data beyond analysis and security.

Solution

Monitoring this sea of data is practically a herculean task. As an information security solution expert, ARCON has developed an interactive analytical system known as “Data Intellect,” a critical component of a robust Endpoint Privilege Management (EPM) solution.

 This AI/ML-based tool builds a ring-fence around enterprise data even at granular levels. This contextual security layer is developed based on the user’s login behaviour and profile activities in a certain period of time. As a result, it creates a category of accessed data for the user and restricts access to other categories, reducing the risk of unauthorized access.

 Data Intellect enables the classification of data, itemization of the exposed data, categorization of the critical data, and understanding of the “where” and “what” of data. With this, it provides actionable insights on the data that is useful for forensic analysis and overall information security. Indirectly, it helps the organization stay compliant with the regulatory requirements.

Conclusion

Data Intellect contributes to wiser decision-making of an organization’s access management practice. It leverages AI and ML technologies to build a solid ring-fence around enterprise data and helps understand the patterns and contextualization of the data. 

The Context

An individual who knows a lot about the workforce, work patterns, or an organization’s business structure and is privy to confidential information just because he/she is a part of the organization is an insider. Why do insiders turn malicious? There are several reasons behind it, but greed, vengeance, or disgruntlement are the predominant factors among them. 

Whatever the reason, the ill effects of insider threats are long-lasting, and there have been instances where the victims have faced non-compliance penalties as well due to insider attacks. 

Insider threats have intensified in recent years due to the rapid expansion of the IT environment, the proliferation of cloud infrastructure, and the huge growth in user populations (digital identities). 

According to an alarming report by Forbes, the number of cyber incidents caused by insiders has risen by 47% in the last couple of years. It is said that the continuous evolution and revolution of information access control techniques has given the opportunity to malicious insiders to create and recreate new threat patterns.

Let us delve a bit deeper into the reasons behind the proliferation of insider threats.

 

Who are the users and what are the threats?

There are different security vulnerabilities and threat patterns associated with different users in an organization. 

Standard IT users: Almost 70–80% of an organization’s workforce consists of standard IT users. With the increase in the number of standard IT users, there are hundreds of login credentials existing in an enterprise IT infrastructure to ensure uninterrupted access to the systems and applications. The maximum probabilities of insider threats always revolve around the most standard users.

 

Solution: To prevent typical threats arising from standard users, ARCON’s Identity and Access Management solution offers a stringent password rotation mechanism that automatically creates dynamic and complex passwords and enhances access control security. The solution governs, audits, and manages the lifecycle of each and every digital identity and ensures robust authentication and authorization for information systems to keep insider threats in check. 

Database users: Database users can be categorized based on their roles and access patterns in the organizations’ database. There are

1. Database administrators: A database administrator is a person responsible for directing and performing each and every activity related to the maintenance of a successful database environment. As the database is a treasure trove for classified information, it bears the risk of unauthorized access. Hence, it requires intense monitoring and analysis of the log activities to keep insider threats at bay. 
2. Elevated or privileged users: In an organization, elevated or privileged users have greater access to target systems than typical standard users. Privileged or elevated users have different sets of credentials that offer access to confidential information. But what about the risks that could arise from the increased number of privileged users? One never knows who is accessing which system or application with what intention. So, insider risks are omnipresent.

Solution: A robust and feature-rich privileged access management (PAM) solution can help organizations analyze, predict, and prevent insider threats in real time. ARCON’s Privileged Access Management (PAM) solution offers complete governance of the identities and provides granular level access to critical systems. ARCON | PAM’s Just-In-Time (JIT) privilege tool ensures that every privileged access is happening on a “need-to-know” and “need-to-do” basis and for a pre-defined limited period. This helps to remove unnecessary and excessively elevated (privileged) users in an IT environment.

Password vaulting, multi-factor authentication, and continuous session monitoring, along with session management, enable database administrators to ensure that only authorized and genuine users access confidential enterprise data. Regular reporting of their activities helps to detect any suspicious movement that has happened internally and is eventually beneficial for audits.

Application administrators: Application administrators take care of a different range of tasks related to the applications, including technical support and troubleshooting. They generally provide support directly to the end-users and may also bridge the gap between internal teams and external clients. The possible security threats of an application administrator lie in managing excessive requests from the on-boarded users and troubleshooting machines on time. Any unwanted, unrecognized, and unauthorized access can result in an untoward incident.

Solution: ARCON’s Privileged Access Management (PAM) solution offers a desk insight feature that helps administrators manage requests from any on-boarded desktop in the enterprise network. It even automates the troubleshooting of a machine without moving from one desktop to the other. As a result, it secures the IT environment with complete control of access-related tasks.

Application users: In the post-pandemic era, we have observed the trend of hybrid work environments where most end-users work from anywhere, anytime, and from any device. This results in ambiguity over who is accessing which application, when, and for what purpose. Lack of role-wise profiling and access permissions to the designated applications invites insider threats that could remain unnoticed and undetected for a long time. Furthermore, suspicious behavioral patterns could become insider threats if there are no mechanisms to check users based on their risk scores.

Solution: ARCON’s Endpoint Privilege Management (EPM) solution helps IT admins learn and determine the behaviour of onboarded users. Once the onboarded users request the admins to allow endpoint access to any particular application, the admins grant just-in-time endpoint access based on their roles and responsibilities. The EPM solution secures the accessed application from any unauthorized access because, once the designated task is over, the permission is also revoked automatically. Moreover, it detects anomalous user profiles in real-time based on the risk scores (with the help of embedded AI/ML capabilities) and ensures controlled and restricted access to critical applications. With this, the administrator finds it easy to monitor the end-user activities seamlessly.

Conclusion

Insider threats can arise from any IT layer and from any IT user. It is one of the most challenging threats that every organization faces every day. By deploying essential access control safeguards, organizations can significantly reduce insider threats. 

The Context

Security configuration assessment, approved hardening policy, and data security management are extremely important for today’s organizations.

The reason being that information technology has percolated across all the layers of modern businesses and is the driving force behind the innovations and consistent growth. The changing dynamics of IT and business processes, however, has increased the IT vulnerability. This is especially true when organizations have a vast and distributed IT infrastructure. 

In this context it is extremely important

• To have an enterprise-wide mechanism in place to conduct security configuration assessments
• To perform security audits with minimal human intervention and provide an information security audit report that mentions the non-compliances against the compliance requirements as per the approved hardening policy

The necessity to deploy Security Compliance Management (SCM): 3 predominant use case scenarios 

Scenario 1

IT administrators always try to build up a strong IT ecosystem to flag off suspicious profiles, prevent compromise of data assets and make sure that they are audit ready. 

And to remain audit-ready, the compliance status of the organization’s technical system configurations and individual IT elements need to be assessed continuously. Any gap or security vulnerability in the technical system configuration can increase information security risks. So, it is mandatory to identify and close the vulnerabilities on time to prevent any untoward incident.

To address this, ARCON | Security Compliance Management (SCM) is deployed, and the compliance status of the security measures and the technical system configurations are incorporated at the enterprise level. It is also applied to the individual IT elements that can be assessed continuously. SCM’s Risk (information security) Control helps organizations to identify the gaps in time that induce the information security risks. It allows the organization to close such possible vulnerabilities in a timely manner.

Scenario 2

Given a situation where an organization has implemented robust access control mechanisms along with stringent IT policies, but there is no regular monitoring of the end-user activities-whether they are following the guidelines or not. Can we consider that the organization is compliant with IT security standards? There has to be a strict and well-defined process that regularly reviews the levels of IT risks in the entire ecosystem.

ARCON | Security Compliance Management (SCM) tool’s Automatic Risk Review feature automates the process of reviewing IT risks by generating detailed reports of end-user activities during a given date, time, and location. Moreover, the assessments of the risk factors performed for single or multiple IT elements are done in real-time. As a result, the organization maintains audit readiness and complies with IT security mandates. 

Scenario 3

What happens if an organization needs to alter or customize its system hardening policy all of a sudden? There could be multiple conditions like a change of IT workflow, a change in IT operational policy, or any change in IT setup (eg. transition to a cloud platform) that could affect IT security posture. Now, this alteration could be time-consuming and tedious if done manually. Furthermore, any human error could unknowingly expose the IT security vulnerability to any cyber criminal. 

ARCON | Security Compliance Management (SCM) tool’s Baseline Policy Manager helps organizations with a proper security management process that involves instant customizations and configurations of policies. In lieu of manual intervention, it centralizes and automates the process of policy alternation and its lifecycle in a secure way. Moreover, the SCM tool has in-built support for information security configurations for different technologies such as operating systems, databases, web servers, and network devices, etc.

Conclusion

Information security risk visibility is sought by global organizations to ensure comprehensive compliance with regulatory requirements. The Security Compliance Management (SCM) solution not only builds the foundation of robust compliance but also offers automated risk management mechanisms for every critical technology platform.

What is HIPAA? 

The Health Insurance Portability and Accountability Act (HIPAA) is the compliance standard that sets out rules to protect personally identifiable digital health records from cyber criminals. In order to ensure a secure healthcare IT infrastructure, HIPAA standards can be considered as a global benchmark to ensure data confidentiality, integrity, and availability.

HIPAA requires the following healthcare organizations to remain compliant in order to prevent unprecedented cyber incidents at any time and from any location.

• Speciality Hospitals/ Medical centers
• Pharmaceutical companies
• Medical equipment suppliers
• Medical service providers
• Health insurance companies
• Pathology laboratory chains

Some recent cyber incidents in the healthcare industry have raised fresh questions about vulnerabilities and how they are exploited. A healthcare service provider in North-West Europe exposed nearly two million patients’ data earlier this year. It caused massive repercussions as the ensuing investigation and cyber forensic studies revealed that it was the result of some suspicious activity inside the organization’s network. The significance of a secure access control mechanism came to the forefront, yet again.

So, what are the dominant reasons behind the security vulnerabilities of the healthcare industry and how can those be addressed?

The reasons behind IT security vulnerabilities:

There are several reasons behind information security vulnerabilities in the healthcare sector. To a large extent, these vulnerabilities emanate from poor identity and access control mechanisms. Insider threats, account takeovers, credentials abuse, and unauthorized access to critical applications are some of the common examples of how poor identity access controls lead to data breaches.

Today, many healthcare chains manage data in hosted environments: on-cloud and managed services. Digital identities are managed by a growing number of user populations, that is, internal and external. Therefore, it is extremely important to ensure databases and applications, especially privileged accounts, are protected from unauthorized access.

What does HIPAA compliance standards mandate?

HIPAA standards require the implementation of necessary data security rules. These rules must be administered by IT security officials. It is mandatory for both physical safeguards and e-PHI (Electronic Protected Health Information). The mandates demand that the entities ensure the confidentiality, integrity, and availability of all e-PHI they create, receive, maintain, or transmit.

In other words, HIPAA standards basically require organizations to formulate a centralized access control policy framework. This framework allows us to administer and control sensitive health information by authorizing and authenticating end users based on their roles and responsibilities.

Meeting all HIPAA requirements takes a combination of internal policies and processes, the right technology, and targeted external partnerships. In addition, implementing the right safeguards for the right information along with a continuous assessment of risks helps a healthcare organization become HIPAA compliant from a strategic level.

How does PAM help in compliance with HIPAA?

Below ARCON discusses three rules outlined by HIPAA to ensure compliance and maintain data integrity. We have also highlighted how does ARCON | Privileged Access Management (PAM) enables information security heads to comply with these mandates.

Rule 1

Ensure the confidentiality, integrity, and availability of all e-PHI they create, receive, maintain or transmit.

How does ARCON | PAM help complying with the mandate?

ARCON | PAM helps healthcare organizations stay HIPAA compliant by offering a unified governance engine to limit, monitor, and restrict access to critical information. While access to information systems is granted by rules and role-based policies, it also ensures that the data is encrypted when at rest or in transit.

ARCON | PAM’s granular level control—time-bound and role-bound access controls help organizations to restrict unauthorized users from accessing e-PHI. The password vault of ARCON | PAM automates password management on a regular basis. The vault randomizes and generates dynamic privileged passwords at frequent intervals to prevent any unauthorized access.

Besides, Just-in-Time privileges, privileged session monitoring, privileged session management, session logs, and reporting of privileged access provide comprehensive controls to maintain data integrity, data confidentiality, and data availability.

Rule 2

Identify and protect against reasonably anticipated threats to the security or integrity of the information.

How does ARCON | PAM help complying with the mandate?

In the digital ecosystem, medical staff, including doctors, nurses, technicians, and lab assistants—almost everyone counts on digital records that are stored in on-prem or cloud databases and applications. Sometimes, data is processed at managed service providers’ IT infrastructure.

They access these records every day and anytime for several purposes. Among hundreds of these users, there could be some anomalous profiles or digital identities that perform certain activities that they are not supposed to do. For example, drifting away from baseline activities and trying to access applications that aren’t supposed to be accessed.

These suspicious users could be potential threats to sensitive data. ARCON’s threat predictive tool User Behaviour Analytics (UBA), easily integrable with both PAM and EPM, helps organizations identify the suspicious behaviour profiles that are deviating from their baseline activities and flags alerts to the administrators for instant action.

Rule 3

Protect against reasonably anticipated, impermissible uses or disclosures.

Anticipation of potential threats is highly imperative today. A suspicious user, if performing any action that is not permissible as per the user’s role, is likely to be a potential threat. It could be highly risky for e-PHI because the information might be breached.

For instance, if any user is showing some unusual behaviour by downloading a batch of files that he/she has never done before, it is considered malicious behaviour. Or maybe someone who is accessing any critical health application that he/she has never accessed before or is not supposed to access is also considered to have malicious intent.

ARCON’s threat analytics tool identifies these anomalous user-profiles and notifies the IT admins promptly to prevent them from accessing any sensitive health information henceforth. These user IDs are deprovisioned or their elevated access rights are revoked.

Conclusion

It is important that every healthcare organization is compliant with the HIPAA standards. Following the comprehensive guidelines, physicians, pharmacists, pathologists, dentists, and even health insurance providers need to lay a strong foundation of HIPAA compliance by deploying a robust PAM solution and keeping evolving information security concerns at bay.