COVID’s impact on businesses has included special challenges for identity and access management (IAM) programs. First and most obvious is the unprecedented demand of a remote workforce. The second challenge is the unfortunate need to reduce the workforce through layoffs and furloughs. Third is the need to do just the opposite – increase the workforce with temporary workers, full-time hires, and reinstating furloughed employees.
These challenges have highlighted weaknesses that companies might not have been aware of before COVID, but that are painfully obvious now.
Here are four weaknesses we believe have created the most frustration and pose highest business risks:
Weak MFA and SSO: Ineffective or weak multi-factor authentication and single sign-on capabilities make it difficult to scale and properly authenticate the ENTIRE workforce to your mission-critical applications. This results in a loss of precious productivity and significantly increases exposure to bad actors. A remote workforce greatly highlights this weakness and the associated risks.
Manual On/Off-boarding Process: We find that many companies rely on error-prone on/off-boarding processes, which are heavily dependent on human-input. This can create frustration and hurt productivity as new hires await access. It also overburdens IT staff as they react to the overwhelming demand. It’s not the first-impression you want to make. For off-boarding, it can expose you to bad-acts from disgruntled employees due to delays in access removal.
Orphaned User Accounts: Knowing what accounts exist, who has control of them, and what systems they have access to, is incredibly important. The 2020 increase in workforce volatility combined with poor governance can result in a dangerously high level of orphaned user accounts. High volumes of contractors and temp workers can exacerbate the problem.
Privileged Account Exposure: Many IT administrators and other privileged users are now working remotely. Insufficient governance processes and safeguards of privileged accounts can create exposure and give unwanted access to organizations’ mission-critical systems.
Immunizing Your Organization from Access-Related Weaknesses
So what’s the best way to address these weaknesses? There are four fundamental capabilities any self-respecting IAM program enables, which can effectively immunize an organization against access-related weaknesses exposed by major events like COVID.
Solid Governance: As members of the workforce come, go, and move around the organization, you need automated, secure and compliant on/off-boarding of user access across your enterprise.
Secure Authentication: You need fast, secure, and user-friendly authentication and authorization of users to enterprise systems (on premise and Cloud) and business partner (B2B) systems.
PAM: Tight management of privileged users (administrators and services) which hold the critical ‘keys to the kingdom’. You need a Privileged Access Management program that will ensure all critical application privileged credentials are vaulted and secure, especially for those used by remote workers
Closed-loop reporting: Accurate reporting of access processes will ensure that all access-related events are compliant with company regulatory policies. This will prevent security vulnerabilities and possible audit findings that could result.
The good news is that by addressing the weaknesses 2020 has revealed, you not only solve these immediate challenges but also create a strong foundation that will last long after the COVID challenge has passed (soon, please!).
Where to start?
If you’re not sure how best to proceed or would like feedback on your IAM business case, Integral Partners has the depth of experience to help. We’d be happy to provide a free consultation to educate and give expert input to help get you started. From there, we would welcome the opportunity to advise and assist with your ongoing IAM journey and help you stick to your post pandemic budget plan no matter what 2021 decides to throw at us.
Click here to contact us and schedule a short call.
Comments are closed.