Identity and Access Management and Work-From-Home

COVID-19 created the work-from-home phenomenon, but as things hopefully get back to normal, your employees may not be returning to the office any time soon. Surveys of both companies and employees show a willingness, if not a desire, to keep the office in the home scenario going forward. What’s an IT department to do?

The way it was

Before COVID-19 forced the workforce from the office to work-from-home (WFH), companies had good control on the devices, login IDs, and authorizations used by their employees at the office. Security could control who logged in from the internal networks on computers and devices – all installed and controlled by the IT department. Yes, there were a few people who needed remote access, but those were managed and audited by using a VPN tunnel into the corporate networks.

The WFH rush caused problems

Now at home, employees are using either company supplied computers or, like most of us, our personal computers and devices. This resulted in the following:

• Employees needed access to the applications and data needed to do their jobs. IT departments had a difficult time processing the volume of remote access requests. To solve the problem, they may have created a global rule that everyone was granted remote access. The company VPNs also became overloaded, causing them to slow down or crash. Some cloud applications were only allowing access if employees were logging in from the corporate network.
• In the rush to allow everyone remote corporate access, the security department lost control of who was logging in from where and on what devices. They didn’t know if the people logging in from all these remote devices were the account owners – or if in that group a bad actor had gotten into an account and now had access to applications and files.
• Instead of only allowing access to their cloud applications from the corporate network, they changed the cloud application login policy to allow logins from anywhere. Yes, people could access the cloud applications from home, but so could anyone from almost any place on the planet.

What to look for in WFH security

If you need to provide WFH remote access, what do you need to be assured that the access to the applications, data and personal information is secure? Companies are looking for a security framework that provides threat management – the detecting and managing of cyber risk – including:

• Authentication: Identity as a Service (IDaaS) solutions provide scalable Identity and Access Management from the cloud. IDaaS solutions provide a first point of entry to a corporate network. The person’s identity is confirmed using a login/id, token, or 2FA strategy. Login information, such as when and where, are recorded.  
• Authorization: Simply – who has access to what. Configuring Single Sign-on (federations) allows the user to securely access applications and data that they are entitled to without having to enter a login ID and password every time. 
• Auditing: Keeping track of who is logging in from where and what they are accessing. For example, if a furloughed employee still has a network account, they could potentially access confidential applications and data that they should no longer have access to. 
• Analytics: More IdaaS solutions are using advanced analytics and artificial intelligence (AI) to determine if there is a login or data breach happening. The solutions analyze the identity and access data on an ongoing basis to determine if there may be unusual data downloaded, or a known malware has been uploaded and installed.
• Incident response: When a security breach does happen, do you know how to respond? If someone opens an email that installs ransomware, does your security department have a business continuity plan? If personal information has been compromised, what are your GDPR and CCPA responsibilities?  An incident response plan will spell it all out.

There are many other security needs, but these are some of the areas that you need to address, scale and deploy with your WFH employees.

Talk with us

You have a vision for your organization – don’t let your technology slow you down. Prolifics Security helps you architect and implement solutions by discussing and prioritizing your security requirements, as part of an overall security framework. Talk with us – let’s discuss your challenges, review and reevaluate your plans and get you started where it makes the most sense. Vision to Value. Faster. It’s not just our tagline, it’s what drives us. It’s how we deliver solutions and services. It’s our commitment to you – and it’s needed today more than ever. Visit prolifics.com or email solutions@prolifics.com.

About the author

Rob Adachi is Head of Security – Identity and Access for Prolifics and also leads a team of engineers implementing Tivoli security solutions for Fortune 500 companies. He has more than 20 years in the Identity Management field, starting with the early software development of the product that is now known as Tivoli Identity Manager (ITIM). Learn more about Rob here Identity and Access Management and Work-From-Home and reach him at Robert.Adachi@prolifics.com.