ciso insights to access security from gemalto’s access ... › customer ›...
TRANSCRIPT
1
CISO Insights to Access Security from Gemalto’sAccess Management Survey
Jeremy Tomlin
Director Product Management, Identity and Access Management, Gemalto
www.thalesgroup.com
3
CISO Insights to Access Security from Gemalto’s Access Management Survey
4
Demographics
Gemalto IAMI - research results
…respondent country …organization size …organization sector
1,050 IT decision makers were interviewed in January and February 2019
Figure D1: Analysis of respondent region, asked to all respondents (1,050 respondents)
Figure D2: “How many employees does your organization have in the country you are based?”, asked to all respondents (1,050 respondents)
Figure D3: “In which of these sectors would your organization be categorized?”, asked to all respondents (1,050 respondents)
200
100
100
100
100
50
100
100
100
50
50
US
Brazil
UK
France
Germany
BeNe
India
Japan
Australia
Middle East
South Africa
250
283313
204
250-499 employees
500-999 employees
1,000 - 5,000 employees
More than 5,000 employees
183
132
118
113
94
80
65
61
59
43
43
54
5
IT/computer services
Manufacturing
Financial services
Retail
Telecoms
Government
Utilities
Healthcare (private)
Construction/real estate
Healthcare (public)
Insurance/legal
Other commercial sectors
Other public sectors
5
Targets for cyber-attacks
In general which of the following do you think are the biggest targets for cyber-attacks?
> Unprotected infrastructure is one of the biggest targets for cyber-attacks
54%
50%
49%
45%
37%
37%
30%
28%
28%
28%
28%
25%
18%
1%
0%
Unprotected infrastructure (e.g. new IoT devices)
Web portals
Cloud applications (SaaS, PaaS, IaaS)
Mobile applications
Local network access
Enterprise applications (including legacy systems)
Third party vendors
Virtual desktop infrastructures (VDI)
VPN
Supplier networks
Outlook web access (OWA)
AI based applications
Consultant networks
There are no specific targets
Don’t know
6
Cloud applications as a target
41% say that poor access management solutions for the cloud results in cloud
being a target
63%
55%
54%
50%
44%
41%
0%
71%
55%
N/A
51%
35%
42%
0%
The increasing volume of cloudapplications in use
Lack of strong cyber security solutionsto implement appropriate protection
Inconsistent security protection acrosscloud
Lack of in-house skills to secure cloudapplications
Organizations have poor visibility overtheir applications in the cloud
Poor access management solutions inplace for the cloud
Don’t know
2018/19 total 2017 total
Why do you feel that cloud applications are a target for cyber-attacks
7
Drivers for access management solutions
> Security is a key driver for the implementation of access management solutions
4%
8%
3%
6%
8%
6%
9%
5%
16%
22%
18%
26%
29%
26%
32%
27%
55%
51%
59%
57%
55%
61%
54%
64%
24%
18%
17%
7%
7%
4%
3%
2%
2%
1%
2%
3%
2%
3%
2%
3%
The threat of large scale breaches
Simplified cloud access for end users
Security concerns
Inefficient cloud identitymanagement
Current inability to scale cloud accesscontrols in the enterprise
Enable new ways of doing businesse.g. employee mobility and digital…
The volume of help desk ticketsowing to lost and forgotten…
Visibility and compliance concernsrelating to cloud access events
Not a consideration A small consideration One of the main considerations Most significant consideration Don’t know
8
Cloud access management being conducive to cloud adoption
Do you see cloud access management for cloud and web applications as being conducive to facilitating cloud adoption?
> Cloud access management for cloud and web applications is conducive to facilitating cloud adoption
56%
40%
2%
1%
48%
43%
5%
4%
Yes, definitely
Yes, to some extent
No
My organization does notuse cloud apps
2018/19 total 2017 total
9
Impact of ineffective cloud access management
48%
44%
43%
38%
29%
28%
26%
26%
3%
1%
Cloud becoming a security issue
IT staffs' time being used less efficiently
Increase in operational overheads and IT costs
Larger scale breaches due to a lack of visibility over cloud
Shadow IT taking place
Slower adoption of cloud
Duplication of cloud applications
Decreased user mobility
There is/would be no impact
Don’t know
> Ineffective cloud access management can be problematic
What impacts does/could your organization see to its cloud and web resources as a result of ineffective cloud access management?
10
Authentication policies
Authentication is important to many areas of the business
> Analysis of respondents who agree with these statements
81%
78%
73%
72%
My organization's level of employeeauthentication needs to be able to
support VPN and cloud access
Policy-based access management isthe future of access security
Access management and identitygovernance administration is more
effective when separated
Authentication methods used in theconsumer world can be applied to
ensuring secure access toenterprise resources
11
Two-factor authentication facilitating cloud
> Do you see two-factor authentication for cloud applications as being conducive to facilitating cloud adoption?”,
> Two-factor authentication can be conducive to facilitating cloud deployment
94%...
…see two-factor authentication for cloud
applications as being conducive to facilitating cloud
adoption
12
Data/information used in a smart SSO solution
Smart SSO is a sought after solution
65%
57%
44%
42%
36%
30%
29%
1%
2%
Sensitivity of the data
Sensitivity of the application
Function/department of the user
The network being used
Seniority of the user
Other data accessed in the previous24 hours
Length of service to the organization
I would not like to see a smart SSOsolution
Don’t know
Which of the following types of data/information would you like to see used in a smart SSO solution?
13
Benefits of smart SSO
54%
52%
50%
42%
41%
37%
37%
32%
1%
2%
Employees feel their data is secure
Customers feel their data is secure
Preventing breaches of data
Security solutions becoming proactive rather than reactive
More secure than regular SSO (the same credential is used across
the board for all apps)
Speed of allowing access
Better able to be compliant/meet regulations
Cost effective
There are/would be no benefits
Don’t know
> Smart SSO can bring vast benefits to organizations
What are/would be the benefits of your organization using smart SSO?
14
Typical Cloud Migration Scenarios
15
> We wanted access from anywhere on any device
> We added applications
> We wanted partner access
> We wanted cloud applications
> The perimeter has changed
What does cloud adoption mean
16
Before you know it…
DB
Network Storage
On-Prem Apps
File Servers
End PointVPN
IT Admins
Standard Users
C-Suite
HR
TravelFinancial PAM
Password ?
Password ?
Password ?
Password ?
Password ?
Password ?
Password ?
MFA
RADIUS
AGENTS
APIs
17
Determine who, when and how users log in to cloud apps
ASESS RISK
MANAGE RISK
CONTAIN RISK
• Define where your
sensitive data is located
• Identify cloud apps
• Define who should access
what
• Define appropriate
authentication method
Define access policies taking into
account
• Identities/profiles
• Type of resource being accessed
• Context (device, location, network…)
Detect, Monitor and Respond
• Detect unusual security events
• Respond: Block, allow, step-up,
etc.
• Monitor: Report & adapt policies
1
2
3
18
Step up to MFA
SS
O
Access P
olic
ies
Set policies that take into account role and context to apply the right level of security at the right time
SaaS / IaaS
Conte
xtu
al attribute
s
SAML
OIDC
APIs
IT Admins
Standard Users
C-Suite
19
Applying the right level of security for the right users
DB
Network Storage
On-Prem Apps
File Servers
End PointVPN
IT Admins
HR
TravelFinancial PAM
Access to admin consolesSmart Card authentication needed every time
20
Applying the right level of security for the right users
DB
Network Storage
On-Prem Apps
File Servers
End PointVPN
IT Admins
HR
TravelFinancial PAM
Access to admin consolesSmart Card authentication needed every time
Standard Users
O365 access from local networkTransparent authentication (context), once per session
21
Applying the right level of security for the right users
DB
Network Storage
On-Prem Apps
File Servers
End PointVPN
IT Admins
HR
TravelFinancial PAM
Access to admin consolesSmart Card authentication needed every time
Standard Users
O365 access from local networkTransparent authentication (context), once per session
C-SuiteO365 access from outside network on known device
PUSH OTP, once per session
22
Step up to MFA
SS
O
Access P
olic
ies
Now tie it into your existing access security and MFA framework
SaaS / IaaS
On-prem Apps
RADIUS
SAML
OIDC
AGENTS
APIs
Conte
xtu
al attribute
s
23
C-Suite
Users/GroupsTarget Apps
IT Admins
Standard Users
C-Suite
Example on how to set access policies with SafeNet Trusted Access
24
C-Suite
Users/GroupsTarget Apps
Define Policies
• Scenario-driven
• Compliance-focused
• Based on context & risk
• Set Auth rules by policy
IT Admins
Standard Users
C-Suite
Example on how to set access policies with SafeNet Trusted Access
25
C-Suite
Users/GroupsTarget Apps
Define Policies
• Scenario-driven
• Compliance-focused
• Based on context & risk
• Set Auth rules by policyMonitor Risk
IT Admins
Standard Users
C-Suite
Example on how to set access policies with SafeNet Trusted Access
26
C-Suite
Users/GroupsTarget Apps
Define Policies
• Scenario-driven
• Compliance-focused
• Based on context & risk
• Set Auth rules by policyMonitor Risk
Adjust
IT Admins
Standard Users
C-Suite
Example on how to set access policies with SafeNet Trusted Access
27
Trusted by leading global brands
30 years in Identity & Access Management
More than 25,000 customers and more than 30
million users
Cloud security pioneer: First vendor to offer
cloud-based authentication
Gemalto is the world leader in digital security with
solutions that protect the entire digital service cycle
UK Government
Access Management and Authentication from Gemalto
28
Thank You