What is identity management? Enabling the right individuals to access the right resources at the right times and for the right reasons. It’s your first line of defense in the new world of computing security.
But how do you get started with identity management and ensure you are employing the right roadmap for your business? In an effort to get our customers on that right track, we’ve put together a quick Identity Security Checklist that you can use to see where you’re at and where you ought to be going. It’s not all-encompassing, but this will be a good start no matter where you are on your Identity Security journey.
Identity Security Checklist:
- Define data types and data classification within the organization
- Define acceptable means of accessing company data
- Ensure all employees have defined job titles/roles
- Ensure all defined job titles/roles have been mapped to data they can access from Data Classification policy
- Identify if a Chief Information Security Officer (CISO) is required at your organization, or if these responsibilities will be rolled into an existing role
- Ensure any repeatable technology processes are as automated as possible
- Develop disaster recovery plans in the event of major outages or security breaches
- Implement encryption solutions where data sits at rest based on job titles/roles
- Implement identity automation and access management solutions
- Configure client device policies with a focus on security best practice
- Conduct regular security training that includes both technology and social engineering best practices
If you have checked everything off, then you’re way ahead of the game!
If you’ve left a few boxes empty, then comes the question, what projects should we start with? What will bring the most value to our users? We’ve prepared a list of projects that we’ve completed for customers that might pique your interest. How many of the below Identity Security items have you considered implementing at your company?
Identity Security Project Examples:
- Identity Unification - Use SSO and Federation to ensure that your users only have one username and password to use and keep secure
- Two Factor/Multi Factor Authentication - Use something you know and something you have to ensure accounts are more secure
- User Role Mapping - Creating a list of user roles at your organization to aid in role based administration and control (RBAC) across systems
- User Role to Access Mapping - Ensuring that each role has a defined level of access to corporate resources
- Data Classification & Data Access - Understand what type of data your organization creates and ensure that data is limited to the user roles that need to access that data
- User Onboarding - Ensuring that onboarding is consistent, auditable, and in line with defined policies
- User Offboarding - Ensuring that offboarding is happening and that any access granted to a user account is removed
- Conditional Access - Allowing access to company resources based on device configuration or user conditions (Location, application used to access, etc.)
- Data Protection - Using toolsets that ensure sensitive data is classified and encrypted, no matter what device it’s on
- Behavioral Analytics - Using Artificial Intelligence to note if a user’s access and behavior change, and limit access if behavior is irregular
This list isn’t all encompassing, and in fact, you may have even fewer projects to consider depending on the size of your organization. Either way, hopefully this gave you a few things to think about and put on your IT roadmap for the coming months.
If any of the above topics are new to you, or if you’re not sure where they might fit into your technology roadmap, we’d love to help! Reach out and we’d be happy to discuss with your team and set some next steps!