How governments can implement people-centric security
By SailPoint
Mike Kiser, Senior Identity Strategist, Office of the CTO, SailPoint shares how organisations can pivot towards people-focused cyberdefense.
Cybersecurity is a team sport, and humans must still play a central role, says Mike Kiser, Senior Identity Strategist, Office of the CTO, SailPoint. 99 per cent of cybersecurity attacks require human interaction, according to Security Intelligence, making it crucial to involve humans as the “key line of defense.”
Kiser explains why a people-centric focus is crucial, and how governments can take such an approach to security.
What are people-centric systems?
People-centric systems focus on the role that humans play in cyberdefense, says Kiser. One example would be access controls. Organisations need to identify users or bots trying to access systems, and only grant access to relevant data required to carry out their tasks.
Establishing identity “should be the center of any coherent security approach,” he says.
Norfolk County Council realised that there were gaps in their identity-based security. Information access was not linked to human resource systems, creating issues for new employees, ex-employees and temporary staff, states the SailPoint website.
The council implemented human-centric systems that were better able to track identities. It gave them the ability to track the journey of employees from the start of their employment till the end, allowing access as necessary.
GILAI manages the information systems for disability insurance groups as part of the Swiss regional government. “We manage data for people across Switzerland, so we require sensible and effective security,” said Sandro Lensi, CIO at GILAI.
They implemented a people-centric system, providing an overview of access protections, with an AI and ML system that makes recommendations on security decisions. That allowed the organisation to manage identity access in less time and with less reliance on IT support, Sandro says.
Securing emails
A blog post from Microsoft describes how malicious actors targeted 3,000 email accounts belonging to government officials, consultants and think tanks. They sent an email that, upon clicking, installed a malware programme for stealing data and infecting other computers.
Phishing emails such as these prey on human involvement in organisations’ digital systems. Human-centric security would thus include protecting staff against malicious emails.
SailPoint works with security company Proofpoint to provide email protection services. The software automatically identifies employees with access to sensitive data, and applies appropriate security controls to their email accounts. If an account is compromised, user access is automatically removed.
Identity at the core
Governments must establish a protocol for “governing identity” in order to implement human-centric systems, says Kiser. By knowing who should have access to what systems, organisations can then identify groups of interest or unusual behavioural patterns.
As tech changes rapidly, SailPoint focuses on adapting these systems rather than on “legacy piecemeal approaches,” he adds.
People still remain at the heart of security. By establishing the right identity controls, organisations can protect themselves against a rising wave of threats.