Viable identity and access management for MSPs

According to LastPass, 92% of people know that using a variation of the same password is a risk, but 65% still always or mostly use the same password or a variation. Password and device security are critical to the protection of both corporate data and personally identifiable information (PII).

In fact, reports of potential cyber warfare (including the exploitation of inadequately applied password and security policies) have increased dramatically in the last few years. This includes attacks against small businesses and enterprises, particularly in Ukraine and the United States. The implementation of stringent password and user data protections is absolutely necessary to maintain data privacy and reduce the potential for cyber threats. 

If you’re interested or concerned about this topic, our threat report, What MSPs Need to Know Regarding Potential Russian Cyber Warfare shows an MSP-focused approach to the issue.

Identity and access management is one tool network administrators have to combat potential cyberattacks. So, what is identity and access management? Identity and access management determines which user identities can access sensitive company data and personally identifiable information (PII). Companies that partner with MSPs are able to increase productivity and lower their IT costs (along with many other benefits). 

Why MSPs need an identity and access management solution

Identity access management is extremely important in today’s changing tech landscape. Offering this service to clients allows them to streamline their security processes and gives users the ability to access files and folders with ease. 

Without proper access controls, companies are susceptible to increasingly dangerous threats and subterfuge by malicious actors and hackers looking to invade their network. 

There are several reasons why identity and access management (IAM) solutions are important for MSPs. As a start, there’s compliance with privacy laws such as GDPR, HIPAA, and proposed legislation found in the American Data Privacy and Protection Act (ADPPA). Ensuring high levels of data and privacy protection on company networks continue to remain top of mind for both business owners and security professionals who monitor their networks for intrusions and potential security threats. 

Identity and access management (IAM) solutions function by:

• Providing employees and trusted members of the network easy access to company data and software
• Streamlining authentication of company employees and staff
• Allowing administrators to quickly manage business and employee applications from a central location 

Benefits of IAM for clients 

There are multiple benefits to implementing IAM for your clients. IAM streamlines workflows for employees and makes end-to-end file and network access painless and stress-free. 

• Security benefits: employee passwords access and login credential verification occur via a single portal. This heightens security and lowers unauthorized access to sensitive files and company data. 
• IT benefits: IAM lowers the need for human intervention due to the implementation of self-service password reset capabilities which saves client’s time and money.
• Employee benefits: single self-service access to work-related applications and elimination of employees needing to remember multiple company account passwords.

Key components of identity and access management

The role of IAM is to ensure proper access to sensitive data and corporate applications while making employees’ and managers’ lives easier. Identity and access management procedures should be comprehensive, and access control rules should apply permissions consistently across the organization. 

The key components of identity and access management include:

• Authentication: IAM helps to authenticate a user’s identity using known information by the user (password-based authentication) as well as multi-factor authentication and biometric authentication 
• Authorization: Users are authorized to access sensitive data according to a variety of strategies (one being the role and responsibility they hold within the organization) 
• User management: Users are typically managed via databases that contain information about users’ identities and their access privileges on the company network
• Central user repository: Users and information about their identity are stored in one central database that quickly verifies submitted credentials and ensures sufficient privileges exist for the user to access the requested resource

Best practices for identity and access management

Best practices for identity and access management exist to streamline identity verification and access to important business applications and data. 

The most common cybersecurity best practices for implementing identity and access management (IAM) in organizations include: 

Adopt a zero-trust approach to security

Zero-trust is a strategy used within organizations that eliminates implied trust and requires users to authenticate their identity at every stage of their interaction with the network or company resources. This approach occurs without human interaction and is beneficial to the organization because it saves time and is less of a strain on the organization’s budget than alternative security practices. 

Identify and protect high-value data

Data is typically classified by its sensitivity level (high, medium, or low). Security professionals and MSPs are required to grant access to this sensitive data only to those who have been cleared, authenticated, and permitted to access it. 

It is extremely important to identify which data is sensitive both in terms of containing proprietary company data as well as which files or information contain personally identifiable information (PII). By law (such as GDPR laws), PII and high-value data must be protected and cannot be shared except in certain circumstances. 

High-value data may include: 

• Private company data (including employee data, financial records, and intellectual property)
• Personally Identifiable Information (employee, supplier, and/or client data)
• Protected Health Information (any data covered by HIPAA and other privacy laws)
• Genetic or biometric data

Enforce strong password policies 

One of the most standard and common components included in IAM solutions are the requirement of employees, staff, and other users of any of the organization’s applications or systems in general to use strong passwords. 

Strong passwords include passwords that:

• Contain at least 14 characters or more
• Contain a combination of uppercase and lowercase letters, numbers, and symbols (!,@, etc.)
• Avoid obvious words or numbers (this definition varies depending on security practices)
• Avoid including personally identifiable information (last name, portions of a social security number, birth year, etc.)

Use of multi-factor authentication (MFA)

Multi-factor authentication is one of the most common and well-known best practices that security professionals advocate users make a habit of. MFA allows users the ability to choose several options which help authenticate their identity. This protects the user from data theft and the organization from unauthorized access by unknown persons or groups. 

Multi-factor authentication identity verification methods include:  

• Phone calls
• Email/phone text verification codes
• Secondary passwords or PINs generated by an application 

Principle of least privilege

The principle of least privilege (POLP) is a strategy that only grants access to data and files which are related to a user’s particular job role (and what they may use on a day-to-day basis). This is also known as assigning access based on a “need to know” basis. 

If you are unsure of any of the components listed above, contact us to discuss how we can help your organization meet the compliance and security standards expected within your industry. 

How to audit your identity and access management solution

It’s necessary to routinely audit your identity and access management solution to ensure your strategy complies with local laws and regulations, while also meeting the goals your organization has set out to achieve. 

Here is a checklist you can review when auditing your IAM system:

1. Frequently review your identity and access management policy: Ensure that your IAM policies are clearly defined and have appropriate use cases.Examine roles and responsibilities and ensure security and access controls are in place that aligns with the needs of these users.

IAM policies should:  

• Meet compliance guidelines and comply with laws and regulations, specifically including those related to data privacy protection
• Cover user authentication and access controls for sensitive data and information
• Include guidance on incident response and threat detection  

2. Streamline procedures: Your audit should include all stakeholders and evaluate whether the system correctly identifies who may be affected by access control and how to collect feedback and address the needs of these stakeholders with future iterations of your IAM solution. 

3. Review access restrictions and controls: It’s necessary to thoroughly investigate users’ access permissions and the rights various roles have accessing private or sensitive company data or information. 

1. Ask yourself whether any changes or additional privileges should be granted to various users, or if gaps exist in your access control policy that need to be closed. 
2. One effective strategy to implement is Policy-Based Access Control (PBAC), which streamlines the audit process and access control assignment challenges you may face if you have many users accessing files on your network. 

4. Segregate permissions by responsibility: Be sure that your access controls segment users’ access permissions based on their responsibility within your organization. Segregating users in this way keeps sensitive information secure and limited to those who need access (it also avoids the potential adverse scenario of one user being given access to information or network sections unrelated to their responsibility in the organization). 

5. Evaluate generic account privileges: When auditing your IAM solution, evaluate whether generic accounts have been given too much access to unrelated files, information, or data that may fall into the wrong hands. In many organizations, generic versions may be used by anyone in the organization. Security for these accounts may be an afterthought, and harmful incidents or loss can occur due to poor access controls and security measures not being a priority in the organization. 

Building a proper identity and access management program is an essential part of any MSP, but in some cases, it may make sense to incorporate an existing one into your business than starting from scratch. Learn more about our Identity Management by ConnectWise & Evo or request a custom quote today.