Addressing Challenges in Implementing “The Use of Company Property” policy at a Leading Insurance Company

Company X is a leading insurance company which provides laptops to all employees for their work, regardless of their grade in the organization’s hierarchy.

The company has deployed a gateway firewall, incorporated with a DNS filter to blacklist or whitelist access to certain websites. In this manner, users are denied access to malicious websites, and threats due to unauthorized website use is prevented while users are within the office network.

How DNS Filtering Works?

Whenever a user makes an internet search, a request is passed on to the network through an IP. However, when DNS filtering is implemented in an organization, the relevant web page is redirected to the firewall where the restrictions are verified. If it has been blacklisted, access to the webpage is blocked.

Loophole Causing Security Concern

When more and more users beginning to work from home or work while travelling using the laptops provided by the company, Company X began facing new security concerns.

Although the firewall’s DNS filter was effective when users were within the office network, the user’s laptops were outside of the firewall’s reach. This meant that users could access any site or download any software without any restrictions, exposing the company-owned devices (COD) at risk due to unauthorized websites. This, in turn, threatened to compromise both the devices and the data stored in them.

It also made the devices non-compliant to the Company Owned Device (COD) policy.

Prognosis

The DNS filtering rules set by the company no longer applied when users took their devices outside their network and firewall. Addressing this issue, CloudNow’s Identity and Access Management (IAM) solution was deployed. With its website filtering feature, maintaining DNS filter rules was made possible, even outside the firewall.

With Akku, requests made by users to access any website goes through its DNS filter, which checks for restrictions and blocks unauthorized web pages. Here, the router acts only as the connecting bridge to the internet. This makes it possible to maintain website blocking instructions for devices, disregarding where the users access them from through the internet.

Why is DNS Filtering Outside your Firewall is a Necessity?

It is a vital for all organizations to increase the security of their data by preventing access to malicious websites in CODs. Additionally, this feature ensures that all CODs comply with security standards and remain audit-ready.

Maintain your DNS filter rules even outside your office premises with AKKU’s website filtering feature.

Bolster Data Security with a Powerful and Flexible Password Policy

An array of information being stored online comes with major security risks. Therefore safeguarding data is an important consideration at any organization. And the security of your data relies heavily on the strength of your users’ passwords. The stronger your passwords, the more secure your data! It is important for administrators to drive a strong password policy enforcement, as it is the first layer of defence against black hat hackers and scammers.

A password policy is a set of rules created to upgrade an application’s security by requiring its users to frame a strong password and to utilize it in an appropriate way.

Why is Securing your Border Vital?

In today’s scenario setting up unique passwords for multiple applications is a burden for any user. Most users rely on using a single password for multiple applications, which can put the organization’s data at risk.

This makes implementing a strong password policy essential in protecting your data. Additionally, setting a Password Policy forms a part of the policies or rules for an organization to comply with ISO and PCI certifications.

Top Four Factors for Password Policies

Enforcing a strong password policy in an organization is an uphill task. There are some fundamental norms which are followed by a majority of organizations.

1. Length: The longer the password, the more difficult it is to crack. Set a minimum of 8 characters for your users’ passwords.

2.Complexity: The level of security depends on the complexity of the password framed. Passwords must have a mix of uppercase characters (A-Z), lowercase characters (a-z), numbers (0-9) and punctuations ( eg. !, #, $,*).

3.Expiration: A best practice in improving password security is to have a periodic password expiry. Most often the validity is 30/45 days and at the end of expiry date, the user is forced to change their password.

4.Uniqueness: Require users to set a unique password that has not been used previously when they reset their password.

How Can a Forgotten Password be Securely Retrieved?

When a user logs in with the right password, he is permitted to access the organization’s applications. On the other hand, when a user logs in with incorrect credentials, if the organization allows SSPR (Self Service Password Reset) then the system prompts the user to reset the password on his own.

Here’s how it works – a window pops up with a certain number of questions, and when the user answers all the questions correctly, he is permitted to reset the password. However, this process leaves the door open to social engineering attacks by black hat hackers.

A safer approach is to disallow SSPR in the password policy of an organization. In this scenario, the only way to reset a user’s password is to reach out the admin – this is safer and does not allow any intrusion through social engineering, and therefore reduces the data security threat.

How can a Forgotten Password be Securely Retrieved
How can a Forgotten Password be Securely Retrieved

I shall write more about SSPR and social engineering in my next article.

Enforce a strong custom Password Policy across your organization using Akku’s Password Policy Enforcement feature which brings it all together for improved security.

Harnessing the Power of YouTube for your Institution

Many tools or resources we use come with both pros and cons depending on how we make use of them. YouTube is no different – in the scenario of a school or college, it can be a gamechanger if used effectively, or it can have a negative impact on work and productivity if misused.

As the most popular platform for accessing video content, YouTube is a major e-Learning resource, where it is possible to access content on almost any subject. It provides access to answers to queries and presents content visually, which tends to be faster and more effective for learning than reading.

YouTube has huge volumes of content and e-learning videos from different parts of the world by certified teachers and professors, all of which are accessible at no cost, offering a major benefit to institutes.

However, YouTube access is restricted in almost every educational institution, because of its potential negatives. One major concern of management is students accessing irrelevant content.

For example, if a student is trying to access any video from YouTube there is a high chance of him/her getting distracted by content from unrelated topics, leading to a loss in productivity and concentration.

YouTube itself provides a filtering solution to address this issue – YouTube’s Restricted mode. But even if YouTube is used in Restricted mode, irrelevant videos can be accessed if the user uses an incognito window or uses YouTube without signing in.

Therefore it is vital for both the institute and its students to provide access only to relevant videos from YouTube.

Most institutes block students from accessing unwanted websites through firewall settings. However, students from today’s generation are aware of loopholes by using a proxy server to access any sites they want, which does not serve the purpose of having the firewall in place.

So completely blocking access to YouTube is not the right solution, since this is also often not completely effective, and you will end up restricting access to the biggest learning platform for your students.

Instead, putting in place a YouTube Filtering mechanism, which can act as a firewall and give access only to relevant content from approved channels and categories on YouTube while denying access to irrelevant content is the optimal solution.

Leverage the power of YouTube for your institutions without worrying about the downside with the help of Akku’s YouTube Filtering.

To know how YouTube filtering works: https://www.akku.work/blog/youtube-usage-at-the-office-is-no-longer-a-worry/

Permit Access only from Approved Devices and Whitelisted IPs!

Allowing your users to access your official data from anywhere and at any time sounds like a great idea! They can complete their work even when they are on the move by accessing your company’s cloud-based applications. So, why should we restrict access when it has all these pros?

When you permit unshackled access to your company’s applications from any location and device then you also expose your company’s sensitive data and apps to the risk of security or privacy breaches. The possibility of unauthorized access to your sensitive data is a major concern for any company using cloud-based applications.

Why do you need IP restriction?

IP-based access restriction is a great way to secure and protect your mission-critical business data outside your LAN by preventing access to your apps from any IP addresses other than your trusted whitelisted IP ranges.

How does IP-based restriction work?

An IAM solution offering IP-based restriction uses a customized SAML API and integrates with your cloud-based applications. That way, identity management is brought into a common platform across all service providers, with the IAM solution acting as the identity provider. With the identity provider enabling one point control, it is possible to restrict access to your applications only from permitted locations, regulations and IP addresses.

Why restrict based on device?

Device-based access restriction allows you to allow access for specific users only from authorized devices, to prevent misuse or loss of data – that way, users cannot access applications from devices that have not been approved for their use, and unauthorized people cannot access data from devices that may have been approved for other users.

How does device-based restriction work?

With many IAM solutions, device-based restriction is applied through the use of plugins – however more advanced solutions make use of a certificate-based authentication method which has the major advantage of being tamper proof.

A secure certificate-based authentication is completely platform and browser independent and enables cloud administrators to provide or revoke access to SaaS based applications only from specific devices, even when they are outside the office network. Restricting access based on device helps to minimize data breaches and provides the right access to the right people.

Akku offers an IP and device based access restriction feature to help ensure that your data is secure and well protected.

YouTube Usage at the Office is No Longer a Worry!

Using YouTube at the office is often viewed negatively, both because of it results in heavy bandwidth consumption, and in reduced employee productivity. At the same time, YouTube is a huge digital library where it is possible to access content on almost any subject.

In today’s fast-moving business scenario, YouTube is one of the best platforms to enhance knowledge and skills. While lectures and training may tend to get boring, digital learning is a great way to build interest. YouTube has an enormous range of content from various categories.

Training and development is a department for which YouTube is an essential and effective resource. Trainers can train employees with e-learning videos from YouTube at no cost, and can also recommend videos related to their work and skills to help them perform better.

So completely blocking access to YouTube is not the right solution either, since you will end up restricting the biggest learning platform for your employees.

Providing access to or blocking YouTube tends to be viewed to be an all or nothing exercise – but there is a middle path. Implementing a YouTube filtering solution on your cloud can get you the best of both worlds.

What is YouTube Filtering?

YouTube Filtering is an interesting feature of select Identity and Access Management solutions, which can whitelist specific videos from YouTube based on categories and channels.

YouTube filtering restricts people from accessing irrelevant content on YouTube. Restricted and Moderate Restricted modes can also be activated using a YouTube filter – the Restricted mode helps to block all 18+ content from YouTube while the Moderate Restricted mode prevents employees from liking, commenting on or sharing videos.

How does it work?

YouTube Filtering works with the help of a proxy server which reads the metadata consisting of the channel name, category, channel ID, file name and so on.

For instance, when the user is searching for a video on YouTube, the proxy server will read the metadata to confirm whether the channel is whitelisted, based on which it displays the video. If the channel is not whitelisted, an error is displayed to the user that access to the video is not permitted.

Leverage the power of YouTube for your organization without worrying about the downside with Akku’s YouTube Filtering feature.

How an Identity and Access Management Solution Can Help Your Data Driven Business

Cloud technology has broken several operational barriers to make remote data access easy. It allows you to scale your business with minimal cost while securely holding business-critical data and applications. But with all these advantages comes a catch – managing personnel access for all the applications and files in your network has become increasingly cumbersome.

Why does your organization need an Identity and Access Management Solution?

Managing the credentials of all your employees across all the verticals of even a small to mid sized organization is time-consuming. It can drain the productivity of your company’s Human Resource and IT management teams. They are valuable resources who could otherwise focus on their core competencies to help you grow your business.

In addition to this, securing your network from breaches and other threats can be challenging with so many people accessing your cloud from various devices and locations. If your network is compromised, all your critical business data is compromised along with it.

This is where an Identity and Access Management (IAM) solution can come in handy. It allows you to seamlessly manage access while protecting your cloud network from breaches.

Building blocks of an IAM solution

A strong Single Sign-on (SSO) function is at the heart of an IAM solution. The first step in implementing an SSO is to determine and streamline the role of the identity provider (IdP). The IdP is responsible for bringing all the applications and data on your cloud network to a centralized platform. From this platform, access and identity services are managed through a customized Security Assertion Markup Language (SAML). When a high end, customizable SAML is integrated with your enterprise cloud network, it can result in a secure Single Sign-on solution.

With a cloud SSO setup, you can provide each member of your organization with single login credentials for any or all the applications in your cloud network. With your own powerful Identity Provider, you can redirect all access authentications to a safe and fast network. With this setup in place, it is possible to consolidate a single node in your network to control access to your entire organization’s cloud network.

Features of an IAM System

With an efficient Identity and Access Management system, you can accomplish so much more than just rudimentary monitoring of your cloud network. It will come with a well rounded set of features which allows you to control your cloud in a convenient platform. If your network is fitted with a powerful cloud IAM solution, it will automatically come with provisions in place to handle password standardization and multi-factor authentication frameworks.

Single Sign-on

Allocating a single set of credentials for your employees to access relevant data and applications is made easy by implementing an SSO solution for your cloud network. As the admin of your network, it also becomes simple for you to handle access operations in a single dashboard. In addition to this, if the need arises for a user to be removed, it can be done in a few short steps instead of removing access individually for all your applications. When all of this comes together seamlessly, it results in improved productivity across your organization.

Multi-factor Authentication

Sometimes, in spite of the password protection measures you have implemented to secure your cloud, you might feel the need to bring in an additional layer of security to protect all your critical business applications. When that need arises, a well structured IAM solution allows you to keep in place, a multi-factor authentication system. It ensures that your system is insulated against remote attacks and prevents unauthorized access from getting a foothold in your secure network. This will enable you to extract data from TOTPs, thumbprint scanners or even Yubikeys and verify the users accessing your cloud network.

Password Policy Enforcement

Another challenge faced while trying to secure a cloud network is the varying standards of all the passwords of all the users who access it. The difference in standards can make breaches easier to happen and there rises a need for standardization of all the password credentials issued to the users of your cloud. But with an IAM solution, you can set the minimum standard required to set a password. With an effective password policy enforcement, you can rest assured that all your critical data is protected irrespective of the number of service providers you are associated with. It consolidates all the applications on your network under a single identity and verifies that all the passwords required to access your network comply with PCI and ISO/IECt standards.

Securing your cloud with an effective Identity and Access Management solution can empower you to control identity and access across your cloud environment. In addition to this, an IAM solution helps you improve data security, privacy, standards compliance, and productivity.

Addressing the Data Security and Audit Worries of a Leading Manufacturer

Company X is a leading automotive hardware manufacturer. In the competitive manufacturing environment, documentation of activity are standardization of processes are critical requirements.

In the case of Company X, this was already in place, and in fact they had achieved ISO certifications for their process-based approach and class-leading quality.

However, certification brought with it a constant stream of audits to ensure that processes were in fact being followed, and standards maintained. This posed a recurring problem, since a single failed audit could result in the loss of certification and loss of business.

The employees of Company X were well equipped – every employee was given an email address, and employees above a certain grade were provided with a laptop and a smartphone as well. But being an ISO-certified enterprise, the security of devices and data were vital.

Diagnosis and Prognosis

Given the background and the critical business impact of a failed audit, potential problem areas were quickly identified, along with solutions.

One of the first problem areas that needed to be addressed was that many employees tended to set weak, easy-to-crack passwords that exposed the company to data security threats, while also failing to comply with ISO standards.

A strong, universal, standards-compliant password policy was necessary to ensure uniformly high security across user accounts.

A mandatory ISO-compliant password policy for all users could easily be set up with Akku.

The next point of concern was the possibility that sensitive business data could be compromised by employees.

The solution to this was to enable employees to access their company email accounts only from the devices provided by the company.

Akku enabled restricting access to company mail only from devices with its SSL Key installed.

Another issue identified was that website browsing restrictions were implemented only on the company’s firewall. Therefore, exposure of company devices to malware and external threats while outside the firewall was a looming worry.

A DNS filter to restrict browsing access even outside the firewall became essential.

Akku’s website filter provided this functionality with powerful control and ease of use. This helped to keep the company’s devices secure, whether they were located within the company firewall or not.

This type of device-based access control offered by Akku seemed to tick all the boxes, but it would fail to serve its purpose if it could be tampered with by a user.

Many legacy solutions built using plugins were found to be vulnerable to misuse – with these solutions, it was possible for users to find a way to circumvent the access control by simply removing the plugin to enable unrestricted access. The device could then be made to appear uncompromised by reinstalling the plugin later. Such a solution was far from water-tight.

With Akku on the other hand, the implementation of a certificate-based architecture overcame this potential challenge. This was because any attempt to tamper with Akku’s certificate would completely restrict access to their authorized services like official email and other SaaS-based applications. Reactivation would require a certificate password, available only with the systems admin.

By enabling easy identification of any attempts to evade the implemented access restrictions, potential leaks were plugged and accountability enforced.

Trial by Fire

The road to full implementation of Akku was a challenging one.

After the problem areas at Company X were identified and Akku was presented as the solution, a PoC was run successfully with 30 users to confirm that all requirements were in fact addressed completely.

With this first hurdle crossed, the client next proposed implementation and testing at their Japanese parent company. Stringent testing on every parameter of Akku’s performance was carried out over a period of several weeks in Japan.

At the end of this process, Akku was approved for the final roll-out across 300 users.

What is an IAM ?

Identity and Access Management (or IAM) solutions – also known as Identity Management (IdM) solutions – form a critical component of an enterprise’s IT security. And when used with cloud-based applications, they form part of a powerful cloud security set up too.

In simple terms, an IAM helps to control which users can access what data, as well as from where and when this access is permitted.

So how does an IAM work?

In any Identity and Access Management solution, one of the core concepts at play is that of an Identity Provider (IdP). The IdP brings all of the enterprise’s cloud-based application on to a common platform from where identity information can be managed and authentication services provided through the use of a Security Assertion Markup Language (SAML).

Through this process, it becomes possible to establish a single point of control across all of an organization’s cloud applications, and to provide a single point of access to all users, in the form of a Single Sign-on (SSO) – one of the fundamental functionalities of an IAM.

What features do IAMs offer?

Most IAMs offer some or all of the following features:

Single Sign-on

Enables administrators to provide each user with a single login to access any or all of the local and cloud applications used by the organization.

Multi-factor Authentication

Provides a powerful additional layer of access protection through a TOTP or other methods.

Password Policy Enforcement

Enables enforcement of a custom password policy across the organization, to comply with statutory (or the company’s own) security standards.

Is Akku an Identity and Access Management solution?

Akku is indeed an IAM solution, but it’s also so much more. It brings to the table all the security and access restrictions that a standard Identity and Access Management solution has to offer, along with several additional features to boost security and productivity across your cloud environment:

   1) IP- and Device-based Restriction
   2) Personal Email Blocking
   3) YouTube Filtering
   4) Website Filtering

Do visit the main website for more information on Akku’s powerful value proposition, and to see how Akku can help you control your cloud.