Akku is a great way to control and authenticate communication channels for any enterprise.
One of the biggest threats to any organization is the possibility of a data breach, which can result in loss of data, loss of trust, and ultimately, loss of growth of the business. This makes data security a critical aspect to consider in any enterprise.
An important consideration, especially for SME businesses, is to secure their data – most companies still look for a way to do it in the traditional approach to data security – with an on-premise local environment.
Running the organization with an on-premise environment requires a dedicated workforce, this can be replaced with a secure cloud-based environment. But how does this fit in with Akku? Akku is a pure cloud Identity and Access Management solution that can be integrated with cloud, hybrid or on-prem applications.
So how can Akku help your organization?
Akku’s first great feature would be its Single Sign-on (SSO), where any enterprise’s user accounts and applications can be integrated into a single platform – making access easy for users and control easy for admins.
Unauthorized access is restricted by Akku, which is built on a certificate-based authentication architecture.
It is also possible to filter the content accessed by an organization’s users – DNS filtering to control websites that can be accessed, YouTube filtering to ensure only relevant video content is viewed, and even personal email blocking to improve productivity and security.
Akku also maintains highly granular logs, allowing for detailed reporting on user behavior – time, location, OS and so on for users logging in.
These are just a few of the functionalities that Akku brings to the table to add value to your organization’s data security.
So fight back against data breaches, and tell the world “My Data and Communication are secure!”
As per a survey by Forrester Research (Forrester Consulting Thought Leadership Paper, February 2017), in the last 4 years, out of every three organizations, two have had an average of at least 5 breaches. There are nearly 6 billion data records that were stolen and lost in the past 10 years. According to www.breachlevelindex.com, an average of 165,000 records are compromised every hour. According to this article published on www.csoonline.com, global cybercrime related damage is expected to exceed US$ 6 trillion annually by the year 2021.
How can IAM help protect data?
Identification: Users make their claim on their identity by entering a username and verify through an authentication process
Authentication: Authentication may be a password or may rely on advanced technologies, such as biometric and token-based authentication
Authorization: The IAM system must then verify the user’s authorization to perform the requested activity and also ensure that users perform actions only within their scope of authority
Together, these three processes combine to ensure that specified users have the access they need to do their jobs, while unauthorized users are kept away from sensitive resources and information. Effective IAM solutions help enterprises facilitate secure, efficient access to technology resources across these diverse systems.
Identity and Access Management (IAM) is the information security discipline that allows users access to appropriate technology resources, at the right time. It incorporates three major concepts:
According to this article on BizTech magazine, improved data security is one of the three main reasons to deploy an IAM solution.
The article highlights the fact that consolidating authentication and authorization functionality on a single platform provides IT professionals with a consistent method for managing user access. And when a user leaves an organization, IT administrators may revoke their access in the centralized IAM solution with the confidence that this revocation will immediately take effect across all of the technology platforms integrated with that IAM platform.
The European Union enforced the General Data Protection Regulation (GDPR) in May 2018 with three main aims: to harmonize data privacy laws across Europe, to protect and empower the data privacy of all EU citizens and to reshape the way organizations across the region approach data privacy. As you can see “data privacy” is the keyword in all three of the above mentioned aims. With multiple data breaches coming to light in the recent years, even from several of the world’s biggest corporates, the European Union has enforced stringent measures to regulate the use and prevent the misuse of citizens’ data through the GDPR.
Compliance and Consequences
As stated specifically in the GDPR, all enterprises (whether businesses or organizations) must take a “high level of protection of personal data” as one of their top priorities so that the “abuse or unlawful access or transfer” of such data may be prevented. If data is breached, or if GDPR procedures are compromised, the enterprise will face serious penalties. The fine for the non-compliance to GDPR for breach of data could be up to €20 million or 4% of annual global turnover, whichever is higher, depending on the type and extent of the breach.
This applies not only to enterprises within the EU, but also to those that may be located outside and offer goods or services of any type to the EU. The GDPR rules also apply to cloud controllers and processors.
The Emphasis on Passwords
Interestingly, the GDPR does not place any direct regulations on the way passwords are created or used. However, when it comes to the protection of online data, it’s hard to argue against securing passwords being the logical first step. On the one side, businesses that provide access to customers through an online portal typically ensure that they are creating secure passwords to sign in to by enforcing password policies that define their length and other parameters.
However, the slip often occurs when the employees of these enterprises are allowed to create weak passwords for accessing in-house applications. What is often forgotten is that these applications also carry sensitive data that belong to both the enterprise and its customers. A compromise here can cost the enterprise more than just the data; it will cost its credibility as well.
A strong password policy, therefore, becomes a key first step in the path to GDPR compliance.
The Inevitability of a Password Policy
By enforcing a strong password policy, administrators can ensure that users of an enterprise’s applications set up and use only passwords that are secure and, therefore, much less susceptible to brute force attacks and other hacking attempts.
A password policy defines and enforces a set of rules that include the minimum length, acceptable combination of small and upper case letters, use of numbers and special characters, expiration period of passwords and so on.
Without a password policy, the administrators of an enterprise would have no control over the type of passwords their users set, and would have their hands tied when it comes to situations that lead to a data breach, making it hard to demonstrate the GDPR’s requirement of a “high level of protection of personal data”.
This makes a strong password policy a critical requirement for every on-premise as well as cloud-based application, both for data security and to work towards complying with this aspect of the GDPR.
The Hybrid and Multi Cloud Conundrum
Unfortunately, setting in place a password policy across all of an enterprise’s applications is much easier said than done.
Most enterprises use a wide range of applications across different platforms – both cloud-based and on-premise – with each application operating on different technologies and each with its own identity management and password policy, controlling how users set up passwords in each application can often be an expensive and time consuming process.
Implementing a common bridge layer across of the applications used by the enterprise in the form of an Identity and Access Management (IAM) solution to act as the identity provider (IdP) across all applications is the best way to overcome this challenge.
The Akku Solution
Akku is an identity and access management solution that integrates all of the on-premise and cloud-based applications of an enterprise, providing a single platform for administrators to control employee access, permissions, and levels of control within its different applications.
With Akku playing the role of the identity provider (IdP), it enables administrators to set up a single password policy that will instantly be applied to all of the applications that are accessed by a user at the workplace. This password policy holds good, irrespective of whether the application is on-premise or cloud-based, or across different platforms. Akku also allows for the secure resetting of passwords, as specified by GDPR standards. Besides password policy enforcement, Akku also utilizes a custom salted-hash function, users’ credentials are also encrypted to ensure a high level of security.
Want to explore a quick and hassle-free password policy implementation across your enterprise applications? Get in touch with us today at sales@akku.work
An array of information being stored online comes with major security risks. Therefore safeguarding data is an important consideration at any organization. And the security of your data relies heavily on the strength of your users’ passwords. The stronger your passwords, the more secure your data! It is important for administrators to drive a strong password policy enforcement, as it is the first layer of defence against black hat hackers and scammers.
A password policy is a set of rules created to upgrade an application’s security by requiring its users to frame a strong password and to utilize it in an appropriate way.
Why is Securing your Border Vital?
In today’s scenario setting up unique passwords for multiple applications is a burden for any user. Most users rely on using a single password for multiple applications, which can put the organization’s data at risk.
This makes implementing a strong password policy essential in protecting your data. Additionally, setting a Password Policy forms a part of the policies or rules for an organization to comply with ISO and PCI certifications.
Top Four Factors for Password Policies
Enforcing a strong password policy in an organization is an uphill task. There are some fundamental norms which are followed by a majority of organizations.
1.Length: The longer the password, the more difficult it is to crack. Set a minimum of 8 characters for your users’ passwords.
2.Complexity: The level of security depends on the complexity of the password framed. Passwords must have a mix of uppercase characters (A-Z), lowercase characters (a-z), numbers (0-9) and punctuations ( eg. !, #, $,*).
3.Expiration: A best practice in improving password security is to have a periodic password expiry. Most often the validity is 30/45 days and at the end of expiry date, the user is forced to change their password.
4.Uniqueness: Require users to set a unique password that has not been used previously when they reset their password.
How Can a Forgotten Password be Securely Retrieved?
When a user logs in with the right password, he is permitted to access the organization’s applications. On the other hand, when a user logs in with incorrect credentials, if the organization allows SSPR (Self Service Password Reset) then the system prompts the user to reset the password on his own.
Here’s how it works – a window pops up with a certain number of questions, and when the user answers all the questions correctly, he is permitted to reset the password. However, this process leaves the door open to social engineering attacks by black hat hackers.
A safer approach is to disallow SSPR in the password policy of an organization. In this scenario, the only way to reset a user’s password is to reach out the admin – this is safer and does not allow any intrusion through social engineering, and therefore reduces the data security threat.
How can a Forgotten Password be Securely Retrieved
I shall write more about SSPR and social engineering in my next article.
Enforce a strong custom Password Policy across your organization using Akku’s Password Policy Enforcement feature which brings it all together for improved security.
