Compliance ensures that an enterprise maintains a minimum standard of security-related requirements in accordance with industry and regulatory standards. Its scope, however, goes beyond having regulations in place, to successfully implementing policies and contracts.
As security breaches, fraud, and theft of data are becoming increasingly widespread in the IT world, industry guidelines for compliance have become more complex, and enterprise policies more elaborate. Adding to the difficulty of achieving security compliance is the limited functionality of network security tools in dealing with the dynamic nature of the cloud.Continue reading Navigating the World of Data Security in the Cloud: Steps to Ensure Compliance
The Health Insurance Portability and Accountability Act (HIPAA) has been effective in the USA since 1996.
The Act actually has five different section titles, namely Health Insurance Reform, Administrative Simplification, Tax-Related Health Provisions, Application and Enforcement of Group Health Plan Requirements, and Revenue Offsets – however, the mention of ‘HIPAA Compliance’ most often refers to compliance to the second title – Administration Simplification.
This is the most challenging aspect of the HIPAA Act, as it comes with strict regulations on protecting the data of patients in an industry that is often a major target for data breaches and malicious activity. Identity and access management across applications used in a healthcare facility, therefore, becomes critical to HIPAA compliance.
Here’s how Akku can help in ensuring data privacy and preventing both outsider and insider attacks on patient data, and, ultimately, compliance to HIPAA’s stringent regulations.
It also employs a custom salted-hash encryption methodology – a combination of salting and hashing techniques – for user credentials and data
Preventing unauthorized access
Akku allows you to exercise tight control over which users have access to what applications and data, so that access is not available to users who may not require it
It prevents accidental and malicious data breaches by allowing access to applications only from whitelisted network IP addresses and devices
The system also automatically blocks suspicious access attempts at abnormal times or from unexpected locations, and also enables the set up of time-based and location-based restrictions
Ensuring privacy and accountability
Every Akku implementation is set up independently in a separate server instance, so privacy on the cloud is ensured
Akku provides administrators with complete visibility by maintaining detailed logs maintained for every activity taking place across the apps and in the server
Beyond HIPAA
In addition to helping your healthcare facility become HIPAA compliant, Akku also makes it easy to set up integrations across your Hospital Information System (HIS), Lab Information System (LIS), Patient Management System (PMS) and more. This, in turn, improves collaboration between various departments and enhances overall productivity.
To know more about Akku’s complete set of features and their specific benefits to your facility, contact us today!
Identity theft is as real as your identity and as dangerous as the one who steals it. It occurs when an unauthorized person or entity uses your personal information to assume your identity and commit fraud and other criminal activities including stealing from you, or from others in your name.
What does an identity thief steal?
Your name, address, credit card or bank account information, and even information that might otherwise seem harmless, such as photographs, information about your family members or your date of birth could be used in harmful ways in the wrong hands.
How does identity theft happen?
Identity thieves are well-organized, tech-savvy, creative and have seemingly innocent online personalities. They can steal information, simply by requesting it from an unassuming person or by using technological attacks to capture millions of records from enterprises. Sometimes, a stolen wallet or a carelessly-thrown receipt or letter can also lead to identity theft.
Here are some of the ways in which an identity theft may take place in your organization:
Data Breaches
A data breach, accidental or malicious, can have a heavy cost on both the organization involved and the individuals whose data is compromised.
Improper security on company-owned devices or devices that have access to your organization’s data is one of the leading causes of data breaches that lead to identity theft.
Phishing
Phishing involves sending deceptive emails with links to malicious websites that may either request or steal your information. If one of your employees is manipulated by such an email and clicks on a link it provides, it can be dangerous to the organization itself.
Even if your organization’s email can manage to keep out such mails from employee inboxes, if your employee has access to their personal email at the workplace, they are at the risk of being compromised.
Public Wi-Fi Connections
One of the problems with allowing your employees to work remotely is the possibility that they may be working from places that offer open or free public wireless internet connectivity. A criminal who also has access to the same network could also be able to observe all of your employee’s activities.
Mishandled Passwords
Carelessness with passwords, whether in terms of the creation of weak passwords or the way they are stored, can make your employees and your organization susceptible to identity theft.
When it comes to preventing identity theft, the first step to take is to sensitize your employees on the different ways in which it can happen. Studies have proven that employees are the preferred channels that identity thieves use when they target organizations.
From your end, you also need to:
Set a strong password policy across your enterprise applications, to ensure that your organization is not compromised through your employees’ use of weak passwords
Use two-factor authentication or multi-factor authentication to enhance the security of applications carrying sensitive data
Ensure that your DNS filter works effectively to block out malicious websites that your employees may try to access
Block access to employees’ personal emails at work, so that there a lesser chance of data compromise and data breaches through phishing
Set up IP-based or device-based restrictions so that unauthorized persons are kept out of your applications when they try to access them from unsafe locations or unrecognized devices
An identity and access management solution (IAM) like Akku can help you take control of all the preventive methods listed above, all in one go.
Get in touch with us through sales@akku.work if you wish to know more about how Akku can help protect your organization from identity theft through identity/access management.
Most people use a Password Manager to save their account passwords. A password manager is an app or device which serves as a single collection point for all of a user’s account credentials. LastPass and Dashlane are two well-known password managers in the market. The usage of a password manager presents a security risk in case of a data breach. In fact, as per the Independent, the password manager LastPass was hacked and a data breach did occur, compromising user credentials.
Another high-risk method that many users follow is to save their passwords in their browsers, and use auto-fill for convenience.
In today’s world, data breaches are the highest level of threat – don’t forget, all your data is being protected by your passwords! No security initiative can come with 100% convenience – but it is important to understand and prioritize security.
This is even more important for enterprises, where the tools they are providing their users to manage their passwords are eventually protecting the company’s data.
There are enterprise IAM tools available in the market which help enterprises to provide a secure single sign-on (SSO) and other access control lists such as IP- and device restrictions, time and location restrictions, and multi-factor authentication. These functionalities help end users as well as administrators to protect company data with additional layers of protection.
Delving deeper into MFA as a means to improve password security, the trend today is that many leading SaaS providers have started deprecating SMS as the medium to send the OTP, since this is an old-school method and comes with dependencies in order to serve its purpose. The modern and more convenient way to run an MFA is using TOTP and push notification.
Implementing a single sign-on (SSO) with an MFA is a powerful way to boost the security of your passwords while ensuring a minimal compromise on the convenience front. And of course, type your password each time instead of saving it in your browser or a password manager to minimize the security risk.
Your password – your secret passphrase or PIN that you use for your email, social media profile, or applications at work – is necessary for you to gain access to your accounts. But more importantly, your password plays a critical role in ensuring that no one else has access to your accounts, ensuring the security and privacy of your own as well as your organization’s data and applications.
With advancements in technology, it is important to be aware that there are equally advanced ways in which people steal information belonging to others, and even more ways through which they can misuse that information. Therefore, it goes without saying that secure passwords are of prime importance.
Common Password-Related Mistakes
You can’t blame yourself for being naturally inclined to choose a simple password that will be easy to remember. Unfortunately, these are the very same passwords that are also easy to guess or crack with a hacking software. Remember that, if information about you that can be found online – your date of birth, favourite colour, pet’s name, and so on – is incorporated into your password, it becomes even more vulnerable.
Another mistake made by most people is that a common password is used across multiple online accounts. The problem with doing this is, if someone manages to crack your password to one account, you are giving them free access to the rest!
Writing down your password or saving it somewhere online? This is a very naive act that can put your entire online data at risk of being accessed and stolen easily. Some of the other mistakes you might be making when it comes to passwords is that you don’t change the factory-set or default password, you use the same password for too long, and so on.
Tips to Set Up a Secure Password
Create a long password with a minimum length of 10-12 characters
Use a combination of uppercase letters, lowercase letters, numbers, and special characters
Special characters need to spread out across the password and not be limited to the first or last place
Do not use the same password for multiple security points
Change your passwords every 1-3 months
Avoid using words with obvious references to your personal life
Avoid using dictionary words as a whole
Passwords in the Workplace
In the workplace, the importance of a secure password is further amplified because the breach of a corporate network can have consequences that will affect the entire business.
Employees, who are otherwise the biggest assets to a company or business, also become the weakest link in the security chain protecting its data. The reason? Poor password selection and the subsequent compromise to data security. A single password, if compromised, can open the security gates and let intruders in.
Combating Weak Passwords in the Workplace
A good password policy is the weapon of choice when it comes to combating the threat of weak passwords.
A password policy is a set of guidelines that help users set up strong and secure passwords. When a password policy is enforced, a user is not allowed to create a password that does not abide by these guidelines.
Some essential features of a password policy are:
1) Password Length & Complexity Requirement
The password policy ensures that every password created is of a minimum length (for example, at least 6 characters long) and needs to use a variety of character types (uppercase letters, lowercase letters, numbers, special characters).
2) Minimum & Maximum Password Age
This part of the password policy decides how often a password is to be changed. Ideally, a good password policy ensures the expiry of a password once in 3 months, so the user is forced to create a new password. However, if a policy prompts the user to change their password too often, they may be tempted to write it down or store it elsewhere. This, again, will compromise security.
3) Password History
When a user is prompted to change a password, he/she may tend to reuse a password they had earlier used for the same application. By enforcing a good password policy, users will not be allowed to reuse an old password at least for another 5 times.
4) Number of Failed Attempts
A password policy also establishes the maximum number of invalid attempts allowed before an account will be locked out temporarily. Once locked, the account may need administrator support to be unlocked and made accessible again.
Beyond Password Security
For companies and businesses that use highly-sensitive data, it may be required to go one step beyond just a good password policy that enforces strong passwords. In such cases, a two-factor or multi-factor authentication functionality may be enforced, where additional layers of security are integrated into the sign-in process.
With such a functionality, users will be required to re-validate their identity using one or more of the following:
A one-time password or PIN
A thumbprint or retina scan
A Yubikey, smart card, USB token, or magnetic strip card
Are your users’ weak passwords keeping you up at night? Speak to us to see how Akku can help with Password Policy Enforcement and Multi-factor Authentication.
The European Union enforced the General Data Protection Regulation (GDPR) in May 2018 with three main aims: to harmonize data privacy laws across Europe, to protect and empower the data privacy of all EU citizens and to reshape the way organizations across the region approach data privacy. As you can see “data privacy” is the keyword in all three of the above mentioned aims. With multiple data breaches coming to light in the recent years, even from several of the world’s biggest corporates, the European Union has enforced stringent measures to regulate the use and prevent the misuse of citizens’ data through the GDPR.
Compliance and Consequences
As stated specifically in the GDPR, all enterprises (whether businesses or organizations) must take a “high level of protection of personal data” as one of their top priorities so that the “abuse or unlawful access or transfer” of such data may be prevented. If data is breached, or if GDPR procedures are compromised, the enterprise will face serious penalties. The fine for the non-compliance to GDPR for breach of data could be up to €20 million or 4% of annual global turnover, whichever is higher, depending on the type and extent of the breach.
This applies not only to enterprises within the EU, but also to those that may be located outside and offer goods or services of any type to the EU. The GDPR rules also apply to cloud controllers and processors.
The Emphasis on Passwords
Interestingly, the GDPR does not place any direct regulations on the way passwords are created or used. However, when it comes to the protection of online data, it’s hard to argue against securing passwords being the logical first step. On the one side, businesses that provide access to customers through an online portal typically ensure that they are creating secure passwords to sign in to by enforcing password policies that define their length and other parameters.
However, the slip often occurs when the employees of these enterprises are allowed to create weak passwords for accessing in-house applications. What is often forgotten is that these applications also carry sensitive data that belong to both the enterprise and its customers. A compromise here can cost the enterprise more than just the data; it will cost its credibility as well.
A strong password policy, therefore, becomes a key first step in the path to GDPR compliance.
The Inevitability of a Password Policy
By enforcing a strong password policy, administrators can ensure that users of an enterprise’s applications set up and use only passwords that are secure and, therefore, much less susceptible to brute force attacks and other hacking attempts.
A password policy defines and enforces a set of rules that include the minimum length, acceptable combination of small and upper case letters, use of numbers and special characters, expiration period of passwords and so on.
Without a password policy, the administrators of an enterprise would have no control over the type of passwords their users set, and would have their hands tied when it comes to situations that lead to a data breach, making it hard to demonstrate the GDPR’s requirement of a “high level of protection of personal data”.
This makes a strong password policy a critical requirement for every on-premise as well as cloud-based application, both for data security and to work towards complying with this aspect of the GDPR.
The Hybrid and Multi Cloud Conundrum
Unfortunately, setting in place a password policy across all of an enterprise’s applications is much easier said than done.
Most enterprises use a wide range of applications across different platforms – both cloud-based and on-premise – with each application operating on different technologies and each with its own identity management and password policy, controlling how users set up passwords in each application can often be an expensive and time consuming process.
Implementing a common bridge layer across of the applications used by the enterprise in the form of an Identity and Access Management (IAM) solution to act as the identity provider (IdP) across all applications is the best way to overcome this challenge.
The Akku Solution
Akku is an identity and access management solution that integrates all of the on-premise and cloud-based applications of an enterprise, providing a single platform for administrators to control employee access, permissions, and levels of control within its different applications.
With Akku playing the role of the identity provider (IdP), it enables administrators to set up a single password policy that will instantly be applied to all of the applications that are accessed by a user at the workplace. This password policy holds good, irrespective of whether the application is on-premise or cloud-based, or across different platforms. Akku also allows for the secure resetting of passwords, as specified by GDPR standards. Besides password policy enforcement, Akku also utilizes a custom salted-hash function, users’ credentials are also encrypted to ensure a high level of security.
Want to explore a quick and hassle-free password policy implementation across your enterprise applications? Get in touch with us today at sales@akku.work
An array of information being stored online comes with major security risks. Therefore safeguarding data is an important consideration at any organization. And the security of your data relies heavily on the strength of your users’ passwords. The stronger your passwords, the more secure your data! It is important for administrators to drive a strong password policy enforcement, as it is the first layer of defence against black hat hackers and scammers.
A password policy is a set of rules created to upgrade an application’s security by requiring its users to frame a strong password and to utilize it in an appropriate way.
Why is Securing your Border Vital?
In today’s scenario setting up unique passwords for multiple applications is a burden for any user. Most users rely on using a single password for multiple applications, which can put the organization’s data at risk.
This makes implementing a strong password policy essential in protecting your data. Additionally, setting a Password Policy forms a part of the policies or rules for an organization to comply with ISO and PCI certifications.
Top Four Factors for Password Policies
Enforcing a strong password policy in an organization is an uphill task. There are some fundamental norms which are followed by a majority of organizations.
1.Length: The longer the password, the more difficult it is to crack. Set a minimum of 8 characters for your users’ passwords.
2.Complexity: The level of security depends on the complexity of the password framed. Passwords must have a mix of uppercase characters (A-Z), lowercase characters (a-z), numbers (0-9) and punctuations ( eg. !, #, $,*).
3.Expiration: A best practice in improving password security is to have a periodic password expiry. Most often the validity is 30/45 days and at the end of expiry date, the user is forced to change their password.
4.Uniqueness: Require users to set a unique password that has not been used previously when they reset their password.
How Can a Forgotten Password be Securely Retrieved?
When a user logs in with the right password, he is permitted to access the organization’s applications. On the other hand, when a user logs in with incorrect credentials, if the organization allows SSPR (Self Service Password Reset) then the system prompts the user to reset the password on his own.
Here’s how it works – a window pops up with a certain number of questions, and when the user answers all the questions correctly, he is permitted to reset the password. However, this process leaves the door open to social engineering attacks by black hat hackers.
A safer approach is to disallow SSPR in the password policy of an organization. In this scenario, the only way to reset a user’s password is to reach out the admin – this is safer and does not allow any intrusion through social engineering, and therefore reduces the data security threat.
How can a Forgotten Password be Securely Retrieved
I shall write more about SSPR and social engineering in my next article.
Enforce a strong custom Password Policy across your organization using Akku’s Password Policy Enforcement feature which brings it all together for improved security.
Cloud technology has broken several operational barriers to make remote data access easy. It allows you to scale your business with minimal cost while securely holding business-critical data and applications. But with all these advantages comes a catch – managing personnel access for all the applications and files in your network has become increasingly cumbersome.
Why does your organization need an Identity and Access Management Solution?
Managing the credentials of all your employees across all the verticals of even a small to mid sized organization is time-consuming. It can drain the productivity of your company’s Human Resource and IT management teams. They are valuable resources who could otherwise focus on their core competencies to help you grow your business.
In addition to this, securing your network from breaches and other threats can be challenging with so many people accessing your cloud from various devices and locations. If your network is compromised, all your critical business data is compromised along with it.
A strong Single Sign-on (SSO) function is at the heart of an IAM solution. The first step in implementing an SSO is to determine and streamline the role of the identity provider (IdP). The IdP is responsible for bringing all the applications and data on your cloud network to a centralized platform. From this platform, access and identity services are managed through a customized Security Assertion Markup Language (SAML). When a high end, customizable SAML is integrated with your enterprise cloud network, it can result in a secure Single Sign-on solution.
With a cloud SSO setup, you can provide each member of your organization with single login credentials for any or all the applications in your cloud network. With your own powerful Identity Provider, you can redirect all access authentications to a safe and fast network. With this setup in place, it is possible to consolidate a single node in your network to control access to your entire organization’s cloud network.
Features of an IAM System
With an efficient Identity and Access Management system, you can accomplish so much more than just rudimentary monitoring of your cloud network. It will come with a well rounded set of features which allows you to control your cloud in a convenient platform. If your network is fitted with a powerful cloud IAM solution, it will automatically come with provisions in place to handle password standardization and multi-factor authentication frameworks.
Single Sign-on
Allocating a single set of credentials for your employees to access relevant data and applications is made easy by implementing an SSO solution for your cloud network. As the admin of your network, it also becomes simple for you to handle access operations in a single dashboard. In addition to this, if the need arises for a user to be removed, it can be done in a few short steps instead of removing access individually for all your applications. When all of this comes together seamlessly, it results in improved productivity across your organization.
Multi-factor Authentication
Sometimes, in spite of the password protection measures you have implemented to secure your cloud, you might feel the need to bring in an additional layer of security to protect all your critical business applications. When that need arises, a well structured IAM solution allows you to keep in place, a multi-factor authentication system. It ensures that your system is insulated against remote attacks and prevents unauthorized access from getting a foothold in your secure network. This will enable you to extract data from TOTPs, thumbprint scanners or even Yubikeys and verify the users accessing your cloud network.
Password Policy Enforcement
Another challenge faced while trying to secure a cloud network is the varying standards of all the passwords of all the users who access it. The difference in standards can make breaches easier to happen and there rises a need for standardization of all the password credentials issued to the users of your cloud. But with an IAM solution, you can set the minimum standard required to set a password. With an effective password policy enforcement, you can rest assured that all your critical data is protected irrespective of the number of service providers you are associated with. It consolidates all the applications on your network under a single identity and verifies that all the passwords required to access your network comply with PCI and ISO/IECt standards.
Securing your cloud with an effective Identity and Access Management solution can empower you to control identity and access across your cloud environment. In addition to this, an IAM solution helps you improve data security, privacy, standards compliance, and productivity.
Company X is a leading automotive hardware manufacturer. In the competitive manufacturing environment, documentation of activity are standardization of processes are critical requirements.
In the case of Company X, this was already in place, and in fact they had achieved ISO certifications for their process-based approach and class-leading quality.
However, certification brought with it a constant stream of audits to ensure that processes were in fact being followed, and standards maintained. This posed a recurring problem, since a single failed audit could result in the loss of certification and loss of business.
The employees of Company X were well equipped – every employee was given an email address, and employees above a certain grade were provided with a laptop and a smartphone as well. But being an ISO-certified enterprise, the security of devices and data were vital.
Diagnosis and Prognosis
Given the background and the critical business impact of a failed audit, potential problem areas were quickly identified, along with solutions.
One of the first problem areas that needed to be addressed was that many employees tended to set weak, easy-to-crack passwords that exposed the company to data security threats, while also failing to comply with ISO standards.
A mandatory ISO-compliant password policy for all users could easily be set up with Akku.
The next point of concern was the possibility that sensitive business data could be compromised by employees.
The solution to this was to enable employees to access their company email accounts only from the devices provided by the company.
Akku enabled restricting access to company mail only from devices with its SSL Key installed.
Another issue identified was that website browsing restrictions were implemented only on the company’s firewall. Therefore, exposure of company devices to malware and external threats while outside the firewall was a looming worry.
A DNS filter to restrict browsing access even outside the firewall became essential.
Akku’s website filter provided this functionality with powerful control and ease of use. This helped to keep the company’s devices secure, whether they were located within the company firewall or not.
This type of device-based access control offered by Akku seemed to tick all the boxes, but it would fail to serve its purpose if it could be tampered with by a user.
Many legacy solutions built using plugins were found to be vulnerable to misuse – with these solutions, it was possible for users to find a way to circumvent the access control by simply removing the plugin to enable unrestricted access. The device could then be made to appear uncompromised by reinstalling the plugin later. Such a solution was far from water-tight.
With Akku on the other hand, the implementation of a certificate-based architecture overcame this potential challenge. This was because any attempt to tamper with Akku’s certificate would completely restrict access to their authorized services like official email and other SaaS-based applications. Reactivation would require a certificate password, available only with the systems admin.
By enabling easy identification of any attempts to evade the implemented access restrictions, potential leaks were plugged and accountability enforced.
Trial by Fire
The road to full implementation of Akku was a challenging one.
After the problem areas at Company X were identified and Akku was presented as the solution, a PoC was run successfully with 30 users to confirm that all requirements were in fact addressed completely.
With this first hurdle crossed, the client next proposed implementation and testing at their Japanese parent company. Stringent testing on every parameter of Akku’s performance was carried out over a period of several weeks in Japan.
At the end of this process, Akku was approved for the final roll-out across 300 users.
Identity and Access Management (or IAM) solutions – also known as Identity Management (IdM) solutions – form a critical component of an enterprise’s IT security. And when used with cloud-based applications, they form part of a powerful cloud security set up too.
In simple terms, an IAM helps to control which users can access what data, as well as from where and when this access is permitted.
So how does an IAM work?
In any Identity and Access Management solution, one of the core concepts at play is that of an Identity Provider (IdP). The IdP brings all of the enterprise’s cloud-based application on to a common platform from where identity information can be managed and authentication services provided through the use of a Security Assertion Markup Language (SAML).
Through this process, it becomes possible to establish a single point of control across all of an organization’s cloud applications, and to provide a single point of access to all users, in the form of a Single Sign-on (SSO) – one of the fundamental functionalities of an IAM.
What features do IAMs offer?
Most IAMs offer some or all of the following features:
Single Sign-on
Enables administrators to provide each user with a single login to access any or all of the local and cloud applications used by the organization.
Multi-factor Authentication
Provides a powerful additional layer of access protection through a TOTP or other methods.
Password Policy Enforcement
Enables enforcement of a custom password policy across the organization, to comply with statutory (or the company’s own) security standards.
Is Akku an Identity and Access Management solution?
Akku is indeed an IAM solution, but it’s also so much more. It brings to the table all the security and access restrictions that a standard Identity and Access Management solution has to offer, along with several additional features to boost security and productivity across your cloud environment:
