By Joseph Carson, Chief Security Scientist & Advisory CISO at Delinea
As devastating data breaches become more frequent, cybersecurity is a top priority for many businesses. Despite this, many organizations are failing to devote the necessary resources to protecting their data and business– cybersecurity budgets are among the cuts made when capital is tight.
What’s more, the measures organizations do devote funds to focus more on protecting sensitive customer and employee data, but privileged access management (PAM) is an essential tool to strengthen your security position and your budget.
If you want to adopt a strong cybersecurity position and secure the budget necessary for it, PAM is a crucial part of the conversation.
What Is Privileged Access and Why Is It a Top Priority?
There are many ways that malicious hackers can find a way into the systems, networks, and platforms within your organization. From there, they can move unencumbered and exfiltrate sensitive information or install ransomware to support future breaches.
PAM is a comprehensive cybersecurity strategy that safeguards identities with special access. It relies on the principle of least privilege, meaning that people only have only the necessary levels of access to do their jobs.
Protecting your high-level privileged accounts is an essential component of a layered approach to security. Compromised accounts – whether through error or intention – can create a path for bad actors.
If a breach occurs, organizations face more than just data theft with sensitive customer information or business information. A cyber attack can have a big financial impact with damage repair, expenses, and legal costs. There may also be indirect costs with compensation for affected parties, interruption of services, and reputational damage.
Threats to Enterprise Systems
Most modern organizations rely on technology, which has benefits for efficiency and productivity, but it creates new challenges for IT departments.
Compromised Credentials
Accounts can be breached via third-party sites or through compromised passwords. These attacks can be reduced by implementing multi-factor authentication, strong passwords, and scheduled password rotation. Non-human passwords should be long and use a combination of upper-case characters, symbols, and numbers to make them difficult to guess, and for human interactive passwords, you should use a long passphrase that is easy to remember but also includes some complexity. Passphrase length today is important to make them more difficult to crack.
Malicious Insiders Risks
People with legitimate access to an organization’s systems can make mistakes that inadvertently allow bad actors in, or they can be malicious insiders. These people rely on their knowledge of the system to carry out an attack, so it’s important to control who has access to certain parts of the system. You should also conduct regular audits on privileged account activity to detect suspicious behavior and mitigate its risks.
Missing Encryption
Encryption is an important security measure to prevent unauthorized users from viewing confidential data stored within an organization’s system. When you fail to encrypt your data, it can be vulnerable to attackers seeking access or malicious insiders looking to access sensitive information.
Ransomware Attacks
Ransomware is a type of malware designed to attack computers and networks using encryption algorithms that lock down information until a ransom payment has been delivered. Running current antivirus software can detect most ransomware infections and mitigate their effects, as well as setting up robust backup strategies to restore encrypted information without needing to pay a ransom.
Strengthening Your Budget with PAM
Illustrating the value of PAM and protecting the budget can be difficult when you’re speaking to the C-suite. Decision-makers are focused more on the bottom line than the nuts and bolts of the IT initiatives, so it’s important to speak in terms of return on investment and value.
Explain the benefits of PAM in less technical terms. Instead, focus on cost savings, low risk exposure, and improved organizational performance. It’s better to discuss the risk of not prioritizing cybersecurity and privileged access in monetary terms – such as financial consequences and reputational damage, than the cost of implementation.
If decision-makers can see the value and potential savings of PAM, rather than the money that needs to be put into it, they have a big-picture view and more incentive to allocate some of the budget to it. Otherwise, you could just lose them in a wave of technical jargon that doesn’t speak in terms of dollars and cents.
Make sure to use examples of success in monetary terms with previous IT initiatives, improved automation, interoperability or implementations. This puts your recommendation in context and demonstrates how technology can generate a successful return. One important business value of PAM is that it can significantly reduce wasted time.
Make Privileged Access a Priority for Your Decision-Makers
Cybersecurity budgets are one of the first areas to cut back when organizations run lean, but that could leave them vulnerable to larger financial impact in the future. There’s no overestimating the importance of shoring up security and data, and privileged access budgeting is a key part of your IT security.
When you demonstrate the value of cybersecurity and PAM to decision-makers in terms that resonate with them, they’ll be more inclined to invest in the implementation and ongoing maintenance of your organization’s security.
Joseph Carson is a cybersecurity professional with more than 25 years of experience in enterprise security and infrastructure. Currently, Carson is the Chief Security Scientist & Advisory CISO at Delinea. He is an active member of the cybersecurity community and a Certified Information Systems Security Professional (CISSP). Carson is also a cybersecurity adviser to several governments, critical infrastructure organizations, and financial and transportation industries, and speaks at conferences globally.
.
Follow Brilliance Security Magazine on Twitter and LinkedIn to ensure you receive alerts for the most up-to-date security and cybersecurity news and information.