CEO Tom, addressing Maria, his chief information security officer (CISO), demanded, “In five words, tell me what is the most important thing to know about access control that is different when it comes to cybersecurity.”

Maria shot back, “Manual controls are simply ineffective.”

Taking a Fresh Look at Access Control

While the cybersecurity risk landscape has dramatically mutated, the approaches that organizations rely on to manage cyber risks have not kept pace. Traditional information security models do not address the realities of today. These models are still largely technology focused, compliance based, and perimeter-orientated, while aiming to secure the back office. IT security hygiene is often lacking, and ineffective access controls contributed directly to the half billion personal records lost or stolen in 2015. (See the foreword for more details.)

It is time to take a fresh look at access controls—to understand how going digital changes the fabric of your organization. This journey starts with the implementation and integration of the latest technologies, trends and platforms, including cloud computing, mobile technologies, and Big Data analytics, allowing stakeholders to interlink their social media environments on shared smart devices for personal and business usage. With the proliferation of Internet of Things (IoT) devices and the expectation of being always connected, always online, consider the question: is our access control model still supporting our organization goals and addressing the right risks?

An effective cybersecurity program starts with a strategy and a foundation based on risks. According to PwC’s “Global State of Information Security Survey 2016,” 91 percent of the participants had adopted a risk-based cybersecurity framework. Although many organizations are using an amalgam of frameworks, the two most frequently implemented guidelines are the ISO 27001 and the cybersecurity framework of the U.S. National Institute of Standards and Technology (NIST). Risk-based frameworks can help organizations design systems, measure effectiveness, and monitor goals and risks for an improved cybersecurity program.¹

Access control refers to the mechanisms and techniques used to ensure that access to assets is authorized and restricted based on organization and security requirements. The access control sections below, including the definitions given, are largely based on the ISO/IEC 27001:2013 (E) international standard, developed to provide requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS).² Particular attention must be paid to the distinction between “can/may” and “should” and “must”. “Can” and “may” mean the following guidance can be considered as an option, whereas “should” is highly recommended, and “must” a necessity or requirement.

Organization Requirements for Access Control

The access control principles and activities covered below should be designed and formulated based on the organization and information security requirements for access control, with an overall aim of limiting access to information and information-processing facilities.

Based on a proper understanding of the organization, including its strategy, goals, and objectives, as well as the outcome of a risk assessment, the organization should formulate its access control policy with due consideration of the principles of need to know and need to use. The access control policy, including the sections discussed below, should be documented, approved, implemented, and reviewed based on the nature of the organization and its related security requirements. In determining the organization requirements, it is important to have a comprehensive understanding of your cyber threat landscape and your digital assets, including your company’s “crown jewels.” Many organizations have found that it is overly resource-intensive to implement maximum protection over all of their information components and information-processing facilities. The organization requirements for access controls should thus be crafted and modeled based on the specific nuances within the organization; they should support the overall organization goals, while protecting what matters most.

User Access Management

A large percentage of cybersecurity incidents stem from compromised login credentials. Attackers often follow the path of least resistance. They might search for the likes of unused user accounts (IDs), accounts with default passwords (the password set at installation and documented in the installation manuals), and accounts with easy-to-guess passwords. Therefore, to achieve the overall access controls objective, specific focus is required on user access management.

User Responsibility

The people component is often seen as the weakest link in the cyber chain. People are not equally diligent or knowledgeable when following processes or making decisions. As a result of leave arrangements, use of temporary staff, handover of responsibilities, and human emotional and physical well-being, manual controls are not consistently effective. Attackers will use social engineering, spoofing, phishing, brute-force attacks, and many other methods to obtain confidential information or to get a user to perform an activity that will compromise the organization.

Users must be trained in information security, and continuous awareness campaigns should remind them of cyber risks and the techniques used by hackers. Users must understand the importance of keeping their authentication information secret and their authentication devices secured at all times. Organizations should provide advice to users on how to select complex passwords and how to remember them, as writing them down will compromise the organization. Users must be aware of the access control policy, and they must understand the importance of full compliance and what their roles and responsibilities are in relation to information security.

System and Application Access Control

There are a number of fundamental requirements that need to be in place in order for an access control system to function at a basic level.

Mobile Devices

As mobile devices increasingly become part of our lives, and as businesses start to harden their on-site security, cybercriminals will focus more on mobile devices. Most organizations now allow corporate-issued or employee-owned mobile devices to connect to their networks and business applications. This is where the corporate/business and private worlds become interweaved. A user may now use the same device to read mails (business and private), open confidential attachments, make appointments, surf the Internet, make mobile payments, and use several social media applications, all while connected to an unsecured Wi-Fi network in a public location. Does this sound familiar?

Risks associated with the use of mobile devices can include unauthorized access via unsecure Wi-Fi connections; loss or theft of data; mobile malware; phishing and spyware; the creation, use, or distribution of inappropriate content; organizational reputation; or simply having a confidential conversation over a cellular phone in a public place. Often, users store various log-in credentials on their mobile devices and if the device is compromised, then access to multiple business or private systems and applications is compromised. In this way, mobile devices can become an easy entry point for cybercriminals. Figure 22.1 shows how attacks on IoT devices have increased in percentage terms for 2015 over 2014, according to PwC’s “Global State of Information Security Survey 2016.”⁹

The modest mobile phone that was launched in the early 1990s has now become a sophisticated and powerful mobile computing device that is adding new levels of complexity to cybersecurity as it evolves ever further. Organizations can deal with mobile cyber threats by setting up mobile device management policies. This is no simple task. You have to navigate your way through a complex debate involving user expectations, productivity, and mobile freedom, and compare that to the mobile device risk to the organization. Ultimately, the benefits of mobility are in danger of being outweighed by the increase in your cyber risk.

Not all mobile devices offer the same security features. You therefore have to decide if you will allow all mobile brands and ranges of devices to connect to the organization’s network and applications. You can reduce your mobile cyber risk by using virtual private networks (VPNs), encrypting data (static and in motion), and having passwords on all devices. Through the central management of remote devices you can also locate a device, perform a remote lock or a data wipe, and enforce authentication—preferably multifactor authentication. You can also monitor device usage, and continuous feedback to the user community can change user behavior. Making users aware of mobility risk is therefore extremely important. Users should turn off all features and functions that they do not use, and all business systems and applications that are accessed by mobile devices should be secured via identity and device management, authentication, encryption, and privilege management. It is also a good idea to consider third-party solutions for antivirus, antispam, and intrusion detection. It is anticipated that native device software and third-party solutions will develop rapidly in this regard. (See Chapter 4 for more sample policy content for mobile devices and BYOD).

Teleworking

Teleworking or telecommuting is an arrangement where an employee uses computers and other telecommunication devices to work from a location other than the normal workplace, for instance, from home. This is often a temporary arrangement to assist an employee with their work–personal life balance or a particular set of circumstances, or where contractors or temporary staff are employed. While the human resource and potential cost benefits of allowing telecommuting are obvious, it does increase the cyber risk to an organization. The physical security within the telecommuter’s environment may not be as strong as at the workplace; people may share equipment or use unsecure communication and personal applications on it; and the hardware, software, and security arrangements in respect of the equipment and its configuration may not comply with corporate standards. It is also very difficult to detect noncompliance. The organization could consider a number of practices to reduce the related risk:

• Policy development. A clear policy is required to ensure that user behaviors, actions, and practices are acceptable. The roles, responsibilities, benefits, and conditions must be clear, and physical, logical, and paper-based security requirements must be well known.
• Use of equipment. If the organization provides the equipment, it has more control—it is easier to ensure that the equipment is configured and loaded with the same software and that the same protection is used as in the workplace. If staff are allowed to use their own computers, it is very difficult to achieve the same level of protection as in the workplace. The organization will have to be prescriptive about, for instance, the use of the equipment and licensed software, firewalls, and antivirus and spyware software.
• Encryption. Due to the physical access risk, all PCs and storage devices, including removable media, have to be encrypted to protect all stored data.
• Secure communication. All electronic communication with the workplace should be via a VPN, connected only to secure networks.
• Log-in. Adequate log-ins using proper identification and strong authentication controls are required.
• Support. Telecommuters should be provided with the necessary technical support.
• Training. Ongoing technical and cyber awareness training should be provided.
• Audits. Compliance audits should be performed as required.
• Access management. Those business systems and applications that are accessed by telecommuters should be secured using identity and device management, authentication, encryption, and privilege management.

Telecommuters should be treated the same as third parties that require access to your environment—provide them with a strong set of baseline standards, audit them, and treat all interactions with them cautiously.

Other Considerations

Cybercriminals are always on the lookout for crown jewels, those core digital assets that, if compromised, may seriously damage or even ruin your business. Valuable and confidential information, including your crown jewels, need protection.

Cryptography could be an effective way to protect your information. Consider the end-to-end process and ensure that information is always encrypted, whether stored (static) or in transit. Encryption can be used for a variety of applications, including hard drives, flash drives and other removable media, e-mails, critical Web transactions, and external communications.

Another aspect to consider is network security. General network controls include the implementation of procedures for network equipment identification and management; defining roles and responsibilities; strong authentication control (device and user authentication); the segregation of duties; firewalls and routers that are correctly configured; and, of course, encryption. It is also essential to focus on the logging and monitoring of network activity, including the use of advanced intrusion detection systems (IDSs). Despite these controls, however, there are no guarantees than attackers will not (eventually) gain access to your network. This is where network segmentation or zoning can protect your crown jewels. By zoning the network, you can limit the number of devices, users, and applications that operate in highly protected areas, thereby making it more difficult for attackers to access your more sensitive digital assets.

Conclusion

The following cyber risk management statement expresses those organizational capabilities that the CEO and board expect to be demonstrated in terms of access controls and cyber risk.

About Sidriaan de Villiers, PwC Partner South Africa

Sidriaan started his career in IT, where he gained experience as a programmer, systems analyst, and project manager for retail applications and networking environments. He then joined PwC as an IT auditor in 1990 and started to specialize in ERP controls and security. Due to his ERP experience, he has been involved in a number of international engagements in countries that included Namibia, Botswana, Zimbabwe, the Middle East, the United Kingdom, the United States, Switzerland, and Greece. With 30 years of experience in IT, computer auditing, risk management, data analytics, and system development life-cycle assessment, he is now responsible for the PwC Africa cybersecurity practice. He often lectures on controls- and security-related topics at colleges and universities in South Africa and is a regular cybersecurity presenter. More recently, he delivered a paper on controls and security in an ERP environment at the ORACLE Africa user group conference in Swaziland and was the keynote speaker at an ERP conference in Tel Aviv (Israel). Sidriaan holds BCom (Information Systems) and BSc (Hons Computer Science) degrees. As a member of ISACA, he completed the CISA certification in 1998, CISM in 2007, and CRISC in 2011.