The use of personal devices and access to externally hosted applications such as Dropbox continues to grow yet it is concerning that few organisations have the security infrastructure in place to protect the resultant spike in business critical data in motion. What are the options? While some companies have attempted to lock down access, that is far from practical. The reality is the growing Shadow IT phenomenon where users are either choosing to access unauthorised applications and/ or IT is simply ignoring the activity creating ever-greater security risks.
The traditional VPN model simply no longer works – any hacker that does gain access via a VPN basically has an open door in to the company’s most sensitive data. The alternative is user-specific encryption that essentially transforms the complexity of traditional remote worker secure access. This ‘know your user’ model addresses the two key requirements of today’s security landscape: firstly, it provides a central location to identify ’authorised’ or ‘unauthorised’ users and, secondly, an opportunity to define specific encryption policies for each user based on the applications they are allowed to access. Essentially, this extends the centralised user management approach with secure data in motion to provide end-to-end control over the data each user can access and how that should be secured.
Rather than the multiple layers of authentication required to access the diverse applications used on a daily basis, the user-specific encryption reduces the cost, management and risk associated with multiple security layers and, critically, reduces the ‘accidental criminal’ risk the holes in security created by frustrated end users breaking a company’s security policies by using the same password for every system or illicitly using their own devices. Taking this approach, an organisation can easily roll out new applications to users, enable BYOD – and remove the danger of Shadow IT.
Duo Security RSAC 2015 – Register to win a free Quadcopter
By Paul German, VP EMEA, Certes Networks
BIO : Paul is responsible for growing the Certes business in the European, Middle Eastern and African regions. Paul brings more than 18 years of experience to Certes and was most recently VP/GM EMEA for Sipera Systems , a worldwide leader in IT security solutions sold to Avaya in 2011. In addition, Paul has broad experience having held key roles with Cisco, Siemens Network Systems and Lehman Brothers. His main success has been in helping companies achieve forecasted goals by structuring sales, operational processes, and coaching sales teams to deliver multi-year, multimillion-dollar contracts. Paul holds a Bachelor of Science honours degree from Brunel University, London.
Certes Networks has delivered groundbreaking, dependable solutions for encrypting sensitive traffic over data networks. With thousands of solutions deployed around the world, Certes delivers proven solutions for protecting data in financial services, health care, government, utilities, telecommunications, education and many other industries.Certes Networks offers the new generation of security, for companies who want to gain all the efficiency and competitive advantage of modern IT, without putting themselves or their customers at risk.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.