Enterprise security has become a multifaceted, complex system that is constantly evolving amid new threats and technologies. For years, businesses have protected themselves with a combination of solutions such as firewalls, vulnerability management, security event monitors, change management and identity governance. Each of these forms a critical link in the chain that protects organisations from global cyber threats.
While the security chain is strong, it is not unbreakable because any missing or outdated link can become an area of compromise. The old saying that a chain is only as strong as its weakest link is quite apt in the realm of enterprise security. And given the fact that three in five companies are expected to be breached in the next year, there are clearly some weak links in the chain.
The challenge: Threats and data
The challenge organisations face is twofold: keeping up with the relentless barrage of threats pummelling enterprises; and deciphering the signal-to-noise ratio when it comes to the slew of security event data that security tools generate. That data must be effectively combed and analysed, differentiating between real and false positives in order to trace back to correlated events, users and behaviours. This analysis is a gigantic task, particularly when IT and security resources fall short of what most people would consider ideal.
To put this in perspective, our recent Market Pulse Survey showed that less than half of businesses surveyed had full visibility into all users and their access privileges to corporate applications and systems. While sometimes this information is captured by an identity governance system, it is not always used effectively to identify and reduce risk, which is a huge potential blind spot.
Strengthening the links with machine learning
Machine learning has the potential to revolutionise the way in which companies process the massive amount of identity data to detect and isolate areas of risk. By taking all of an organisation’s identity data into consideration and learning the unique situations relevant to the organisation, machine learning translates identity-related data into smarter decisions. This in turn generates signals through the ‘noise’ to strengthen the oranisation’s identity governance program.
Proactively, this could mitigate risks generated from users having inappropriate entitlements or gaining access through non-official channels. Notifications of high-risk users and unusual request scenarios can be flagged to an administrator without their having to know the user or context. Reactively, being able to trace an incident of improper access through historical timelines and discover other user accounts that may have similar vulnerabilities can quickly help stem the damage caused by a compromised identity.
Additionally, machine learning allows for the automation of low-risk tasks. This can have a tremendous positive impact on operational efficiency by reducing the time business and IT users spend on routine, low-value tasks, such as access certifications for low-risk users.
Early detection of vulnerabilities is key to preventing and mitigating damage from a breach. It is key to knowing where vulnerabilities often exist in the sea of data that an organisation holds, but just doesn’t have the resources to manually comb through.
Enterprises employ a range of security solutions to protect their business, each making up a link in the chain. However, the challenges faced in this field require every link to be strong and up to date. Machine learning insights applied to existing processes can strengthen your enterprise security by ensuring that a single rogue entitlement or ill-informed permission doesn’t fly under the radar and compromise business security. The bottom line for business? Make sure the identity link in your security chain is a strong one.
