Large-scale data breaches have become somewhat expected. In the past year, the personal information of Australians has been revealed through high-profile hacks on organisations such as Uber, Bupa and Medicare. In fact, SailPoint’s 9th Annual Market Pulse Report found that over half of Australian organisations have experienced two or more security breaches in the past 12 months.
If this tells us anything, it’s that there’s no longer a question of whether an organisation will be breached, but rather when. Companies must be proactive in building internal safeguards to minimise the impact of a breach, to defend against their inevitable cost and damage.
Mental shift: beyond the perimeter
Recently, I’ve found myself in conversation with customers and prospects regarding their companies’ attitudes on the topic of breaches. These discussions make it clear that companies have made a mental shift from relying on the prevention of breaches at the perimeter, to ensuring they have damage control and resilience when one does occur.
They are all making the assumption that a breach will occur, rather than resting on the notion that their data will be adequately protected using preventive measures alone. These measures are, of course, very important. But it is far more damaging to wind up being breached and find out that you are unprepared and ill-equipped to minimise the damage associated with a breach. This new attitude is reshaping how organisations approach IT security.
Employees as an exposure point
The reality is, it’s next to impossible to predict and stop every attack. In today’s digital world, users need access to a myriad critical systems, applications and datasets to do their jobs. The increasing adoption of Software as a Service often means these systems exist outside the corporate network as well. And the way users are accessing these assets is becoming ever more diversified through the adoption of mobile computing, so you have a very complex environment.
Employees as an exposure point continue to pose headaches for organisations in Australia, with 68 per cent of businesses reporting heightened concern. Making sure the right people get access to the right systems – while keeping the wrong ones out – has never been more crucial. The traditional network perimeter is rapidly vanishing, so relying on a well-protected wall around the corporate network is no longer a sufficient form of security.
Visibility and control: identity governance
Most organisations are recognising the need for visibility and control over who has access to what, for all application types, both in the cloud and on-premises, independent of the device they are using for that access. Companies need to know what to do to mitigate this risk and how to quickly to respond to contain the damage breaches like these cause when they do happen.
This is precisely what identity governance does. Putting an effective identity governance solution at the centre of their security strategy allows organisations to quickly react to a breach, better understand who and what is at risk and potentially shut down an attack from spreading.
Data breaches are now a feature of everyday decision making for Australian organisations. While protecting against a breach through preventive measures is an ongoing necessity, there are definitive steps organisations can take to increase resilience and potentially reduce the negative impact of a breach when it does occur. After all, it’s the severity of the data loss, not simply the fact that they were breached, that will impact business operations and damage brands.
