Security by design (English Version)
More than just a lock on the door.
Lately I've been hearing a lot about it in the media; - data leaks -. We store a lot of data in systems that are relatively easy to use. On top of that, working from home also reduces social control. This combination appears to be sensitive to data misuse. What can you do as an organization to prevent this?
To answer this question it is good to divide it into a number of parts;
- Technical; hardware (infra) and software (applications)
- Process-based; functions, processes and "ease-of-use"
- Social; awareness and culture
The first category (Technical) is the easiest in my opinion as a CTO. Set up Identity and Access Management properly (IAM, management of identification and access). Limit and segment your infrastructure and hardware so that you don't have one large network to which everything and everyone can access. Try to realize that at the hardware level as well. A step higher to applications, in addition to identification, access to the application, it is also important that you set up authentication. Easy to remember: identification says something about IF someone has access. Authentication says something about WHERE someone has access to. I always recommend setting up the second (authentication) in such a way that it remains workable (and not everyone still needs the heaviest authentication) but still create clear segments in line with functions and processes. Strive for a clear role separation, but more on that later. Do not forget to set up and record supervision, especially with sensitive data: “who looked at what when”. Also have a process in place to detect and follow up on abuse. In films I often see that someone logs into the computer of the FBI and immediately all flashing lights go off and people are alarmed.
In addition to the above, the process-based design of your organization with regard to security is at least as important. After all, the dutch saying goes “… opportunity makes the thief…”. Make sure that functions are coordinated in such a way that they need, supplement and control each other. Also make sure you don't put up too few barriers, but not too many. When there are too many barriers, you often see that it is difficult to be authorized during a leave or vacation of a colleague and that the identification and authorization of the colleague is then used. Well then the technology does not help against this either. "On-boarding" and "off-boarding" are also important. When someone starts working, but more importantly when someone stops working and leaves the organization. What goes wrong even more often is when someone is promoted and goes to work at another department to adjust his authentication (throughput). On-, off-boarding and promotion must be well anchored in the processes of the organization.
As a last point I would like to emphasize the social. The organization must invest in a safety culture. A culture in which employees are aware of and care about the dangers and risks. Make sure that this awareness is close to the individual norms and values. Management must also listen to employees and take steps when matters are raised correctly. Downplaying is detrimental to all of the foregoing, if the boss doesn't care about security, why should we? So you see again that the keyword is cooperation!
Casper.
https://www.casperotto.nl/en-gb/home
https://www.casperotto.nl/en-gb/blog
Photo: The New Dutch Waterline;
https://nieuwehollandsewaterlinie.nl/
https://odeaandehollandsewaterlinies.nl/
Blog
