When securing your company’s computing infrastructure, one of the most useful ways to manage it is with access control.
Not only is it the best way to protect valuable information, but it also helps limit the number of people who have access to specific pieces of data. The fewer people that have access to sensitive information, the less chance there is that it can be stolen or leaked.
There are more ways than ever before to implement access control in your organization. Let’s go over a few things to consider regarding access control, along with some innovative methods it can be applied for your business’ security.
Table of Contents
What are conditional access policies?
The definition of conditional access policies is a specially planned if-then statement that governs who has access to what places and data. These policies can be based on different factors, all of which help determine why a user should or should not be permitted to view certain folders and files.
If you are a Microsoft 365 user, conditional access policies can be configured through Azure.
Why implement access controls?
It’s important to understand the need for access control. First and foremost, not everyone in your business needs to have access to all your company’s information.
Human resources will need access to employee information, while accounting and financing will need to be able to get banking information and budgetary data. Rarely will those two necessities intersect.
For departments to operate smoothly and to keep information secure, employees should only have access to the information needed to perform their jobs, and nothing more.
Limiting access to information keeps your employees focused and will reduce the risk of sensitive information being released.
If an employee has access to more data than they need to do their job properly, then your organization is potentially exposing more information than necessary to danger.
Furthermore, you should have a separate Wi-Fi account made exclusively for your visitors. This keeps your network separate from others who have no business accessing it.
What can I use to make policy decisions?
We know that users should only have access to what they need, so what should determine where those boundaries are?
Role or Group
The easiest way to decide if a user needs access to certain information, or vice versa, would be what role they play within a company.
How many users in your network actually need access to your financials? How many need to see your personnel files?
More than likely, those aspects of your company need to be seen by a select few. Start small, restricting data to one or two point-people each, and expand access as it is needed.
Device
Some devices have no place on your network and could expose your organization to great risk.
Non-corporate devices, especially those that are not connecting via your protected on-premises network, are a wide-open avenue for cybercrime.
Because these devices lack the cybersecurity hardening of a corporate device, connecting them to your network makes them the easiest route to your data.
Access controls allow you to restrict access to anything but the essentials if the device is not one from a select group.
By restricting most access from mobile or non-corporate devices, you protect your network the best. Your organization should consider a mobile device management (MDM) policy, if you have not already.
Application
Access controls are not just for users and devices. Some applications should be considered when setting policies. While it is worth considering what users and devices can access certain applications, some applications need permission whether to talk to themselves or not.
One of the main things to consider with application-level access control is whether it could expose data to unauthorized parties.
If there is a potential backdoor to important data through the app, the same users who can access that data traditionally should be the users permitted to access the app.
Otherwise, where applicable, individual functions can be limited through access controls. Sometimes the difference between admin and non-admin controls is all that is needed, but some controls can be more granular.
Location/IP Address
There are legitimate reasons to ban devices logging in to your network from a certain location or IP address. If any of these reasons apply to your organization, you can create a list of trusted locations, or ban locations outright through Azure.
The location access control can also force users to authenticate further if they are not located on the company’s private network.
Access control technologies
There are a few ways to implement barriers to access to information on your network without assigning permissions. They can also be barriers that are used in addition to permissions. Let’s take a look at some of the other ways we can authorize access for users.
Two-Factor or Multi-Factor Authentication
One of the most secure forms of access control is two-factor authentication. Many companies are suggesting two-factor authentication for their customers to reduce the risk of personal information getting released. So, it only makes sense to implement this within your company with your employees.
Two-factor authentication requires the user to authenticate themselves with something they know and something they have.
For example, something you know would be a password, passphrase, or perhaps the answer to a complicated riddle. Probably one of the first two. Something you have would likely be a smartphone that has an authenticator app, which generates a unique code every minute or so.
Biometrics
If you aren’t sold on two-factor being secure enough, maybe something a little more personal and unique will suit your security needs.
Biometrics are the use of physical characteristics that authorize access to information or locations. Think of the common ways that some smartphones unlock these days: using your fingerprint or face.
This sounds like something straight out of a spy movie, but why not make use of it in your business security.
Physical Security
With more and more business being done digitally, it’s easy to forget about security at a physical location. Protecting your office is as important as securing your network.
You want to make sure the people inside your business are meant to be there. This can be achieved through card keys, security cameras, and electronic locks.
Unlike securing a network, physical security is more in-depth and depends on each location and size of the office.
When to grant access
In summary, access controls can and should be leveraged across your organization. Limiting authorization and hardening authentication should be at the top of your list when considering your network’s security.
As you consider how you control access within your organization, here are some general rules to think about abiding by:
– Require multi-factor authentication where possible. MFA should absolutely be necessary for users with admin roles, as well as those who manage Azure.
– MFA should also be necessary when logging in from an off-premises network or specific locations. Users should only be able to register a device with MFA from trusted locations and networks.
– Block attempts to sign in using legacy authentication protocols like POP, SMTP, IMAP, and MAPI. Because they cannot enforce MFA, these measures are preferred for cyberattacks.
– Block risky sign-in behaviors or utilize Azure Active Directory Identity Protection for live monitoring.
– Require devices to be marked as compliant and joined to your hybrid Azure AD or other cloud identity management platform.
– Require approved client applications, as well as limiting specific applications to corporately managed devices.
Beyond these tips, make sure to drill down into your data, apps, and users to make sure that they do not have access to anything unnecessary. By doing so, your organization will limit anyone from acting in bad faith.
Network security should be at the forefront of every business owner’s mind, and access control is an important aspect of that. If you’re ready to protect your network from external and internal threats, schedule a call with our Virtual CIO today.
We have successfully installed and implemented network security solutions for small to medium-sized businesses for over a decade. To learn more without an appointment, call and talk with a specialist today at 855-4IT-GUYS (855-448-4897).
