Risk Never Sleeps – Time to Rise and Shine

By Kevin Cunningham President and Co-founder

It seems like you can't get your news these days without reading about another organization that's lost sensitive customer data or fallen victim to a trusted employee committing internal fraud. Paradoxically, breaches are occurring with increasing frequency despite the flood of regulations mandating stronger security and privacy practices.

Part of the answer to this puzzle lies in the fact that many organizations fail to effectively align security and compliance activities with tangible goals to reduce actual risk. Companies that implement "check-the-box" compliance processes are likely not addressing the true areas of risk to the business. What's missing is a disciplined approach to managing risk that quantitatively evaluates exposures and consequences.

Taking a risk-based approach to managing user access to sensitive applications and data is key when it comes to protecting your organization's reputation, intellectual property, and financial integrity. But where do you start? Here are a few practical steps organizations can take to build risk management into their identity infrastructure:

• Inventory IT assets and classify by business risk. To adequately protect your information assets, create a common framework that will allow you to determine the level and severity of risk associated with each asset.
• Gain enterprise-wide visibility to user access privileges, and systematically identify high-risk users. Start with building a comprehensive view of "who has access to what" across all of your high-risk or compliance-relevant applications. You can then employ rules-based analytics to identify high-risk users based on the number and type of access privileges held by the user, policy violations detected, or other user attributes such as temporary/contractor status or location. My advice: start with a simple risk model and build from that base.
• Take a risk-based approach in the design of IT controls. Prioritize controls that relate to areas of greatest business risk – avoid treating all assets and users the same. This will ensure you get the biggest impact from your efforts.
• Remember, you need to measure risk in order to manage it. Metrics deliver the information needed to make informed decision and to monitor and improve your organization's risk management performance.

Remember the famous quote by Benjamin Franklin, "An ounce of prevention is worth a pound of cure"? Well, he's right. It's time to get ahead of risk, and, in this edition of SailPoint Navigate, we offer you tools, real-world examples and expert advice that will help you do just that.

Coffee's ready,

Kevin Cunningham
President and Co-founder
SailPoint