Encryption on Steroids – Attribute Based Access Control (ABAC)

How many data breaches need to occur before companies take real preventative action? While hotel chains, retail stores, and Facebook are likely to grab headlines, companies of all sizes, across all industries, face the same threats. If you work with intellectual property, handle sensitive materials, or are subject to regulatory compliance, you need to safeguard your digital assets.

Pernicious attacks don’t always come from the outside. According to JAMA Internal Medicine, 53 percent of the 1,138 instances of a data breach at medical facilities they analyzed originated from inside the organization. Overall, 15.1 million patient records were compromised in 2018, a near three-fold uptick from 2017.

Unprepared companies find themselves on newsfeeds for both negligence in combatting a breach and the resulting punishment levied by regulating bodies. Despite this, most companies trying to manage their data are using increasingly unreliable methods such as:

  • Putting up a firewall around the application. Despite amazing progress with firewalls and network security, a malicious attack or internal leak (whether intentional or inadvertent) will result in compromised data.
  • Using an Access Control List (ACL). Sadly, this static method of protecting who can touch data doesn’t work in today’s modern, dynamic, and globally distributed environment.
  • Applying Role-Based Access Control (RBAC). Using authentication schemes, location, network, risk, and individual characteristics can work for one-time access, but today’s environment is dynamic, making RBAC impossible to keep updated.

Chasing dynamic data with static security models will not support a fast-moving company. As more data becomes available for sharing across a variety of networks, these security measures are proving ineffective at stopping data breaches. Using a network, an ACL, or RBAC simply can’t stop malicious attacks or internal threats.

The paradigm is shifting to Attribute-Based Access Control (ABAC) to redefine data protection. ABAC has been developed to address the most stringent security requirements of the most important government entities on the planet. ABAC is the platform of choice for the US DoD, the UK MoD, and has quickly become a NIST standard.

At its basic level, ABAC uses an ‘IF/THEN/AND’ model to protect the data itself. This model is then applied to data via policy, checking attributes and applying the appropriate permissions (aka “digital rights”).

A Starbucks in Slovakia

Imagine a US State Department official carrying a laptop into a foreign country notorious for its ability to hack and steal data from the open web. This official heads into a Starbucks, opens his or her laptop, and connects to the public WiFi. It’s hard to argue that this may be one of the easiest ways for data to be compromised, but if this official’s data is encrypted via ABAC, data safety is assured regardless of how open the network may be. Regardless of the location, encrypted data is protected by an ABAC schema that guarantees appropriate access or denial of access.

ABAC puts the encryption and safety measures inside the data itself, ensuring that even if hacked or flat-out stolen (e.g., a thumb drive stuck into the side of a laptop), the encryption prevents the data from being compromised and utilized outside of its intended use.

Live inside the data itself

Attributes are the foundation of ABAC. Factors such as program, citizenship, location, clearance level, even time of day, can be used to protect the data. If the user violates any parameter, the ability to access is lost.

Continuing from the above example about an official opening his or her files in a Starbucks in Slovakia, the policy may allow this user to access the data based on multi-factor authentication, United States location, and clearance level. The fact that the official is trying to access the data in another country violates the policy, which then denies access to the data and reports the attempted use to the policy management system. All elements of the policy must be met. This official could copy/paste the information into a separate application or right into their personal email address, but the encryption inside the data itself prevents their ability to access it and protects the information.

Moving information around the globe on a second-by-second basis while maintaining control of the intellectual property or sensitive data is more important than ever. An ABAC system can be set up as a centrally located security measure, independent of people, geography, and network perimeter security, and provide a single data safety infrastructure around multiple applications. Users will have persistent rights management regardless of the application they use to access ABAC-encrypted data.

When you put the encryption inside the data and metadata itself, companies can seize control of their data and prevent a breach from internal or external threats. The Department of Commerce has made this a mandatory practice and the adoption is spreading throughout several governmental and military agencies.

There isn’t an industry that couldn’t benefit from implementing an ABAC solution, especially in a world where data is dynamic, information moves across the world in real-time, and breaches can ruin a company’s reputation and trustworthiness.

Words of Wisdom: How to Ensure a Successful ABAC Implementation

Attribute-based access control (“ABAC” for short) has reached the point of mass adoption with respect to access control technologies. In fact, the National Cybersecurity Center of Excellence developed a reference design for ABAC that provides organizations “greater efficiency, flexibility, scalability security.”[1] To ensure that those benefits are realized, however, it’s essential to establish best practice guidelines when it comes to implementing ABAC successfully.

ABAC can be instrumental in reducing enterprise risks such as insider threats, loss of customer data and personally identifiable information (PII), leakage of trade secrets and intellectual property, and fraud. The use of context in access decisions can also lead to substantial cost savings since ABAC systems enable more efficient policy management and regulatory compliance. Furthermore, organizations can continue to leverage much, if not all, of their previous investment in existing IT infrastructure. more “Words of Wisdom: How to Ensure a Successful ABAC Implementation”

Could Your Car Be Hacked? It’s More Possible Than You Think.

When you’re driving your car, you view it as something completely protected. You’re driving it, and if you’ve maintained it, it’s going to likely drive as it should. I recently spoke with a friend who said he views his car as a ‘black box’; he drives it, but he relies on his mechanic to tell him if something is wrong with it. The unfortunate reality is that now, even while you’re driving, your car could potentially be taken over by a rogue hacker.

While it may sound like something out of a spy thriller or sci-fi novel, over the last few years, hackers have found numerous ways to hack into a vehicle, from taking over the on-board navigation system through an unsecured WiFi network designed to look like a public network, to hacking into a local mechanic’s diagnostic system then using that system to access the car’s on-board diagnostics.  more “Could Your Car Be Hacked? It’s More Possible Than You Think.”

GDPR: A Lens into the Bigger Picture of Digital Transformation

LensThe General Data Protection Regulation (GDPR) has been receiving much press the last couple years on both sides of “the pond” and for good reason.  It impacts companies not just in Europe but potentially anywhere in the world.

We’re doing business in a world that’s increasingly globalized and intertwined, much more so than it’s ever been.  Large multinational companies have offices throughout the globe.  more “GDPR: A Lens into the Bigger Picture of Digital Transformation”

Why Dynamic Authorization Is a Big Deal in Data Security

CollaborationIf you’re unfamiliar with dynamic authorization, be prepared for an epiphany of sorts.  It could very well be the biggest little secret you’ve never heard of with respect to data security.  What with all the cloud apps, mobile devices, Big Data, and productivity tools that consume our professional lives these days, legacy access control solutions are having a difficult time keeping pace. more “Why Dynamic Authorization Is a Big Deal in Data Security”

Providing secure access to information for improved customer service while streamlining IT operations

“Securing customer data in property and casualty insurance, life & savings, and asset management products is tantamount to protecting a company’s ethos. After all, organizations in this industry gain brand loyalty by promising to give customers’ “peace of mind,” which now includes maintaining the privacy and security of their information.

However, one leading global insurance company reports that another business mandate— offering best-in-class customer service—can pose challenges to the mandate to protect customer data. How does an organization provide anytime, anywhere access to services, while also protecting confidential customer data from unauthorized access and leak? more “Providing secure access to information for improved customer service while streamlining IT operations”

The Case for Attribute-Based Policies in eDRM

In today’s collaborative world, eDRM (Enterprise Digital Rights Management) is proving to be one of the most effective ways to share documents with partners. EDRM is a technology that enables companies to restrict access to documents containing sensitive information, both inside and outside the corporate firewall. The way it works is documents are rights protected using AES encryption and then policies are applied to control access and usage rights (view, edit, print, etc.). If a user is not entitled to view the document, he cannot open it. If he is entitled to view the document, usage may be restricted. more “The Case for Attribute-Based Policies in eDRM”

4 Ways IT must Change to Protect your Business

By E.K. Koh, VP of Solutions at NextLabs

It’s not your perimeter. It’s not your applications. In an age where there is no perimeter, where data moves from application to application, from servers to desktops to tablets and smart phones that the company does not even own, managing security at the perimeter or application is essential, but not sufficient. What is your value at risk? It is your DATA.

Data is Valuable

In a survey by Forrester, companies noted that corporate secrets (or intellectual property) comprise 2/3 of their information portfolio, with 1/3 being customer custodial data. The figure below shows the relative value of different types of data rated on a million dollar scale: more “4 Ways IT must Change to Protect your Business”