If you’ve started down the path of Zero Trust security, identity and access management (IAM) is likely a substantial part of your road map — and it should be. Identity management providers, such as Okta, Ping, and AuthO are focused on ensuring that people and systems accessing your network are who they say they are — requiring users to authenticate themselves before gaining access to your essential applications and network assets.
We all know that Zero Trust journeys can be layered, complex, and expensive. As you’re thinking about stronger identity management on your Zero Trust roadmap, why not extend the value of that investment by applying identity to specific, granular data access decisions?
First Things First: What Is Identity Management (IAM)?
According to Gartner, Identity and Access Management (IAM) is “the discipline that enables the right individuals to access the right resources at the right times for the right reasons.” Identity management providers specialize in honing smart approaches to identity, putting safeguards in place that validate and authenticate that a user, system, or device is a known entity.
Identity Informs Access: What is Access Control?
Access control applies identity to the applications and parts of a network that the user should have access to. In the context of cybersecurity, it’s assigning access parameters to an individual user. This determines what applications, which areas of your network, and what types of data the individual should have the authority to access.
Identity management (authentication/AuthN) and access control (authorization/AuthZ) are often paired together: For example, once you’ve logged into your single-sign-on provider (which authenticates your identity), you’ll then be authorized to access the applications that are needed in order to do your job. One informs the other.
But, what about particularly sensitive data? What if organizations could get smarter about exactly who can access certain pieces of data?
Getting Granular: What Is Attribute-Based Access Control (ABAC)?
Attribute-based access control is a granular, nuanced way to ensure that sensitive data is only accessed by the individuals who have a need to know. Whereas role-based access control (RBAC) may be based on an individual’s role and responsibilities within a company, attribute-based access control (ABAC) allows you to further delineate access rights based on more granular details, like being a stakeholder on a certain project for a specified amount of time, or needing access to a certain subset of sensitive data rather than the entire dataset.
Role-based access controls can cause you to over-grant data access to your employees. But, by assigning granular tags to certain datasets or files, sensitive data can only be accessed by those with a true need to know.
The Complete Zero Trust Picture: Tying Identity and Access Controls to Data Itself
According to John Kindervag, the father of Zero Trust, “The first principle of Zero Trust security is to protect the data.” At the end of the day, it’s your data that you’re protecting, not the network, and not the apps. The data is where the true value lies — and that data is critical to your business, both from a day-to-day operations perspective and from a brand value and loyalty perspective.
To best protect that data, you can apply attribute-based access controls that grant access only to those with a true business need to know.
However, as Okta points out, it can be challenging to implement ABAC if you’re starting from scratch.
So, it’s a good thing you don’t have to start from scratch: Virtru’s data protection provides Zero Trust Data Control to safeguard information shared in the applications you use every day: Google Workspace, Microsoft Outlook, Salesforce, and other critical apps. With Virtru, you can extend your identity management work past the network and application layers and to the data layer — arguably the most foundational layer of Zero Trust.
Our data protection capabilities are built on the open, IC-standard Trusted Data Format, which enables you to apply sophisticated, granular access controls to the data itself, giving you full visibility and control over exactly who can access it at any given time. You can revoke access to specific data if business needs change. You can prevent users from forwarding the information. You can set an expiration date for short-term projects. For federal agencies that already use tagging tools such as TITUS or Boldon James, you can pull from existing classification and tagging regimes, appropriately tagging data under CAPCO Classification & Control Markings, STANAG 4774 (NATO’s confidentiality metadata syntax), IC-EDH or other classification or categorization structures defined within standard tools.
In this way, your data becomes self-protecting and self-directing: These access controls and policies are cryptographically bound to the data itself, traveling with it everywhere it moves. Even after a file or other piece of data has been shared outside your network, those policies are still in place, and can be changed by admins or end users at any time.
This extends your identity management to your most important asset, the data — while enabling that data to move in and out of your organization while still remaining fully under your control.
Maximize Your Zero Trust Identity Investment with Virtru
You’ve already invested in Identity and Access Management. Make the most of that investment by leveraging Virtru to apply those policies and access controls to the data itself, everywhere it moves. To learn more, contact Virtru’s team of data protection experts to book a demo.
