Identity is the new perimeter for protecting critical government assets

The COVID-19 pandemic has spurred many Australian government organisations to accelerate the deployment of digital technologies over the past 18 months. This has been driven by increasing demand for government services, support for a remote workforce and virtual service delivery requirements for citizens, in conjunction with other societal pressures to shift and evolve priorities.

This has presented government organisations with new opportunities for innovation, using technologies and data to build trust, agility and resilience in the public sector. It’s also opened up more doors for cross-agency collaboration to drive positive citizen outcomes during the pandemic and beyond.

While this transformation has been absolutely necessary, it’s also made the public sector a prime target for cybercriminals due to the sensitive data collected by government departments, as well as their increased reliance on cloud-based services.

The Australian Cyber Security Centre (ACSC) responded to more than 2,266 cybersecurity incidents in the 12 months to 30 June 2020. 436 of these targeted Australia’s Federal Government, while 367 were against State and Territory Governments.

This was particularly highlighted in June 2020, when a sophisticated state-based actor targeted all levels of the Australian government, posing significant threats to the country’s security. According to the ACSC, “Access to government networks remained a top priority for malicious cyber actors. Cyber operations deliberately targeted Commonwealth entities with an intent to obtain information of strategic value to undermine our advantage and strengthen theirs.”

The rise in cyberattacks on the sector is a wakeup call for all government organisations to review their cybersecurity hygiene levels. Cybersecurity maturity levels continue to vary across different organisations and a sustained effort is required to meet the evolving threat environment.

Controlling who has access to what

Australian government organisations are entrusted with holding copious amounts of highly sensitive personal information relating to over 25 million Australian citizens and on the nation’s critical operations. Part of reviewing their cybersecurity strategy should involve tightening who has control and access to highly-privileged critical information and systems.

With more users, devices and applications than ever before, however, many government organisations are struggling to maintain visibility and control across the accounts and credentials that allow this privileged access. A clear ‘stock take’ and subsequent removal of unnecessary privilege must be undertaken to reduce the risk of attacks, on an ongoing basis.

Taking an identity security approach

It is crucial to secure privileged access; according to Forrester, 80% of all security breaches involve default, lost, stolen or compromised privileged credentials. Government organisations must examine how to deploy a comprehensive identity security solution, focused on authenticating every identity accurately, authorising them with the proper permissions and providing access to privileged assets in a structured manner — all in a way that can be audited or accounted for.

Implementing least privilege is an important component of the effort to secure privileged access and identities for the cloud-based infrastructure and applications that are essential to IT operations in the public sector.

In a perfect world, each identity is configured to have only the privileges and permissions needed to perform its intended functions — nothing more, nothing less. This is the crux of the principle of least privilege and a core tenet of zero trust — “never trust, always verify.”

Gaining control of critical information and systems

Identity security offers government organisations the peace of mind that their most critical assets are secure, while accelerating their ability to provide agile, digitally-enabled citizen services.

Think of identity security as the ultimate gatekeeper for who gets access to what, where and for how long. Government organisations gain complete protection, control and visibility of privileged access across critical networks, systems and applications. At the same time, they achieve the ability to mitigate security risks and protect against unauthorised privileged account access, impersonation, fraud and theft.

As the guardians of sensitive personal data for Australian citizens, the government sector plays a fundamental role in ensuring the privacy and security of that confidential information. Addressing who has control and access to this critical information must form part of good governance for all Australian government organisations.

To find out more, listen to CyberArk’s government podcast series which includes commentary from Alastair MacGibbon, former cyber security advisor to the Prime Minister and Robert Deakin, Director of Cyber Security at ACCC.

Image credit: ©stock.adobe.com/au/denisismagilov