Identity and Access Management Lessons as Told by Game of Thrones
By Hannah Cho
If we learned anything from this past Sunday’s episode of Game of Thrones, it is that previously impenetrable and well trained forces are no match for dragon’s breath.
Like the Lannister army, our data is spread across servers in different locations — on premises and in the cloud. And we ensure firewalls and access controls to protect that data and create multiple layers of security. But if recent private data breaches have revealed anything, it’s not just about protecting the data, it’s ensuring the right permissions to that data through identity access management and privileged access management solutions as well as knowing where the data resides. Otherwise we end up in a hot mess (pun intended), as if we encountered the ire of a dragon ourselves.
If we are to use an additional GoT reference, think of Castle Black as your perimeter. It’s a good one — carefully monitored, in addition protected by high walls and weaponry to ensure intruders and threats don’t get in. But who could have predicted that in GoT Season 5, we’d see the Night’s Watch turn and stab Jon Snow to death? These were good men (and boy) who were loyal to the cause and leader. Yet, because they had the access and trust, they had an unchecked path to make the deepest cut of all, assasinating the future King of the North IN HIS OWN PROTECTED DOMAIN!
So not only do we need to worry about the dragon’s breath that can take down entire security systems, we also need to look out for the threats that reside within. Proving that having a strong perimeter is only just the start. In fact, if the Jon Snow scenario had deployed adaptive security with behavioral analytics, he could have predicted the mutiny and avoided death (the first time) altogether!
Security today is not just about protecting the castle (figuratively now) but also ensuring that whatever happens inside the castle is supportive of the business and does not put any personal, private or business critical/sensitive data at risk.
Solutions that deploy the use of analytics for behavioral monitoring and pattern recognition start to ensure better application of identity and access management solutions. And not too far into the future, we’ll see the ability to apply adaptive authentication to security solutions with real time data analytics that crunch contextual, in the moment, at-rest and in-motion data all at once with biological recognition that gives us the assurance that who we are and what we know are colliding at the right time to support the business needs. …kind of like the initial (and somewhat awkward) meeting of Dany and Jon.
The moral of the story is: avoid dragon’s fire. Think of dragon’s fire as the worst possible scenario that you’re protecting yourself and your company against and stay diligent. But as you do so, don’t forget about the possibility of Night’s Watch traitors within. It’s a struggle to ensure that your employees and partners have the access to keep the company efficient and productive, but not at the expense of your brand and business integrity. Some ways CA suggests you think about how to keep your data where it should be and access it as needed:
- Know what data needs to be protected and how access to it is controlled
- Ensure that suppliers and key vendors take an equivalent amount of due care in protecting third party customer data that they have access to
- Understand that their responsibilities to protect customer information extends beyond their own internal networks and servers to any cloud accessible storage locations
Feel free to give us a ring to discuss other GoT analogies, or for more information on CA Identity and Access Management solutions visit ca.com/security.
