“The whole is greater than the sum of its parts.” As philosophies go, it remains steadfastly true regardless of how the world has changed. It’s a more eloquent way of saying that connections and integrations that leverage the best of individual components produce better outcomes than those achieved individually.
Integrations also impact security technologies, and the industry continues to work toward integrations that allow individual solutions to work together. Greater solution integration means less complexity for the IT team, and better outcomes produced by each solution.
Securing the hybrid workforce
Gartner reports that 82% of business leaders plan to maintain some version of a work-from-home policy for the long run, with 47% planning on allowing it permanently. The hybrid workforce is here to stay, and it is more dynamic and more challenging to secure than a static workforce in a controlled perimeter on managed devices and networks. Moving security closer to the end-user helps reduce the strain on IT and improve security.
This dynamic workforce needs a more dynamic security approach. Your security team needs to have easier access to and awareness of the differing needs of your remote workers who are now possibly using devices and connections that may lessen or even circumvent corporate security controls.
How threat-aware authentication works
Authentication is a technical control used to validate an identity claim, but taken out of context, it loses its effectiveness. How can we ensure that users are who they claim to be? Linking multi-factor authentication (MFA) with threat detection provides the opportunity for IT teams to use the alerts and security measures from each to strengthen the organization’s overall risk-mitigation efforts. The user experience can also be improved: when an alert is sent by the threat detection solution to the MFA solution, known factors for that user are applied and a higher level of authentication is only requested if necessary. This helps to apply the level of assurance appropriate to the risk presented.
Some solution providers may provide integration to other solutions on the market through APIs, and others through native integrations within their product suite, such as is available when RSA SecureID and NetWitness are combined.
Through user and entity behavior analytics (UEBA), risky behavior associated with a user is identified. One example that could trigger this alert might be a series of unsuccessful log-in attempts to access critical or sensitive resources. This alert is sent to the MFA. At the next login attempt, this user is challenged to provide additional forms of authentication to verify identification and prevent a breach.
Following this action, the MFA indicates to the threat-detection solution whether the user was validated or not. Security analysts then need to only take further action on those users who were not validated. Invalid users may be added to a blocked user list to prevent any further access.
The benefits of threat-aware authentication
Improved visibility, better security at the user perimeter, and automated, reliable identity are all gained with this integration. The combination of UEBA and risk-behavior authentication for each session to help mitigate potential incidents at the point the user connects to the network. The automated nature of this process provides 24×7 monitoring and response to break the attack chain if a potential breach is discovered. This saves analysts from losing time and focus on low-level risks.
- Augments multi-factor authentication efforts
Enriches threat insights on each user’s overall behavior across the organization in real-time, not just to the session established through MFA. - Automates detection of potential compromises
Provides detection of compromises that originate with remote workers or third-party users, and stops potential breaches at the user’s endpoint before it gets across your entire network. - Mitigates risk exposure
Achieves a higher level of assurance that users are who they say they are, helping to provide better security through fewer vulnerabilities and reduced attack surface. User-perimeter protection is applied automatically. - Connects security identifiers with SOC teams
Creates a reliable bridge between user and group security identifiers and the SOC team, providing a more complete picture of the organization’s security status.
Is threat-aware authentication right for your organization?
Threat-aware authentication empowers your security team with continuous authentication as an automated out-of-the-box workflow, reduces the number of alerts that might block valid user activity, and elevates only critical alerts with a higher probability of being malicious.
Whether your organization would like to explore available integrations for your existing solutions or take advantage of the additional benefits of a single user interface, the security experts at Sirius can consult with you to determine the right solution and help you implement it successfully. Reach out to your Sirius representative today to learn more.
