Flash Point Paper

Ransomware Relies
on Poor Data AccessGovernanceProtection through Containment• Can you verify that the files you
consider the “crown jewels” of yourorganization are stored in locations
with restricted access permissions?

In modern building construction, firewalls are
put in place to contain the effects of a firethat might break out in a given area. The idea
is that if the fire can be contained to a specificsection, then despite the damage, you won’t
lose the building.

• What would happen if thesefiles were compromised
through ransomware?

Think of ransomware as a fire that you
must be prepared to fight. What can
you do to contain ransomware using asimilar approach?
Data Access Governance (DAG) is allabout controlling insider access to datausing concepts such as least privilege andseparation of duties. The mention of insider
access conjures images of employees doing
bad things. Worse, however, is the attitude,“Sure, there are bad apples in every barrel,
but our people are good people.” This is thetype of thinking that relegates DAG to anorganization’s “nice-to-have” list.
Astute security leaders know that the easiest
way for outsiders to gain access to theirorganization’s data is through insider access.
Compromised credentials and Trojan horses(phishing) are the most common tactics.
Data exfiltration (where the bad guys canpublish your secrets) and ransomware
continue to make headlines. If you don’ttake precautions against these threats,
before you know it, the “building” is on fire.

Identifying What Needs Protecting

Which files need the most protection? Sure,you can get in trouble by not adequately
protecting compliance-related data such as• Can you easily conduct a leastprivilege analysis of employee
access permissions?
• Are you conducting regularaccess reviews?

PII, PCI, or PHI. Those file types are definitelyimportant. But ask the CEOs at Colonial
Pipeline and JBS Foods what landed themon the evening news? And, in the case of theformer, in front of Congress? The lesson isclear: If you don’t protect the “crown jewels,”
you will find yourself poorer, severely
wounded, or out of business faster than
you can say, “It won’t happen to me.” It will
happen to you and it’s only a matter of time.
Based on the principles of well-known security
frameworks such as Gartner’s CARTA and theNIST Cybersecurity Framework, both Colonial
Pipeline and JBS could be hit again. Will they
be prepared? Will you be prepared if yourorganization is the target instead?

Too Much Access: A Disaster
Waiting to Happen

Some look to encryption as a protection
from ransomware. Data encryption can help,

Ransomware Relies on Poor Data Access Governancebut it’s no silver bullet. For example, manytimes the ransomware attack vector involves
the employee’s own machine, which holds
the decryption keys for seamless day-to-day
access. Furthermore, even if you happen to
be attacked in a way other than through themachine that holds the keys, data encryption
really only helps with the threat of exfiltration.
It doesn’t keep the bad guys from locking
you out of your own data.
Even though there are no silver bullets,
there is an arsenal. Along with the usual
measures of user education and patching,
we really need to talk about DAG (and related
technology such as NetIQ Privileged Access
Management (PAM) by OpenText for correcting
the real problem of over exposure. Use of
these technologies can significantly mitigate
the scope and extent of ransomware andsimilar types of attacks.
Like a fire in a building, ransomware is only
as destructive as the access it is able togain into the network.
Think of your organization’s data footprint
as the floorplan of a building as shown in
Figure 1. Data for certain purposes and setsof people are located in certain areas.

Identity and Role

Want to stop the bad guys? Stop giving themwhat they are counting on: a hunting groundwith few or no data firewalls. Full network
access, whether it’s granted to the administrative assistant or the CEO, is a disasterwaiting to happen. Do either of them reallyneed access to everything? No!

Finances

MarketingHR

M&A

SafetyLegal
Operations

Sales
NorthSouthR&D
Exec

Figure 1. Comparable to a building floorplan, data for certain purposes and sets of people are located incertain areas of the network.

That’s why the viability of identity and role
as key factors in securing data is undisputed.
Security is really about the right people
having the right access to the right datain the right place at the right time. Most ofthese “rights” are defined by role—and roleis articulated through identity.

Taking Focused Corrective Actions

proprietary files. You already know
where this data is, or at least where itis supposed to be.
For each High-Value Target, you should:
1. Do an analysis of access and remediateusing the concepts behind least privilege,
restricting user access to the minimum
levels needed to perform job functions.

Fortunately, you don’t have to boil the ocean
to take corrective measures. You can do soby putting a few firewalls in your “building”
as shown in Figure 2. Security analysts
recommend that you:

2. Defend against access escalation andentropy by putting automation policies
in place to lock down access so that it
doesn’t change; or at least allow it tochange only within certain limits.

• Use a phased approach.

3. Perform periodic access reviews tocontinually ensure that only the people
who really need access have it.

• Start with the “crown jewels” or “High-Value
Targets.” Examples include storage locationsof financial, legal, and confidential

That’s DAG.

2As you move forward, you’ll have a “building” with a data footprint like this:Finances

MarketingHR

M&A

SafetyLegalOperations

SalesNorth

Connect with Us
www.CyberRes.com

SouthR&D
Exec

Figure 2. Similar to constructing firewalls that limit the spread of a fire to a room, protecting High-Value
Targets through least privilege access limits the capability of ransomware to spread across a network.

With protection like this, a phishing attack
sent through email to the administrativeassistant of the South Region of Sales islimited to the user’s least-privilege access—effectively limiting it to the utility closet” of the“building.” Likewise, even a successful attack
through the VP of Sales restricts the effects toa single “room” while saving the “building.”

DAG Product Offerings

Data Access Governance is an emerging
market segment that focuses on identifying
and addressing the malicious and nonmalicious threats that can come fromunauthorized access to sensitive andvaluable unstructured data. Many software
companies have developed and introduced
DAG products with the objective of securing
and protecting network-stored unstructured
data from unauthorized access, data breaches,and data loss.
NetIQ Data Access Governance by OpenText
offers an enterprise DAG solution built on

identity and role. It is engineered to integratewith IAM systems—providing applicationbased data access management and NetIQ
Identity Governance by OpenText to deliver
access reviews for unstructured data.
Learn more at
www.microfocus.com/en-us/cyberres/
identity-access-management/accessgovernance

About NetIQ by OpenText

OpenText has completed the purchaseof Micro Focus, including CyberRes.
Our combined expertise expands oursecurity offerings to help customers protect
sensitive information by automating privilege
and access control to ensure appropriate
access to applications, data, and resources.
NetIQ Identity and Access Management ispart of OpenText Cybersecurity, which provides
comprehensive security solutions forcompanies and partners of all sizes.

OpenTextCybersecurityprovidescomprehensivesecuritysolutionsforcompaniesandpartnersofallsizes.Fromprevention,detectionandresponsetorecovery,investigationandcompliance,
our unified end-to-end platform helps customers build cyber resilience via a holistic security portfolio. Powered by actionable insights from our real-time and contextual threat intelligence,
OpenText Cybersecurity customers benefit from high efficacy products, a compliant experience and simplified security to help manage business risk.
784-000005-002 | O | 09/23 | © 2023 Open Text