Story image

Companies caught between crooks and compliance - Centrify

12 Jun 18

Businesses in Australia and New Zealand are increasingly squeezed between defeating cyber-attacks and complying with surging volumes of government regulation, cybersecurity company Centrify says.

Centrify is concerned that complying with the increasing amount of red tape required to retain personal information may hamper the ability of a business to protect that customer information successfully.

Already this year, Australian companies have seen the implementation of national Notifiable Data Breach legislation and the mandating of GDPR regulations for businesses with a presence in Europe.

In addition, the Australian Prudential Regulation Authority (APRA) is currently developing a new proposed cybersecurity standard, CPS 234, planned to take force from July next year to further strengthen the Australian financial system.

In April this year, the New Zealand Government announced plans to refresh its three-year-old Cyber Security Strategy.

Centrify APAC sales senior director Niall King says regulatory protection of information privacy is completely commendable.

“The challenge that faces companies is they have to defend against cyberattacks while also having to comply with multiple regulations from diverse jurisdictions,” he says.

“In an ideal world, these two activities would be aligned, but the reality is that while companies must jump through bureaucratic hoops to demonstrate their regulatory compliance, the bad guys don’t follow rules, so they keep on innovating to find new ways to get illicit access to private data.

“The bottom line is that if companies want to keep the crooks out and comply with government regulations, they need to rethink how they approach cybersecurity by putting identity protection at the centre of their defences.”

King says that in many cases, hackers did not try to break in through corporate defences.

“The fact is, they use the path of least resistance by deploying our own weak credentials against us,” he says.

“Reports show that 81% of data breaches exploit weak, default or stolen passwords. That means four out of five breaches occur through a failure in identity protection.

“Centrify advocates a model of Zero Trust Security which assumes that every user - whether inside or outside the network - is a potential threat, so we verify every user, validate their devices, and limit their access and privilege to what is required to do their jobs,” he says.

“Centrify also uses machine learning to identify risky user behaviour and apply conditional access without impacting user experience.

King says, “Securing identity while still making it easy for employees and partners to do their jobs is the key to delivering cybersecurity and regulatory compliance.”

Symantec releases neural network-integrated USB scanning station
Symantec Industrial Control System Protection Neural helps defend against USB-borne cyber attacks on operational technology.
SingleSource scores R&D grant to explore digital identity over blockchain
Callaghan Innovation has awarded a $318,000 R&D grant to Auckland-based firm SingleSource, a company that applies risk scoring to digital identity.
Ramping up security with next-gen firewalls
The classic firewall lacked the ability to distinguish between different kinds of web traffic.
Spark Lab launches free cybersecurity tool for SMBs
Spark Lab has launched a new tool that it hopes will help New Zealand’s small businesses understand their cybersecurity risks.
Gartner names LogRhythm leader in SIEM solutions
Security teams increasingly need end-to-end SIEM solutions with native options for host- and network-level monitoring.
Cylance makes APIs available in endpoint detection offering
Extensive APIs enable security teams to more efficiently view, enrich, and contextualise real-time intelligence collected at the endpoint to keep systems secure.
SolarWinds adds SDN monitoring support to network management portfolio
SolarWinds announced a broad refresh to its network management portfolio, as well as key enhancements to the Orion Platform. 
JASK prepares for global rollout of their AI-powered ASOC platform
The JASK ASOC platform automates alert investigations, supposedly freeing the SOC analyst to do what machines can’t.