July 2021 Summaries

Mandatory Access Control (MAC) uses a centrally managed model to provide the highest level of security, applying security labels to resources and individuals. Discretionary Access Control (DAC) decentralizes security decisions to resource owners, using access control lists (ACLs). Role-Based Access Control (RBAC) grants access privileges based on the work that individual users do, limiting access to just the resources users need to do their jobs. Privileged Access Management (PAM) is a type of RBAC designed to defend against attacks by giving administrators limited, ephemeral access privileges on an as-needed basis. As companies shift towards more dynamic approaches to access control due to remote and blended workforces, modern solutions like Twingate offer flexible and scalable alternatives to traditional VPN technology that evaluate device posture and trust, location, and behavioral patterns in real-time.

Authentication and authorization are two distinct and required steps in a company's access control process. Authentication verifies user identities, while authorization ensures authenticated users only gain access to specific permitted resources. As network security evolves beyond legacy technologies such as VPN, having a solid understanding of the role each process plays in access control is more important than ever. The article explains the difference between authorization and authentication and discusses their growing roles in modern security approaches such as Zero Trust Networking.

Stuart Loh discusses the Sarbanes-Oxley Act (SOX) and its relevance to IT departments, particularly those preparing for an IPO. SOX is a law that protects investors by improving corporate disclosures, primarily concerned with ensuring the integrity of financial records and reporting. It applies to public companies in the US and their subsidiaries, as well as non-US companies doing business in the US. SOX compliance is mandatory, requiring annual audits by independent auditors and personal certification from principal officers. The finance department, led by the CFO, is typically responsible for managing SOX compliance. However, information security is not specifically discussed by SOX, but internal controls must cover infosec controls due to technology systems' reliance on them. Twingate is a secure access solution that simplifies and automates implementing modern and secure access controls, including Identity-First Networking, least privilege access, Zero Trust, logging, monitoring, quick deployment, easy maintenance, and hiding private networks from the public internet.