If you’re a sales operations professional, you sit at the crossroads of user access to vital, proprietary information — to applications (whether on premises or cloud), including all those plugins to your CRM system. There’s the interface/integration with your finance system, the customer success app, the technical support app, the integration with channel partners, the business intelligence app, the access you provide third party vendors to assist with management of their app…the list goes on.
If a bad actor gets access to any one entry point, you’re in trouble. Compromised credentials are the number one cause of data breaches, according to data supplied by Mandiant. IT security teams can’t protect users who have too many passwords, too much access and too much privilege.
Here are a few best practices to help assure that your company doesn’t wind up in the news (and you don’t wind up contemplating how to salvage your career)…
- Enforce a single source of identity — everyone logs-in as themselves and are unable to change identity. Users must authenticate to elevate privilege to administer systems.
- Implement multi-factor authentication with single sign-on systems and processes to prevent stale, unused and reused password vulnerabilities.
- Enforce strong password policies.
- Require adaptive multi-factor authentication to access any protected or highly sensitive data — MFA that adapts based on context aware policies: who, when, where, what.
- Restrict privilege — limit user access to only the resources and data necessary to do their job, and with the least amount of privilege required.
- Participate in a continuous compliance policy program across your company. Eliminate the communication silos that exist across disparate teams within your organization. Set clear objectives for who owns what for review. Enforce policies that allow audit results to be published internally.
- Protect data on mobile devices using MDM policies that enable remote lock and wipe.
- Secure remote access for 3rd parties and business partners without using a VPN. VPNs don’t provide granular access and privilege controls.
Unfortunately, when it comes to data breaches today, it’s only a matter of when. And the sales operations team has a pivotal role in protecting the assets of the organization.
Click here to read our best practices paper on strengthening app security.