How does miniOrange help organizations to comply with NYDFS Cyber Security Guidelines?

What is the 23 NYCRR Part 500?

The NYDFS CyberSecurity Regulation Guidelines, released on March 1 2017, are a set of regulations from the New York Department of Financial Services that places new cybersecurity requirements on financial institutions. These new guidelines under 23 NYCRR Part 500 affected licensed lenders, state-chartered banks, trust companies, service contract providers, private bankers, mortgage companies, insurance firms doing business in New York, non-U.S. banks licensed to operate in New York, and many other organizations, which now have to comply with these additional Cybersecurity Requirements.

These NYDFS Cybersecurity guidelines focus more on a cybersecurity program risk assessment which determines an entity’s best practices and policies to mitigate security risks. Identity and Access Management (IAM) in the form of Multi-Factor Authentication (MFA) or equivalent measures, is now required by the NYDFS. Specifically, section 500.1 defines MFA as follows:

“Multi-Factor Authentication means authentication through verification of at least two of the following types of authentication factors: (1) Knowledge factors, such as a password; or (2) Possession factors, such as a token or text message on a mobile phone; or (3) Inherence factors, such as a biometric characteristic.”

Additional sections that are pertinent to effective IAM include:
“Risk-Based Authentication means any risk-based system of authentication that detects anomalies or changes in the normal use patterns of a Person and requires additional verification of the Person’s identity when such deviations or changes are detected, such as through the use of challenge questions.”

NYDFS also describes how each Covered Entity needs to implement and maintain cybersecurity regulation policies. One of the areas explicitly covered as part of the cybersecurity policies relates to access controls and identity management. Covered Entities must prove they have effective IAM measures in place to eliminate or reduce unauthorized access to sensitive information by hackers, phishers, insiders, or third parties.

According to these new cybersecurity guidelines by the NYDFS, IAM becomes the most important factor to protect huge customer and business information. So implementing MFA, Lifecycle Management and other solutions can help organizations to ensure that they comply with these new guidelines.

Why is 23 NYCRR Part 500 needed?

To prevent data breaches, cyber security threats & unauthorized access. These cybersecurity guidelines help organizations secure their environment from different cyber security threats to protect all types of data.

How can miniOrange help you?

miniOrange provides Identity and Access Management services quickly for the management of information such as users, organizations, devices, services, etc., and in a very cost-effective manner to its customers.

With miniOrange IAM systems, you do not need to worry about administrative overheads. We provide IAM services, which take care of your security, administrative, access management and help you focus on your core business.

• The identity and access management policy, including the responsibilities and accountabilities, should be defined, approved, and implemented.
  • An Identity and access management solution which is highly flexible to fit into any organization’s policy or workflow as per the customer requirements and existing setup.
  • Centralized, simple management and synchronization of identities for users, devices, and things. Can integrate with any system and enhance authentication and authorization capabilities with multiple protocols and connectors for web apps, mobile apps, thick-client applications, etc. Highly flexible and therefore able to fit almost any use case.

• Compliance with the identity and access policy should be monitored.
  • miniOrange generates real-time reports for high-level usage summary, per user summary, user authentication, active usage report, etc. to monitor the user activities across the applications.
  • Logs are saved for monitoring, debugging issues, recovery, etc. miniOrange can integrate with your SIEM tools for real-time monitoring of the organization’s Information security systems.

• The effectiveness of the cybersecurity controls within the identity and access management policy should be measured and periodically evaluated.
  • All users are given controlled access to the applications with the help of multi-factor authentication during Single Sign-on. miniOrange provides multiple parameters for adaptive authentication such as restriction based on IP, device, location, time for proper evaluation of user before giving access.
  • The administrator can receive updates/ alerts for any behavior change of the user.
  • You can create multiple groups for different levels of users and have access policies depending on the groups. Any new user can be added to the appropriate groups and he will be provisioned to the allowed application of that specific group.
  • Any inappropriate access can be easily revoked at any point in time.

• The identity and access management policy should include
  • business requirements for access control (i.e., need-to-have and need-to-know);
    • You can create user/group access policies for your applications based on the role and requirements of each user/group.
    • Users can access their respective applications with one click from the miniOrange dashboard without having to log in every time.
  • User access management (e.g., joiners, movers, leavers):
    • Users can be added to the system with any of the following methods –
      • Manual addition of Users/Vendors.
      • Bulk upload of users and groups using the CSV upload method.
      • Connect to your existing Identity provider ( eg. Okta, OneLogin, Keycloak, ADFS, etc.)
      • Connect to AD/LDAP
      • Use your existing database as an identity store ( My-SQL, MS-SQL, etc.)
      • Provision your users through your HR management system.

• To streamline the process of assigning and managing the user access rights, miniOrange provides an automated user access management system. This will aid in time management and allow administrators to take faster and quick action against any security breaches and prevent improper user activity.centralization of the identity and access management function;

• Provisioning and Deprovisioning are handled in one place using a centralized identity and access management system. IT resources are centrally controlled with miniOrange IAM services, and users can access all apps and tools from a single dashboard with the convenience of a single sign-on. Click to learn more multi-factor authentication for sensitive and critical systems and profiles;

• miniOrange provides 15+ authentication methods and solutions for various use cases. This additional layer prevents unauthorized persons from the resources, even if they know your username and password, thus protecting sensitive and critical information. Click to learn more. privileged and remote access management, which should address:
  • the allocation and restricted use of privileged and remote access, specifying:
    • multi-factor authentication should be used for all remote access;
      • MFA provides an extra layer of security for remote access. MFA for remote access will prevent unauthorized individuals from accessing critical data while also improving the organization’s overall security strategy.multi-factor authentication should be used for privilege access on critical systems based on a risk assessment;

miniOrange provides the facility of multi-factor authentication to be used on privileged access. This secures your repositories, logs, and administrator account by ensuring that only authorized workers have access to your privileged account passwords.