Webcast, April 12: Automating User Provisioning, A User’s Perspective

User provisioning solutions offer tangible, often quantifiable, benefits. A Forrester Study* based on data from 4 customers concluded an ROI of over 200% and net cost savings of over $8M over 3 years post implementation of Oracle Identity Manager, Oracle’s user provisioning solution.  Additional benefits seen were around improved security and a tremendous boost in user productivity.


Join this FREE webcast to find out how Educational Testing Service (ETS), a private nonprofit organization devoted to educational measurement and research, is leveraging Oracle Identity Manager to meet its user administration needs. Hear first-hand from your peer how you can improve security and user productivity in your organization while reducing IT administration, helpdesk and other overhead costs at the same time.

More Here

Courtesy:http://identigov.wordpress.com/2011/04/07/webcast-april-12-automating-user-provisioning-a-users-perspective/

More about → Webcast, April 12: Automating User Provisioning, A User’s Perspective

Human Behavior = Biggest Security Risk

Two quick examples (both considered 'spear phishing' or targeted phishing attacks) from today's headlines:

1. The perpetrators of the RSA data breach which may have compromised the security of RSA's premium two-factor authentication solution, as it turns out, got help from RSA employees when they opened an email attachment. An Excel spreadsheet containing an Adobe Flash exploit opened the doors to RSA's network.

2. Conde Nast recently paid $8 Million to a fake company in response to a single believeable email that
asked them politely to update their payee information on one of their vendors.






Both of these examples make the clear, simple point that it doesn't really matter how much technology you put between an attacker and your business assets. If an employee opens the door, they can walk right in. We're either going to get extreme in terms of limiting behavioral options (disallow all email attachments?) or we need to do much better in employee training.

More Here

Courtesy:http://360tek.blogspot.com/

More about → Human Behavior = Biggest Security Risk

Cloud Identity Management: CSC and Symplified Partner Up

Access and identity management remains one of the hottest topics in cloud computing, as developers, vendors, and service providers alike race to find answers to the lingering questions around the SaaS model. Enter Government- and large enterprise-focused systems integrator Computer Sciences Corp., which has partnered with security specialist Symplified for CSC CloudIAM, a solution to extend existing customer credential stores to the cloud.
Here are the major benefits of the Symplified-powered CloudIAM identity and access management (or “IAM,”  get it?) solution in convenient bullet-point form, taken directly from CSC’s press release:

• Providing [a single sign-on (SSO)] experience to employees that maintains control over user credentials.
• Controlling access to applications based on individual employee functions.
•  
• Providing automated on-boarding and off-boarding to improve efficiency and eliminate security holes when employees are hired and depart the company.
• The ability to quickly and efficiently respond to requests for detailed access logs for SaaS applications to meet compliance auditing requirements.

This product is a potential fit for CSC’s customer base, especially cosnidering all the chatter around security in the cloud.

More Here

Courtesy:http://www.talkincloud.com/cloud-identity-management-csc-and-symplified-partner-up/

More about → Cloud Identity Management: CSC and Symplified Partner Up

Business booming for cyber criminals: security firm

Cyber criminals are selling stolen credit card details for as little as two dollars each and renting computer networks for spam for 15 dollars as part of a vast online black market, according to a report released Thursday.
PandaLabs, the anti-malware laboratory of computer security company Panda Security, published the various prices for cyber crime-related products after conducting an undercover investigation into online crime networks.

"This is a rapidly growing industry and cyber-criminals are aiding and abetting each other's efforts to steal personal information for financial profit," PandaLabs said.

"PandaLabs discovered a vast network selling stolen bank details along with other types of products in forums and more than 50 dedicated online stores."

The computer security firm said cyber criminals had diversified from stolen bank and credit card details to a "much broader range of hacked confidential information" including log-ins, passwords, fake credit cards and other data.

"Since anonymity is of the utmost importance, many sellers use underground forums to keep out of sight," PandaLabs said. "Their offices are effectively the Internet.

"Some are more brazen about their activities, and have accounts on Facebook and Twitter which they use as shop windows."

PandaLabs said a credit card number or bank account details can be purchased for two dollars but that does not include any information on the available credit line or bank balance.

"The price increases to 80 dollars for smaller bank balances and upwards of 700 dollars to access accounts with a guaranteed balance of 82,000 dollars," it said.

PandaLabs said the price for rental of a botnet, a network of infected computers, for sending spam or other purposes begins at 15 dollars.

More Here

Courtesy:http://news.yahoo.com/s/afp/20110120/ts_alt_afp/usitcomputersecuritycrimepandalabs;_ylt=Aop13UJrRqGYRwjBxySuVgmDzdAF;_ylu=X3oDMTNhampnYjdzBGFzc2V0A2FmcC8yMDExMDEyMC91c2l0Y29tcHV0ZXJzZWN1cml0eWNyaW1lcGFuZGFsYWJzBHBvcwMxNgRzZWMDeW5fcGFnaW5hdGVfc3VtbWFyeV9saXN0BHNsawNidXNpbmVzc2Jvb20-

More about → Business booming for cyber criminals: security firm

Identity Management Journey Defined

Organisations can typically be defined by the stages of Identity Management they have gone through. This identification tag can be used to predict both the current pain points as well as expected future pain points. I thought it would be an interesting exercise to have a look at one view of what these stages might look like.


Stage 1 – Directory


This is the stage where attributes mean everything. Organisations are grappling with how and where to store attributes, how to keep attributes accurate, how to stop the proliferation of attributes and how to manage them. It is also the most sensitive issue both in relation to privacy and ownership. Privacy from the point of view that users want their information to be kept secure and ownership from the perspective of inter-departmental arguments over who has the ‘right’ attribute and who can access it. eDirectory, Active Directory and Sun Directory are the main players from vendor land and additional tooling can include load balancing, proxy servers and management tools.


Stage 1a – Meta Directory


Worth a special mention but not its own fully fledged stage is the Meta Directory phase where everyone madly rushed to uber- directories with the dream of having all attributes stored in a single location for ease of management and access. Ah what a dream!! CRASH…..yep not really a good idea and very hard to control. Political nightmares, legal nightmares, compliance nightmares……and the nightmares go on. Meta directories were the answer to this, create another location to reference the attributes actual location. In principal the right idea and with the advent of the virtual directory technologies, a light weight set of pointers if you like, this is today a valid way to have the dream in a virtual manner without actually relocating the attributes. Lesson learned here are that attributes belong where the are, HR attribute should stay with HR system etc…


Stage 2 – Access Management


Single sign on gives way to simplified sign on (what a security nightmare single sign on could be) as organisations look to use the attributes to manage access to applications and services. This stage is about defining policies about users access, getting rid of a yes/no answer to access and allowing a more flexible ‘yes you can under these conditions’ or ‘based on current conditions I give you access to this, if you want more provide more’. The attributes from stage 1 are authenticated using a range of security methods from username/password to biometrics, and the authentication used as a decision for authorisation of access to the applications and services. The key players include Oracle, Sun Access Manager, IBM TAM and CA Siteminder. I would also give a special call out mention to Open SSO and open source equivalent that is looking very promising with simplification and ease of use be core drivers.


Stage 2b – Federation


Another sub-stage worth pointing out is Federation, or the ability to make identities portable. Federation is access management applied to identities that exist in other domains. So its about how you can accept an authenticated identity from a trusted third party and make policy decisions based on a trusted third parties credentials without re-authentication.

The lesson of stage 2 is that the attributes, the authentication and the authorisation should all remain separate. Attributes belong with the owner of the identity, authentication should be done by whoever the user trusts and authorisation belongs to the owner of the application or service. That way the gatekeeper of the application can say ‘based on who you are (attributes), with what credentials and who/when you got them from (authentication) I will grant you access to X level (authorisation).


Stage 3 – Provisioning


The stage where most organisations have matured to is the automation of provisioning. The work flow piece that allows life-cycle management of a user and the adding, editing and deleting of application accounts from a single point. This stage provides real business value in efficiencies, security and service delivery but is very difficult to achieve without the first two stages under control. The big players again are Novell, IBM, Sun and Oracle, all of who can do the task at hand with competant product. The key in this space is implementation, getting the right partner with the right approach is critical …..for a hint see previous blog on Identity Management in 90 days.. The lessons we learn here are that roles are plentiful and difficult to manage…..


Stage 4 – Roles and Compliance


Debate could rage over whether this is one or two stages, for now it seems the market views them as one but I suspect over time they will break into two distinct stages. This stage is about identifying roles and managing compliance of things like separation of duties and role based provisioning methods. Its a very tangible ROI and there are some simple quick wins that can be done in a reasonable time frame with a minimal budget to get great results such as just being able to see who has access to what applications in your organisation…. The market in this space is still consolidating so is a bit of a moving target in relation to main players with acquisitions on the go constantly. At a basic level there is directory based role management with Microsoft and the like but at the high value end of the market is where the real returns are such as Sun Role Manager (ex-Vauu), Oracle (Bridgestream), the more recently CA aquired Eurekify and the niche stand-alone’s SailPoint and Aveksa.


These stages are largely played out in the order they appear here. This is due to the fact that each was born out of the complexities and lessons of the previous on. For example role management arose powerfully on the back of provisioning because for provisioning to be automated and value maximised, role must be known and manageable.


A footnote to this however, of late I have noticed many organisations skipping the provisioning stage to do roles and compliance first. I think there are two reasons for this, firstly the pain of roles during provisioning is profound and now quite well known and secondly roles and compliance can add immediate value without having done the previous stage. It may be over the next 12 months that we see these two stages swap places in the preferred order of the journey.


Now here is the clincher…….put the stages together in summary and I believe you get one of the better definitions of Identity management. Here is my take:


* To create a single view of a user, using accurate and authorative attributes wherever they live. Use these attributes to create policies and then provision and police access to applications and services in a secure and compliant fashion. Lastly its important to provide the tools, processes and governance that automate and manage the life-cycle of the users, roles and policies over time.

More Here

Courtesy:http://passthesource.wordpress.com/

More about → Identity Management Journey Defined

Identity and Access Management – Important for a Growing Company

Go and ask some of best IT professionals about Identity Management, surely you will be flooded by hundreds of different answers. To be honest that you will get thousand new replies. We should not make this complex. Consider that identity management as an agency. Every employee cannot access every facilities or cannot go into every rooms but they can access which is permissible to him. But in some cases that even not allowed. They should have a perticuler key to access perticuler rooms..

Likewise, a computer network is like the agency, and every agency room exemplifies a file or some application on that network. The employees working in the agency are the users. The keys are the access cards that the executive circulates to each employee on the network. The keys also define what an users can do while accessing a file or application.

Similar to the agency security system, identity management is the most fundamental kind of data protection that the big agencies and companies utilise.

**Usability of Password
Identity Management doesn’t mean only to give some user the permission to log in;
identity management operates on the user accesibility just like to raise an alarm against some unauthorised person. Put Differently, An administrator puts some certification like an identity number to each of his workers. That identity number gives the worker access to the network and controls what services are to be acquirable. That identity number can also alarm the executive if the user is using forbidden regions. Security personnel are also conscious of activities that could trigger an alert set on actions that point a person is trying access into proscribed domains.
In its standard figure, identity management expects a user to insert a username and password. Furthermore, identity managementcontains the exact science process to identify a user, as well as to approve/deny access to resources within an organization or agency.
Find out more on GRC Framework- Find Out Some Handful Information
 

More Here

Courtesy:http://houston9burks.wordpress.com/2010/03/15/identity-and-access-management-important-for-a-growing-company/

More about → Identity and Access Management – Important for a Growing Company

Identity Management and Federated ILM

Had of course heard the term Identity Lifecycle Management, and understood that it had something to do with centralizing and helping users manage identities across systems and all that jazz. Any IT jock or person involved in Technology should understand (and hopefully does) that Identity Management is probably the most integral part of any system. Hell, even with anonymous systems it still uses a form of identity management because these systems must be ‘administered’ by someone and that someone has an identity for use with that system.

So I decided to look a little more into it, and to say I am impressed by the solutions and ideas that people have come up with in relation to Identity Lifecycle Management solutions would be definitive understatement. I believe the best term for how impressed I am by this would be at the ‘totally freaking wicked awesome’ level. I know.. I am excitable, but seriously if you haven’t ever really read about or looked into Identity Management or Identity Lifecycle Management (which will be referred to as ILM from this point onward in this post) follow along with me here.

The concept of Identity Management is pretty simple. You have an identity. Everyone using any system of any sort uses an identity when they interact with that system. This could be an anonymous user (which uses an anonymous identity) or an identity that has information about who you are. The most common systems for this would be forms authentication running of a user store (let’s say… sql database for an example) or Active Directory if you are working with Windows, or whatever Linux and those other systems use for Identity Management.

So what’s the big deal? The fact that everything nowadays requires you to submit your identity. Think of the internet (big I know) and how you visit different sites and register or login (facebook, myspace are pretty popular so lets use them as an example). When you login it uses your profile information in a number of ways, presenting the information you want to see, who you are, who you might be associated with and other things. All of this of course comes down to being associated with your ‘identity’.

In a nutshell Identity Management provides you with more cability to manage identities. This can be in the form of policies, provisioning, workflows, or reducing ‘sign in’ needs.

So what’s cool? The whole federated identity management stuff and how far some groups have come with these systems.

So what is federated identity management? Exactly what the term sounds like unionizing, or bringing together these identity management. Let’s take a simple example. Your organization has AD and maybe an intranet. You login to the intranet and navigate to your benefits area. When you click on a link in the intranet to the benefits area it actually uses federated identity management to communicate who you are and (since your already authenticated) does not prompt you. The information it presents you with is based on your identity which has been passed onto and associated with the benefits system’s identity store.

This isn’t a new concept or anything, but what fascinated me was when I actually played with one of these systems (in my case Microsoft Identity Lifecycle Manager (the new beta)), it was how the interface was set up, and how it honestly was like something out of my dreams.

I have seen a great many different AD’s in my day and have wrote applications that integrated with PeopleSoft or other systems for identity management. Many of them had problems and issues, weren’t well maintained, or were structured poorly. This causes all sorts of issues when you are trying to implement systems like SharePoint 2007 because now you cannot rely on having organizational hiearchy (as an example) being available to you for audience targeting. Take that one step further and many of the clients I have worked with use many different user stores, or work directly with groups that have their own user stores.

It’s the way the world works, I evangelize and advocate SharePoint, another person sells their custom app and so on until there are a plethora of different systems that all use different identity stores.

With a tool like Microsoft’s Identity Lifecycle Manager it removes so many of the issues I would run into on a regular basis trying to either replace, or integrate the existing systems. That’s not to say you don’t have plenty of alternatives (single sign on is a good one), but seeing many systems so well integrated and being so easy to manage and synchronize made me fully understand the power (and obvious effort) these ISV’s and organizations solution’s provide.

Looking forward to learning more about the whole ILM marketplace,
Richard Harbridge
P.S – Here’s some examples of solutions which fall under Identity Management and ILM…
Management of identities

• Provisioning/De-provisioning of accounts
• Workflow automation
• Delegated administration
• Password synchronization
• Self-service password reset

Access control

• Policy-based access control
• Enterprise/Legacy single sign-on (SSO)
• Web single sign-on (SeoS)
• Reduced sign-on

Directory services

• Identity repository (directory services for the administration of user account attributes)
• Metadata replication/Synchronization
• Directory virtualization (Virtual directory)
• e-Business scale directory systems
• Next-generation systems – Composite Adaptive Directory Services (CADS) and CADS SDP

Other categories

• Role-based access control (RBAC)
• Federation of user access rights on web applications across otherwise untrusted networks
• Directory-enabled networking and 802.1X EAP

Standards initiatives

• Security Assertion Markup Language (SAML)
• Liberty Alliance — A consortium promoting federated identity management
• Shibboleth (Internet2) — Identity standards targeted towards educational environments
• Abriva — Free mobile identity management framwork

 

More Here

Courtesy:http://projectanalysis.wordpress.com/2008/10/02/identity-management-and-federated-identity-management/

More about → Identity Management and Federated ILM