Kuppinger Cole Virtual Conference
The Three Elements of Access
Governance
Martin Kuppinger, Kuppinger Cole
[email protected]
December 8th, 2009
www.id-conf.com/eic2010
• M
ARKET
M
ATURITY
• R
EGULATION
, P
RIVACY
,
I
NFORMATION
S
ECURITY
• G
OVERNANCE
, M
ITIGATING
R
ISK
• C
LOUD
C
OMPUTING
& T
RUST
• R
OLES AND
A
TTRIBUTES
• A
UTHENTICATION
&
A
UTHORIZATION
C
REATING MORE
V
ALUE FOR LESS THROUGH
I
DENTITY
M
ANAGEMENT
& GRC
Call for Speakers:
Virtual Conference
Enterprise Access Governance
Controlling Access, Ensuring Information Security
www.kuppingercole.com/webinars
D
ECEMBER
8-9, 2009
•
How to efficiently mitigate your “access risks”
•
Full Access Governance– combining access certification, role
management, provisioning, and privileged access
management
•
RBAC vs. ABAC: Comparing Role Based and Attribute based
Access
•
The business view – Enterprise GRC vs. IT-GRC and where
they should be linked
•
Mitigating application security risks
Kuppinger Cole Reports
Some of the current reports:
• Market Report Cloud Computing
• Product Report Radiant Logic Virtual Directory Server
• Vendor Report Arcot Systems
• Product Report Sun Identity Manager
• Vendor Report ActivIdentity
• Trend Report Enterprise Role Management
• Vendor Report Quest Software
• Product Report SailPoint IdentityIQ
• Vendor Report BHOLD 2009
• Vendor Report Entrust 2009
• Vendor Report Oracle 2009
• Vendor Report Evidian
• Business Report Key Risk Indicators
Some guidelines for the
Webinar
You will be muted centrally. You don„t have to
mute/unmute yourself – we can control the
mute/unmute features
We will record the Webinar
Agenda
• The Three Elements of Access
Governance:
Recertification/Attestation – Access
Control – Privileged Access
Access Governance defined
•Access
•Managing access to systems and information – who is allowed to do what? •Governance
•Enforcing a good practice of management – in that case particularly for IT
Access Governance
•Identity and Access Management
•The management of identities and their access
•It„s mainly about access – but we need identities therefore
Context: IAM
•Governance, Risk Management, and Compliance •Governance as the basic concept
•Risk Management and Compliance as elements of Governance
Context: GRC
•Information Security is the business term
•That„s why we mainly deal with topics like IAM and Access Governance
The three elements of Access
Governance
Management
Analysis
The main elements
Analysis
Types of
Accounts
„Standard“
User AdminUser
Attestation and Recertification
Analyzing the situation
The (manual) process of having
responsible persons going
through existing access controls
(authorizations, entitlements)
and attesting or revoking them
Manual control process
Regularly performed at the
departmental manager level
(but be careful on that)
Supported by escalations and
other procedures
The need for attestation
5 good reasons
Attestation is a first step to clean up access controls
Attestation is (if done right) an continuous audit mechanism
Attestation can show issues in identity and access lifecycle
management
Attestation educates users about the need for security
Approaches to attestation
One-way, audit-oriented
Two-way, actionable
Single-layered
Multi-layered
Point-of-time
Continuous
Undifferentiated
Risk-based
Threat:
Multi-layered attestation
System Security
Access Control
Administration
System
Correct Access
Controls?
Identity Management +
System Administration
System Roles
Groups, Roles,
Profiles
Management
Identity
Correct
Assignments?
Identity Management
Business IT +
Business Roles
Location, Project,…
Job, Hierarchy,
Business IT
Correct Business
Roles?
Management +
Business IT
Employees
Tasks, Projects,…
Management
More Analysis
Adding Automated Controls
Automated Controls support the ongoing analysis
and (potentially) the realtime detection of issues
Advanced analysis mechanisms support the ad
hoc analysis
Specific attestation/recertification solutions
typically support at least ad hoc controls
The situation
Increasing
pressure on
IT
management
and
operations
Growing number
of compliance
regulations
Increasing
awareness of the
need of IT
Governance
Increasing
complexity of IT
environments –
breadth and
depth
Changing role of
IT – less
autonomy, more
focus on efficient
fulfillment
The result
More requests
More answers to provide
Less time to deliver
Higher workload for fewer people
The real world of core systems
Many servers Different systems
Different operators, frequently some inconsistency in operations Large amount of data Large amount of controls
The answers to
questions like „what
has Mr. X done
when“ requires
access to different
systems at a
detailed level
strong capabilities
in mapping and
normalizing data
strong analytic
The Reality
Missing auditability
• Few enterprises know them all
Which systems
are out there?
• Sometimes known for central system,
if there is a provisioning tool deployed
(sometimes even via E-SSO)
Which users
have access to
which systems?
• Usually even for core systems like
Active Directory and SAP insufficiently
solved
Which granular
entitlements do
Auditing, SIEM, Operations
Management
System-level
Auditing
SIEM
Operations
Management
Current state and
historical data
Current events,
sometimes historical
Current events
Ex post
Real time
Real time
Security-focused
Security-focused
Operations-focused,
all types of
operational aspects
Mainly access
controls
All types of security
events, frequently
more „classical
security“ than access
controls
Approaches to audit
optimization
Integration
• Define the required elements – less is more • Platforms help – few
platforms are better than many point solutions
• Integrate these elements to support drill-down
Automation
• Focus on automated collection and
Authorization Management
Closing the loop
The different terms – all about the same
• Access Control
• Authorization Management
• Entitlement Management
Authorization Management
• Actively managing access
Authorization Management
Closing the loop
Managing
Authorizations
Analysis and
Multi-layered
Authorization Management
Management of detailed Entitlements (System
and App level, might be XACML based,…)
Assigment of Users to Groups, Roles, Profiles
(Provisioning)
The Reality
Missing consistency
Consistent, centralized Authorization
Management for heterogeneous environments?
Privileged Account Management
Focus on sensitive accounts
Adding privileged accounts
How to control the access of users using
these accounts?
Many terms
One target
• PAM: Privileged Account Management
• PIM: Privileged Identity Management
• PUM: Privileged User Management
• Root Account Management
The
terms
• Controlling privileged accounts and
how they are used
Privileged Accounts
Beyond „root“
• root
PAM
The approaches
Differentiated auditing
of administrative
activities
Integration with
Lifecycle Management
approaches – no
orphaned privileged
accounts
One time passwords
for privileged
accounts
Reduced entitlements
of privileged accounts,
for example using
specialized shells
Organizational actions
Automatic generation
of passwords for
accounts without
interactive logon
Avoiding technical
PAM market
Evolution
Point solutions
PAM suites
Integration with
Identity Lifecycle
Management
Application Security InfrastructuresIdentity Federation, End-to-End Security
Changing Security Models at the System Level (OS,
Maturity Levels of
PAM approaches
Missing
•Status
•No PAM at all •Tools •None •Risk •Very high Ad hoc •Status •Point solutions, typically for UNIX/Linux •Tools •Mainly sudo •Risk •Very high Unplanned •Status •Non coordinated use of point solutions •Tools
