User and access management in Cloud applications – a challenge

It appears that ‘the cloud’ continues to expand within the commercial world. Google Apps, Salesforce.com, GoToMeeting, Office 365, itslearning, etc. are all being widely deployed. Controlling who has access to specific applications and corresponding data is even more complicated with cloud applications. Providers of cloud solutions confer little priority to developing better management of user accounts and access rights in their applications. Consequently, user and access management in cloud applications entails a number of challenges:  

1. Federation is not a replacement for provisioning - Working with cloud applications means more authentication sources; Active Directory in one’s own corporate network and one or more authentication sources, for example AD, LDAP directory or database in the cloud. There are only a few possibilities for synchronizing user accounts between both authentication sources, (like AD Federation Services from Microsoft and the SAML standard. In this manner, end-users can log in transparently to the cloud applications. However, federation is not a replacement for provisioning and basic user account management.
2. Too many manual actions - Providers who do not support federation frequently offer a web-browser that managers can use to control access to the cloud application directly. This necessitates a sequence of manual operations and is time-consuming and error-prone. Also, when it’s possible to import a basic CSV file into the cloud application, it still requires manual intervention by the application manager. 
3. Different conventions for naming and passwords  - Conventions governing naming standards and passwords are often inconsistent between network and cloud applications. In the network, a user ID might be based on the log-in name, and in the cloud it might be the e-mail address. This complicates exchanging user account details between the environments, and many times, differences also apply to password conventions. When extremely complex passwords are required in the corporate network, cloud applications might not be able to handle this type of password. The possibility also exists that the cloud application requires a different duration for password expiration than within the corporate network. 
4. Missing organizational structure  - The reporting hierarchy structure within an organization is often utilized to assign authorizations to employees based on their role or position, commonly referred to as Role Based Access Control (RBAC). Within the corporate network this structure is contained in an HR system or within Active Directory. Cloud applications normally cannot translate this organizational structure, and the web based provisioning functionality they offer does not offer a robust method for incorporating this level of detail. Naturally, it is possible to transfer the entire organizational structure to the cloud application, but this requires an enormous volume of management activity when something in the hierarchy changes. 
5. What if the connection drops? - Providers who offer links between the network and cloud applications often use event-based synchronization between the systems. However, they do not have a procedure in place to deal with a temporary drop in the connection. Cloud applications do not provide any guarantee or notification that synchronization completed successfully.
6. Reject bulk actions - Performing bulk actions in cloud applications is occasionally rejected by the application. Some cloud applications which impose restrictions on the number of actions that can be carried out in one pass, or require that no management activities are undertaken during working hours to prevent overloads on their network.

Working with cloud applications generally means that organizations no longer have user and access management in their own hands, and that the rules and SLAs of the cloud applications apply. User and access management are of secondary importance to business requirements. If it is requisite for your organization to have control of user and access management, Tools4ever can help you.

Tools4ever acknowledged that the migration of applications to the cloud would bring new challenges in the field of user and account management. With this in mind, Tools4ever developed links (connectors) that offer the following functionality:

• Password synchronization. If a password is changed in Active Directory, this change will be automatically implemented (synchronized) in the cloud application;
• Auto provisioning of user accounts linked to UMRA's proprietary user account management process, ensures synchronization of user accounts for employees through the HR system, as well as any changes made by the helpdesk, managers and even end users. User accounts are created, modified, enabled, disabled and removed etc. in a completely automated way;
•  Integrated access management from the end users to the cloud application. Accesses to various components of the cloud application are assigned/revoked on the basis of the end user's organizational role. UMRA features an advanced RBAC module that controls access to the cloud application on the basis of the department/job title in the HR system, as well as the choices that managers have made for their employees;
• A centralized dashboard that provides IT managers with an overview of the cloud applications deployed by each user. The dashboard can be used to control the license costs as well as for logging and reporting purposes;
• Single Sign On for all cloud and web applications based on existing Active Directory credentials. This means that users are no longer required to remember a host of user names and passwords.

For additional information or to download one of our solutions , please visit our website. 

Customer Satisfaction and Password Resets

Two recent customers of Tools4ever, a bank and a car dealership, brought to light a new value proposition of our password management solutions that I had not previously thought of.  In both cases, these clients have a great number of employees that spend the majority of their time interacting with clients.  Can you imagine a client’s frustration if a bank teller needed to wait on hold for 10-15 minutes to get the helpdesk online to reset a password? Worse yet, what if it was a Saturday and the helpdesk was unavailable, how much productivity would be lost?

Both of these organizations turned to Tools4ever for assistance. In the case of the bank, they were receiving 3-5 calls per day for password resets. By implementing Self Service Reset Password Manager (SSRPM) and Enterprise Single Sign On Manager (ESSOM), they were able to drive that number to virtually zero calls.  ESSOM reduces the number of credentials a user needs to remember down to one and SSRPM allows self-service should the employee forget that set. 

The auto dealership had an SSO solution that was being phased out by the vendor and support was coming to an end.  They knew the calls to the helpdesk would increase dramatically as users would go from 1 set of credentials to needing to remember between 5 and 10. Implementing the Tools4ever ESSOM solution fit the bill. All of their dealer and financial applications were easily accommodated. Taking it one step further, all employees were “pre-enrolled” into ESSOM. Their user names and password were entered into the database and encrypted. This means the end user never even are made aware of what their credentials are for the various applications. If some leaves, shutting off their ESSOM profile prevents access into any application.

I am always amazed at the new ways our customers find to utilize our products to increase productivity and, in this case, help insure their customers have a more positive experience.  For more information, please visit our website.

Password Synch versus Single Sign On

In many implementations of our Self Service Reset Password Manager (SSRPM), a client will request that we send the new password to several other applications.  On the surface, this seems like a simple request and a function that our product is certainly capable of providing. Once you delve deeper there are a number of mitigating factors that need to be considered:

• Are user names the same across all systems? If yes, implementing is easy. If no, a translation table will need to be built up to make sure JDOE in system 1 is equal to John_Doe in system 2 and DOEJ in system 3 and so on.
• Are password complexity rules the same in all systems? If yes, implementing is easy. If no, the most complex password requirement now becomes the defacto standard. Special character restrictions can also become an issue.
• What happens if System B is unavailable when the synch occurs? A password storage vault and error handling need to implemented to insure a reset can occur when the system becomes available. 
• While SSPRM addresses forgotten passwords, how do we handle capture password changes and synch them?

While Tools4ever has the products (PSM and PCM) and expertise to address these issues, there needs to be a determination of feasibility and reliability. This determination directly corresponds to the number of systems that need to be synched. Sending password resets to 2 or 3 systems, in addition to Active Directory is a complex requirements but entirely feasible. 

When the number of systems expands much beyond that, the recommendation would be to lean towards a Single Sign On (SSO) solution that eliminates all of the issues above.  SSO can capture and cache all credentials for any number of systems making the synch unnecessary. All users need to remember is one set of credential; their AD username and password. SSO can handle password resets automatically for all systems and complexity rules are a non-issue as they are addressed at the application level.

For more information, please visit our website.

Workflow and Identity Management

One topic we seem to running across with increased regularity is employees starting work before they are actually entered into the HR system. When this occurs, completely automating the user account creation breaks down. The employee will need access to the network, email and applications on their first day but HR can have a lag of a few days to a few weeks before all information is compiled, approved and entered into the HR system.

To resolve this issue, we have several creative methods to insure the employee has what he or she needs to be productive on Day 1. In at one recent customer install, we implemented Web forms to allow a hiring manager to start the user account lifecycle process. Basic information, such as name, department and title are entered into the web form. From there an automated workflow process takes over and routes system access request to the appropriate individuals.  As approvals are granted, the system automatically creates the accounts in Active Directory, Office 365 and several other systems based on the user requirements. This process insures the new employee has what they need on their first day of work.

Once the automated process detects the user is added to the HR system, a synching process occurs and adds other relevant information to the Active Directory such as employee number, address, office location and cell number. The automated process also detects changes in employee status such as departmental transfers and takes appropriate actions to re-provision access as appropriate. The HR system also feeds termination dates to the User Management application to insure access is disabled. The HR team and managers also have a web form where they can mark an employee terminated immediately insuring that access to the network is revoked instantaneously.
To learn more about utilizing the Tools4ever User Management solution to delegate account creation responsibilities, please visit our website.

Who is it?

The majority of calls received by the IT helpdesk require caller verification. After all, the helpdesk agent will want to be certain the caller is who they claim to be before granting access privileges to sensitive business applications. But how can helpdesk agents determine the identity of end users?

Many organizations require a physical form of identification in order for the helpdesk to make changes. For instance, employees will be asked to provide a document signed by their manager or a copy of their identification before being assigned any privileges. On the other hand, faster approaches, such as a simple call to the helpdesk, often involve too many risks.

In response to these challenges, Tools4ever has developed Helpdesk Caller ID Verification. This solution offers a simple mechanism for determining a caller’s identity. To this end, the caller will first be prompted to provide answers to a series of personal questions, such as “What is your mother’s maiden name?” Thanks to the use of an intelligent technique, the helpdesk agent will not see the answer to the question, but only parts of the answer (e.g. the first and last characters). The helpdesk agent will subsequently ask the caller which characters have to be entered.

Helpdesk Caller ID Verification does not require any additional hardware, making it a cost-efficient, easy to implement solution. This means organizations can easily verify the identity of callers in a secure fashion.

For more information, please visit our Website.

HOW TO INTRODUCE STRONG PASSWORDS : THREE SIMPLE STEPS

More and more organizations and IT departments need to introduce password complexity. Implementing strong passwords that have to change regularly is not easy, and can get a lot of resistance from the end users, or generate unnecessary helpdesk calls. Here are three simple tools to help you introduce complex passwords in your organization:

1.Password Self-Service:
In order to reduce the number of helpdesk calls that are password related, make users autonomous on the management and recovery of their passwords. Results: less password reset calls, 24x7 service, increased security (helpdesk identification)SSRPM (Self-Service Reset Password Manager) by Tools4ever is a good tool allowing for password resets through security questions or strong SMS authentication.

2. Reduce the number of Passwords that users have:
Naturally the more passwords users have to manage the more they will resist to strong password policies. Introduce a tool that reduces the number of passwords.

Results: decreased number of passwords = user comfort

With Single Sign-On tools like Tools4ever’s E-SSOM (Single Sign –On Manager) it is possible to reduce the number of logins and password combinations to just one, and eliminate about 3 to 5 password logon combinations per day.

3.Help users creating strong passwords through a password creation wizard.
In order for users to not get frustrated when creating their new strong password, they may need some assistance. A simple windows integrated tool can assist users while creating their password, showing the complexity rules and flagging each requirement as it is fulfilled.

Results: Users can create strong passwords instantly without getting unclear Windows error messages.

A tool that assists users in creating strong passwords according to the company’s own rules is reset calls, 24x7 service, increased security (helpdesk identification)PCM (Password Complexity Manager). It is extremely user friendly and integrates seamlessly into the user environment.

If you have more questions on introducing complex passwords don’t hesitate to contact us.

Related to:

• Strong passwords


• Active directory password


• Password reset


• Password self-service


• Complex passwords


• Single sign on


• Password synchronization

ACCESS MANAGEMENT AND SOX COMPLIANCY/AUDIT

When talking with IT management on Identity and Access Management issues, we regularly meet companies that have to be compliant with SOX regulations. This usually has a big impact on the organization of processes, but also on the IT department, especially concerning the management of access rights. Three of the most common issues are:

Workflow and validations on access rights:
Whether it concerns a regular active directory user accounts, NTFS rights, active directory groups, e-mail or application authorizations, all the requests and validations have to comply with the SOX regulations which may mean that in order to create one user account the IT department needs the signature of the requester, the validating manager and the IT director.

We have seen companies where this process was entirely managed by paper driven processes, and each time at a SOX audit, the IT department would spend weeks of digging through the papers with the auditor. An automated workflow system such as UMRA (User Management Resource Administrator), can automate the
se validation steps and make the SOX audit a piece of cake for the IT department.
Instead of papers getting lost in the process and having people waiting for their access rights UMRA will automatically alert the right validators who with a simple action can validate a request before it is sent automatically to the next validator or IT for granting.

Traceability:
Naturally all requests for access and granting of access should be traceable in the identity and access management solution. This is a standard feature of the Tools4ever Identity and Access Management suite.

Segregation of Duty:
This aspect of SOX compliancy requires that certain tasks cannot be performed by one and the same person. For example an order may be placed by person X but this should be validated by person Y. This can have consequences for access management, in the sense that it requires the access to certain data, or the access rights within an application must be tightly controlled.

In terms of access management and authorization management this means that the access management system must block or alert whenever two of such authorizations are being granted to one and the same user. This is easy to realize with the reporting and provisioning mechanisms in the Tools4ever identity and access management solutions. We only have to know which of the authorizations cannot be combined and then the solution will manage and audit the requirement automatically.

Feel free to contact your Tools4ever. office if you have any questions about SOX compliancy, and Access Management workflows.