We are all aware of the potential security risks organizations face when they don’t properly disable or delete network accounts when users leave an organization. If former users still have access to customer data and sensitive internal systems, then there is great potential for them to wreak havoc on the file systems.
Most businesses attempt to take immediate steps to prevent this type of action when an employee is terminated or leaves of their own volition, but some do not. However, even if security is not an issue or if there is no concern, there is one very important issue that is often overlooked: the costs associated with not disabling accounts, licensed applications, and cloud-based solutions.
Costs to Company
Take, for instance, Office 365, the increasingly popular solution from Microsoft for hosted email and the Office productivity suite. Costs typically range from $4-$20 per user per month for business clients. Another example is Salesforce.com, another popular web-based CRM application, which ranges from $65-$250 per user per month. Still other applications, such as Sales Genie or Hoovers, have costs associated with downloading a record or creating an email address. All of this adds up to huge expenses for companies.
Next, if we take a look at a company with 1,000 employees (you can scale this example to your own business size) and assume an annual turnover rate of 10%, 100 employees leave on an annual basis. If that company has one cloud-based application averaging $30 per user per month and it takes three months to process all the terminated employees out of all systems, the cost to the company is $9,000.
Obviously, the more subscription-based applications, the longer it can take to deactivate accounts. The more employees and the higher the turnover rate, the greater the potential costs to the subscribing company. This can lead to a great amount of money lost over time. Over three years, this adds up to about $27,000, money that could have surely been used to help in other areas of the company.
In a 2010 study conducted by IDC, results showed that between 25% and 75% of licenses for enterprise applications are either unused or underused. A huge part of this is most likely due to employees who are no longer with the company but still have an active account.
Security
Now, if the application in question has a cost associated with downloading records, the costs to an organization can be tremendous. A recent conversation with a sales manager brought this point into focus, stating that a recently terminated sales rep did not have his access to a lead-generation database revoked until nearly six months following termination. In that time, the one former employee was able to download nearly 15,000 records at a total cost of $7,500 to the company. In any organization with a high sales turnover, this cost can be astronomical.
Another area where licensing costs can come into play is with network-based applications that are licensed on a per-user basis. Very often, applications like Visio, Photoshop, and others are licensed for a large number of users and access rights to these applications are based on group memberships in an active directory. In a similar vein to cloud-based solutions, if a user is not removed from a group that allows access to one of these applications, it is possible that the company could run out of licenses and need to buy more.
This also is true when a current employee is transferred to a new role. As an example, a graphics designer accessing Photoshop is transferred to a managerial role. When the transfer occurs, the rights to the application remain intact because of a lack of communication between the human resources department and the IT group. The manager no longer needs access to Photoshop, but when a new designer is hired, a new license must be purchased.
Solution
In the above cases, proper controls via an automated identity management solution can easily solve these issues by revoking access rights for all employees within an organization, freeing up licenses and minimizing additional and unnecessary expenses. Many solutions are now commercially available to automate the life-cycle of user accounts by linking a human resource application to Active Directory, as well as handling the proper creation and deletion of accounts in network and cloud-based applications. This allows a manager or IT employee in charge of accounts, to easily remove an employee and revoke all access to each system and application with one click. Instead of employee’s accounts being left active, once they leave they will be easily removed, improving security and reducing costs for the organization.
With an automated identity management solution, there is no need to have a dedicated staff to handle accounts. A manager in charge or help desk employee can easily handle the changes, which is why it is beneficial to even small businesses with a limited staff.
For more information, please visit our website.
Friday, August 23, 2013
Friday, August 16, 2013
Using Identity and Access Management Software for Audits
Regulation such as HIPAA, Basel II and Sarbanes-Oxley continues to overwhelm every business sector as organizations are continuously evaluated for their compliance with various standards, legislations and regulations. These evaluations, or audits, will sooner or later affect nearly every organization.
However, it’s not just top line executives that are affected by audits. In fact, ever more increasingly, IT departments are being brought into the audit response process, which means IT managers faced with an audit must be able to demonstrate full control of the data in which they manage.
Simply put, this means:
• IT departments must be able to demonstrate at any time who has access to what systems in the network, and when network actions have been performed (authorizations and reporting). For instance, IT manager should be able to indicate which employees are allowed to approve and pay invoices and who has reset employee X’s password and when.
• IT departments must implement a strong password policy.
Identity and access management (IAM) solutions provide IT administrators with support for legislative and regulatory compliance and are able to help them manage any audits such that:
Who Can Do What in a System?
Role-based access control (RBAC) is a technique for setting up authorization management in an organization and for providing insight into the questions of “who is allowed to do what in the network” and especially “who is not allowed to do so.” With RBAC, authorizations are not assigned to individual staff members but to RBAC roles, which in turn comprise the employee’s department, title, location and cost center. RBAC reduces the chance of error because network actions and changes can only be performed by people who are authorized to do so, based on their role or title.
Many organizations already use RBAC to a greater or lesser extent for: discovery, project implementation and population management. With the right solutions, organizations are able to reduce the hugely labor-intensive, complex and costly process with smart software that makes it possible to automate the majority of the population in an RBAC authorization matrix.
Using an RBAC system, the so-called organizational roles (the way in which employees are figured in the human resources database system, particularly in terms of title, department and cost center) are matched against the technical roles such as applications and folders present across the organization. Organizational partners and vendors can help organizations match their HR system and network, as well as analyze the current authorizations for each organizational role. This allows the organization to decide which HR attributes should be used for each organizational role.
The result of this alignment could be, say, that 90 percent of a particular organizational role (e.g. the role of nurse at the Cardiology department) involves particular authorizations. The logical step would then be to automatically assign all new employees in this role the same authorizations. By letting the occupancy rate govern the assignment of authorizations, a first step can be made toward populating the RBAC matrix in a very simple way. This approach can save you a great amount of time and money.
Strong password policy
Many laws and regulations require the implementation of a strong password policy (strong authorization). To achieve this, it is possible to activate the complexity rules in Windows Active Directory. However, you should first ask yourself whether this complexity is desirable for your organization, as this may have major consequences for your end users.
The default Windows Active Directory password complexity rules are often insufficient. Systems administrators need a more flexible solution that, among other things, makes it possible to determine individually, which rules are applied and when.
As mentioned, earlier, implementing a stricter password policy has major implications for end users, as well as the organization as a whole. End users will need to remember more complex passwords and since most of them will have trouble in doing so, the helpdesk is bound to receive more password reset calls.
To reduce the number of password reset calls, Tools4ever offers SSRPM (Self Service Reset Password Management), which lets end users reset their passwords independently by providing answers to a series of simple, predefined questions.
A stricter password policy also has consequences for the productivity of employees. They will have to remember more complex passwords for all of their applications, and will be far from happy with the situation. For this reason, many organizations choose to implement a single sign-on solution to cater for the needs of their end users.
A single sign-on solution (SSO) allows end users to log in once, after which they are automatically assigned access to all applications and resources across the network, without having to log in again. SSO functions as an additional software layer that handles all login processes and automatically enters the required credentials (automatic login). SSO also ensures that, in addition to Active Directory, a strong password is automatically used for all the underlying applications.
Two-factor authentication
When implementing a strong password policy is insufficient in itself (e.g. because end users end up jotting down their passwords), it is possible to use strong (two-factor) authentication. Rather than entering their user name and password, users will log in by holding a card against a card reader and entering a PIN code. This results in strong authentication, as two-factor authentication is based on something the user has (the card) and knows (the PIN code). In this set up, the card ID is linked to the user’s Active Directory credentials.
It is also possible to implement strong authentication without having to purchase additional hardware. In this scenario, the use of smartphones takes on an important role. This is because smartphones offer various authentication capabilities, such as facial recognition (using the camera), voice recognition (using sound recordings) and geographical positioning (using GPS). This type of low-cost authentication is the latest trend in the field of authentication.
For more details, please visit our website.
However, it’s not just top line executives that are affected by audits. In fact, ever more increasingly, IT departments are being brought into the audit response process, which means IT managers faced with an audit must be able to demonstrate full control of the data in which they manage.
Simply put, this means:
• IT departments must be able to demonstrate at any time who has access to what systems in the network, and when network actions have been performed (authorizations and reporting). For instance, IT manager should be able to indicate which employees are allowed to approve and pay invoices and who has reset employee X’s password and when.
• IT departments must implement a strong password policy.
Identity and access management (IAM) solutions provide IT administrators with support for legislative and regulatory compliance and are able to help them manage any audits such that:
Who Can Do What in a System?
Role-based access control (RBAC) is a technique for setting up authorization management in an organization and for providing insight into the questions of “who is allowed to do what in the network” and especially “who is not allowed to do so.” With RBAC, authorizations are not assigned to individual staff members but to RBAC roles, which in turn comprise the employee’s department, title, location and cost center. RBAC reduces the chance of error because network actions and changes can only be performed by people who are authorized to do so, based on their role or title.
Many organizations already use RBAC to a greater or lesser extent for: discovery, project implementation and population management. With the right solutions, organizations are able to reduce the hugely labor-intensive, complex and costly process with smart software that makes it possible to automate the majority of the population in an RBAC authorization matrix.
Using an RBAC system, the so-called organizational roles (the way in which employees are figured in the human resources database system, particularly in terms of title, department and cost center) are matched against the technical roles such as applications and folders present across the organization. Organizational partners and vendors can help organizations match their HR system and network, as well as analyze the current authorizations for each organizational role. This allows the organization to decide which HR attributes should be used for each organizational role.
The result of this alignment could be, say, that 90 percent of a particular organizational role (e.g. the role of nurse at the Cardiology department) involves particular authorizations. The logical step would then be to automatically assign all new employees in this role the same authorizations. By letting the occupancy rate govern the assignment of authorizations, a first step can be made toward populating the RBAC matrix in a very simple way. This approach can save you a great amount of time and money.
Strong password policy
Many laws and regulations require the implementation of a strong password policy (strong authorization). To achieve this, it is possible to activate the complexity rules in Windows Active Directory. However, you should first ask yourself whether this complexity is desirable for your organization, as this may have major consequences for your end users.
The default Windows Active Directory password complexity rules are often insufficient. Systems administrators need a more flexible solution that, among other things, makes it possible to determine individually, which rules are applied and when.
As mentioned, earlier, implementing a stricter password policy has major implications for end users, as well as the organization as a whole. End users will need to remember more complex passwords and since most of them will have trouble in doing so, the helpdesk is bound to receive more password reset calls.
To reduce the number of password reset calls, Tools4ever offers SSRPM (Self Service Reset Password Management), which lets end users reset their passwords independently by providing answers to a series of simple, predefined questions.
A stricter password policy also has consequences for the productivity of employees. They will have to remember more complex passwords for all of their applications, and will be far from happy with the situation. For this reason, many organizations choose to implement a single sign-on solution to cater for the needs of their end users.
A single sign-on solution (SSO) allows end users to log in once, after which they are automatically assigned access to all applications and resources across the network, without having to log in again. SSO functions as an additional software layer that handles all login processes and automatically enters the required credentials (automatic login). SSO also ensures that, in addition to Active Directory, a strong password is automatically used for all the underlying applications.
Two-factor authentication
When implementing a strong password policy is insufficient in itself (e.g. because end users end up jotting down their passwords), it is possible to use strong (two-factor) authentication. Rather than entering their user name and password, users will log in by holding a card against a card reader and entering a PIN code. This results in strong authentication, as two-factor authentication is based on something the user has (the card) and knows (the PIN code). In this set up, the card ID is linked to the user’s Active Directory credentials.
It is also possible to implement strong authentication without having to purchase additional hardware. In this scenario, the use of smartphones takes on an important role. This is because smartphones offer various authentication capabilities, such as facial recognition (using the camera), voice recognition (using sound recordings) and geographical positioning (using GPS). This type of low-cost authentication is the latest trend in the field of authentication.
For more details, please visit our website.
Friday, July 26, 2013
Role-based Access Control Ensures Extra Security in Healthcare
Traditionally, implementing RBAC for the care setting can be daunting, but there are efficient ways to bring a system on board that allow health system leaders to track, audit and allow who has access to what information and when.
While Role-based Access Control (RBAC) has uses in every industry, the healthcare provider can benefit enormously from a proper implementation. The potential to save exists not only by reducing potential fines in HIPAA and/or Sar-Box audits, but also from conceivable lawsuits if sensitive patient data is exposed to the wrong personnel.
RBAC Overview
RBAC is a technique for implementing authorization account management across organizations. This technique involves assigning access privileges to certain files and sets of data on the basis of an employee’s role rather than assigning access privileges to individual users. These roles in turn comprise the department, function, location and cost center associated with an employee, also allowing all of an employee’s interactions with the system to be captured, in essence creating an audit trail for the organization in case one is ever needed.
Implementation Difficulties
Typically, one of the difficulties in implementing RBAC is the enormous investment of time that can be required to populate the matrix. This task can be a daunting one as the combination of locations, departments, employee types and roles – and the access rights they should be entitled to — can require a tremendous initial effort to accurately define. However, there is an easier way to get started.
The human resources (HR) system is an excellent source for determining these combinations. This will pave the way for a role model on the organizational level. As an example, a hospital in Location “A” has a surgery department that includes the functional role of “nurse.” The organizational role can be created on the basis of the function, department and location found in the HR system. These are “nurse,” “nurse in Location A” and “surgery nurse,” respectively. After “nurse” and “surgery” have been defined, a nurse in the surgery department will automatically be identified as “nurse + surgery” and assigned the appropriate access privileges and applications.
Using this method, it becomes very easy to populate more than 80 percent of the RBAC table. A major benefit of this approach is that new employees can start being productive on their first day while time is freed up for the assignment of specific privileges on an application and system level.
A subsequent step is to translate these organizational roles into application or system roles, which will comprise the remaining 20 percent of the RBAC table. The basis for this is already present and now further stacking will take place. The assignment of the system roles can easily be handled by the relevant manager. After all, managers rather than HR personnel are responsible for the access privileges of their employees. On the basis of a workflow, the relevant manager will be prompted by an e-mail notification and/or web form to specify the access privileges and applications for the employee concerned.
The RBAC software can subsequently record the manager’s choices to further populate the empty sections of the RBAC table and eventually achieve a fully populated table. This means it is possible to have a manager handle all the translations of roles within her department, with an option to delegate tasks to a colleague. An action triggered by the manager may also result in a workflow notification to a license manager. This allows managers to exactly determine and manage what happens within their department or cost center.
Inevitably, an employee’s location, position or role will change over time. A properly implemented RBAC system allows for a transition of the access and application rights, as well. When the employee changes jobs within the organization, the RBAC matrix ensures he has the proper rights for his new role. The workflow component can notify the previous manager about the transition to insure access to systems and data no longer required are revoked in a timely manner, and also the new manager will be notified in case any special privileges are required for the new role.
By using the method described above, implementing RBAC does not have to be a long, painful and drawn out process. Implementation can be handled in weeks rather than years and the healthcare facility can start reaping the benefits of proper data access control quickly.
Fore more information, please visit our website.
While Role-based Access Control (RBAC) has uses in every industry, the healthcare provider can benefit enormously from a proper implementation. The potential to save exists not only by reducing potential fines in HIPAA and/or Sar-Box audits, but also from conceivable lawsuits if sensitive patient data is exposed to the wrong personnel.
RBAC Overview
RBAC is a technique for implementing authorization account management across organizations. This technique involves assigning access privileges to certain files and sets of data on the basis of an employee’s role rather than assigning access privileges to individual users. These roles in turn comprise the department, function, location and cost center associated with an employee, also allowing all of an employee’s interactions with the system to be captured, in essence creating an audit trail for the organization in case one is ever needed.
Implementation Difficulties
Typically, one of the difficulties in implementing RBAC is the enormous investment of time that can be required to populate the matrix. This task can be a daunting one as the combination of locations, departments, employee types and roles – and the access rights they should be entitled to — can require a tremendous initial effort to accurately define. However, there is an easier way to get started.
The human resources (HR) system is an excellent source for determining these combinations. This will pave the way for a role model on the organizational level. As an example, a hospital in Location “A” has a surgery department that includes the functional role of “nurse.” The organizational role can be created on the basis of the function, department and location found in the HR system. These are “nurse,” “nurse in Location A” and “surgery nurse,” respectively. After “nurse” and “surgery” have been defined, a nurse in the surgery department will automatically be identified as “nurse + surgery” and assigned the appropriate access privileges and applications.
Using this method, it becomes very easy to populate more than 80 percent of the RBAC table. A major benefit of this approach is that new employees can start being productive on their first day while time is freed up for the assignment of specific privileges on an application and system level.
A subsequent step is to translate these organizational roles into application or system roles, which will comprise the remaining 20 percent of the RBAC table. The basis for this is already present and now further stacking will take place. The assignment of the system roles can easily be handled by the relevant manager. After all, managers rather than HR personnel are responsible for the access privileges of their employees. On the basis of a workflow, the relevant manager will be prompted by an e-mail notification and/or web form to specify the access privileges and applications for the employee concerned.
The RBAC software can subsequently record the manager’s choices to further populate the empty sections of the RBAC table and eventually achieve a fully populated table. This means it is possible to have a manager handle all the translations of roles within her department, with an option to delegate tasks to a colleague. An action triggered by the manager may also result in a workflow notification to a license manager. This allows managers to exactly determine and manage what happens within their department or cost center.
Inevitably, an employee’s location, position or role will change over time. A properly implemented RBAC system allows for a transition of the access and application rights, as well. When the employee changes jobs within the organization, the RBAC matrix ensures he has the proper rights for his new role. The workflow component can notify the previous manager about the transition to insure access to systems and data no longer required are revoked in a timely manner, and also the new manager will be notified in case any special privileges are required for the new role.
By using the method described above, implementing RBAC does not have to be a long, painful and drawn out process. Implementation can be handled in weeks rather than years and the healthcare facility can start reaping the benefits of proper data access control quickly.
Fore more information, please visit our website.
Friday, July 12, 2013
Benefits and Risks of BYOD
The “bring your own device” (BYOD) trend continues gaining speed across many industries . Plainly put, BYOD is when employees have the ability to bring their own technical devices—like smart phones, tablets and laptops -- and use the company’s network instead of a company-provided device. BYOD has many benefits and risks, though, that each organization’s IT department needs to consider.
Benefits
Increased Productivity
The use of technology at work has increased significantly over the past few years as using paper and manual processes continue to decrease. In education, for example, schools have increasingly taken to using technology in the classroom by providing students with tablets and computers. Recent research has shown that this type of learning allows students to be more interactive and engaged in the learning process. In business, the use of technology has increased because of green practices and organizations realizing that by positioning themselves as environmentally friendly they are saving money and generating external support of their efforts. Though technology increases overall productivity, research also shows that employees are even more productive if the device they use is their own.
Lower Cost to the Company
Though the use of technology is a benefit to employers as it without a doubt makes employees more productive, the cost to companies that purchase a large number of computers or tablets is a tremendous financial commitment. Most of the technology used by organizations is only current and up to date for a certain, limited period of time and then becomes obsolete and in need of replacement. By allowing employees to bring, and use, their own devices, they can always have up-to-date technology without the company constantly incurring the costs for new models. For many, this practice has been extremely beneficial as many budgets are being cut and organizations are forced to trim spending.
BYOD shift costs from the company to the user and allows employees to use their own devices. BYOD policies also allow employees to use the technology that they are comfortable with and that they prefer, rather than what the company dictates they them. Users also may upgrade their devices to the newest features more frequently than what the company can afford to budget for on an ongoing basis.
Risks
Support of many different devices
Though there are many benefits to allowing BYOD, there are several risks that concern the IT staff. First of all, since it is not one standard device that everyone is using, the IT department will need to support many different types of devices and operating systems. This makes it very difficult to mitigate an issue with a device when the user needs assistance.
No control over what is on device
Organizations have no control over what types of applications are put on the device, which makes it very difficult to enforce security. Though employees probably would not download games or other entertainment applications on their work computer, in the case of BYOD, since the device is their own and also used for pleasure, they will certainly download numerous types of personal applications on the device.
Security Risks
BYOD increases the risk of having a security breach of important data. When an employee leaves the company, they do not have to give back the device, so company applications and other data may still be present on their device. This can lead to some company data being unsecure. There are also certain compliance regulations that businesses have to follow, such as HIPPA or GLBA, which are difficult to enforce when a device is not owned by the company.
Infrastructure Issues
Different types of devices operate at different speeds and with different operating systems. This can be difficult for an IT department to set up and maintain infrastructure to support different device needs. Also, if employees are able to bring their own devices, there will be many more devices used than what would be if the company was providing them. Employees might bring all of their phones, tablets and computers to work, meaning there will be much more strain on the company’s Wi-Fi and network.
Solutions
Easily setup new devices
With an influx of devices the IT department will need to add them all to the network, which can be extremely time consuming. Solutions such as Tools4ver’s User Management Resource Administrator (UMRA) allow IT staff to easily add these new devices by adding them in Active Directory. End users will even be able to register their devices themselves if required.
Only allow certain devices to be registered
Since there are many different types and brands of devices that employees can use, an organization will have to decide which ones it is going to allow and support. This allows it to focus on a narrower selection of devices and be able to solve issues that arise with those devices. When a user tries to register a device, UMRA can be set up to only allow supported devices to be registered, thus not allowing unsupported devices to be registered on the company network.
Ensure Security
Security is a big issue with allowing BYOD at a company. When an employee leaves, he takes the device with him, so it is important that each departing employee does not still have access to important company data. With UMRA, once an employee leaves the company, his account can automatically be disabled, thereby deactivating his access to the network and any secure data. This ensures that when an employee leaves he will not be able to continue accessing important company data. This can also help to comply with regulations and audit needs. No one will have access to applications and data that they are not supposed to have access.
For more information, please visit our website.
Benefits
Increased Productivity
The use of technology at work has increased significantly over the past few years as using paper and manual processes continue to decrease. In education, for example, schools have increasingly taken to using technology in the classroom by providing students with tablets and computers. Recent research has shown that this type of learning allows students to be more interactive and engaged in the learning process. In business, the use of technology has increased because of green practices and organizations realizing that by positioning themselves as environmentally friendly they are saving money and generating external support of their efforts. Though technology increases overall productivity, research also shows that employees are even more productive if the device they use is their own.
Lower Cost to the Company
Though the use of technology is a benefit to employers as it without a doubt makes employees more productive, the cost to companies that purchase a large number of computers or tablets is a tremendous financial commitment. Most of the technology used by organizations is only current and up to date for a certain, limited period of time and then becomes obsolete and in need of replacement. By allowing employees to bring, and use, their own devices, they can always have up-to-date technology without the company constantly incurring the costs for new models. For many, this practice has been extremely beneficial as many budgets are being cut and organizations are forced to trim spending.
BYOD shift costs from the company to the user and allows employees to use their own devices. BYOD policies also allow employees to use the technology that they are comfortable with and that they prefer, rather than what the company dictates they them. Users also may upgrade their devices to the newest features more frequently than what the company can afford to budget for on an ongoing basis.
Risks
Support of many different devices
Though there are many benefits to allowing BYOD, there are several risks that concern the IT staff. First of all, since it is not one standard device that everyone is using, the IT department will need to support many different types of devices and operating systems. This makes it very difficult to mitigate an issue with a device when the user needs assistance.
No control over what is on device
Organizations have no control over what types of applications are put on the device, which makes it very difficult to enforce security. Though employees probably would not download games or other entertainment applications on their work computer, in the case of BYOD, since the device is their own and also used for pleasure, they will certainly download numerous types of personal applications on the device.
Security Risks
BYOD increases the risk of having a security breach of important data. When an employee leaves the company, they do not have to give back the device, so company applications and other data may still be present on their device. This can lead to some company data being unsecure. There are also certain compliance regulations that businesses have to follow, such as HIPPA or GLBA, which are difficult to enforce when a device is not owned by the company.
Infrastructure Issues
Different types of devices operate at different speeds and with different operating systems. This can be difficult for an IT department to set up and maintain infrastructure to support different device needs. Also, if employees are able to bring their own devices, there will be many more devices used than what would be if the company was providing them. Employees might bring all of their phones, tablets and computers to work, meaning there will be much more strain on the company’s Wi-Fi and network.
Solutions
Easily setup new devices
With an influx of devices the IT department will need to add them all to the network, which can be extremely time consuming. Solutions such as Tools4ver’s User Management Resource Administrator (UMRA) allow IT staff to easily add these new devices by adding them in Active Directory. End users will even be able to register their devices themselves if required.
Only allow certain devices to be registered
Since there are many different types and brands of devices that employees can use, an organization will have to decide which ones it is going to allow and support. This allows it to focus on a narrower selection of devices and be able to solve issues that arise with those devices. When a user tries to register a device, UMRA can be set up to only allow supported devices to be registered, thus not allowing unsupported devices to be registered on the company network.
Ensure Security
Security is a big issue with allowing BYOD at a company. When an employee leaves, he takes the device with him, so it is important that each departing employee does not still have access to important company data. With UMRA, once an employee leaves the company, his account can automatically be disabled, thereby deactivating his access to the network and any secure data. This ensures that when an employee leaves he will not be able to continue accessing important company data. This can also help to comply with regulations and audit needs. No one will have access to applications and data that they are not supposed to have access.
For more information, please visit our website.
Friday, June 28, 2013
Security Steps for Small Businesses
Like large organizations, small businesses also often have several identity and access management issues, such as ensuring security of systems and applications along with handling password issues. Unlike large organizations, they often do not have the staff and resources to easily handle these tasks, so the tasks either go incomplete or require more time and money than necessary. There are several solutions for small businesses though that easily mitigate these problems and save time and money in the long run.
Ensure Security of Systems and Applications
Employees often have many sets of credentials to login to their applications and perform their jobs. To remember multiple sets of credentials, employees often write down their user names and passwords and store them somewhere by their desks. This puts the organization’s applications at risk and reduces the security.
An easy way for small business to reduce the headache of multiple passwords for their employees, as well as ensure the security of their systems, is with a single sign-on (SSO) application. With an SSO solution, employees only have to remember one set of credentials. Once they enter their single user name and password they will thereafter be automatically signed into all applications and systems once they are opened. This ensures that employees will not use non-secure methods to remember their passwords.
A single sign-on solution also can incorporate two-factor authentication for an additional layer of security to systems and applications used by small businesses.
Two-factor authentication is used by requiring users to present a smart card, as well as a PIN code. This adds additional security to the login process. Two-factor authentication also can be customized to the needs of the organization, such as requiring the computer to remember the PIN for a defined period of time or automatically closing all sessions on the computer after the smart card is removed. Each of these customizations adds additional security to the systems, as well as improving efficiency for the user.
Easily Reduce Password Issues
Integrating simple sign on protocols in your business can cut down on security breaches and streamline employee access.
When an employee forgets a password, or is locked out of an application, they needs to go through the time-consuming process of resetting passwords. In a small business, access to a 24×7 help desk may not be possible. If there is a help desk or IT department available at all times, it may have a small staff and focusing on password resets can take away from their time of focusing on other more important issues.
A self-service reset password solution allows end users to easily and securely reset their passwords themselves. They simply register by providing answers to personal questions, much like a banking website. Then, when they need to reset their password, they simply click the “forgot my password” button, provide the correct answers and are able to reset their password without having to contact anyone else at the company.
This reduces the annoyance of password resets for both the IT department and the end user and allows them to both be productive working on more important tasks.
In conclusion, small businesses have many of the same issues that larger organizations deal with. By implementing one or all of the solutions discussed here they are able to reduce the amount of time the IT staff spends dealing with these issues, and not need to have an employee working full time to handle them.
For additional information, please visit our website.
Ensure Security of Systems and Applications
Employees often have many sets of credentials to login to their applications and perform their jobs. To remember multiple sets of credentials, employees often write down their user names and passwords and store them somewhere by their desks. This puts the organization’s applications at risk and reduces the security.
An easy way for small business to reduce the headache of multiple passwords for their employees, as well as ensure the security of their systems, is with a single sign-on (SSO) application. With an SSO solution, employees only have to remember one set of credentials. Once they enter their single user name and password they will thereafter be automatically signed into all applications and systems once they are opened. This ensures that employees will not use non-secure methods to remember their passwords.
A single sign-on solution also can incorporate two-factor authentication for an additional layer of security to systems and applications used by small businesses.
Two-factor authentication is used by requiring users to present a smart card, as well as a PIN code. This adds additional security to the login process. Two-factor authentication also can be customized to the needs of the organization, such as requiring the computer to remember the PIN for a defined period of time or automatically closing all sessions on the computer after the smart card is removed. Each of these customizations adds additional security to the systems, as well as improving efficiency for the user.
Easily Reduce Password Issues
Integrating simple sign on protocols in your business can cut down on security breaches and streamline employee access.
When an employee forgets a password, or is locked out of an application, they needs to go through the time-consuming process of resetting passwords. In a small business, access to a 24×7 help desk may not be possible. If there is a help desk or IT department available at all times, it may have a small staff and focusing on password resets can take away from their time of focusing on other more important issues.
A self-service reset password solution allows end users to easily and securely reset their passwords themselves. They simply register by providing answers to personal questions, much like a banking website. Then, when they need to reset their password, they simply click the “forgot my password” button, provide the correct answers and are able to reset their password without having to contact anyone else at the company.
This reduces the annoyance of password resets for both the IT department and the end user and allows them to both be productive working on more important tasks.
In conclusion, small businesses have many of the same issues that larger organizations deal with. By implementing one or all of the solutions discussed here they are able to reduce the amount of time the IT staff spends dealing with these issues, and not need to have an employee working full time to handle them.
For additional information, please visit our website.
Friday, June 21, 2013
Accessing Cloud Applications - A Challenge for the IT department
For an IT department, working with cloud applications and their providers can present a number of new challenges. Where the IT department previously took a facilitating role that is now transitioning to a coordinating role. In addition, it can be significantly more difficult to control user and access privileges in cloud applications. The control over user accounts and roles — who has access to which cloud applications and data — is more complex than with applications that reside within the network. Below are some of the causes:
1. Large amount of information
The flow of information within the business environment is exponentially larger, and with greater frequency, than a few years ago. Organizations have to deal with a large number of users (employees, partners and even clients in some situations) and also many changes; for example, an employee leaves the organization. Previously, it was possible to perform necessary account management process during a pre-established and given time, like monthly or quarterly. Today, this is no longer feasible and the data must be refreshed weekly or even daily. Also a factor, custom scripts often do not work with cloud applications.
2. Different structure
It is a major challenge for the IT department to manage all identities, roles and the data that exists in the various cloud solutions. Many solutions use proprietary authorization and authentication structures. It is common that the same data is required in different systems, but the varying structures make it very difficult to manage in a centralized fashion.
3. Multiple authentication sources
Active Directory, or other directory service, such as Novell eDirectory or Apple Open Directory, is normally the central authorization point for users and most likely controls access to other internal applications and systems. Cloud applications are typically not Active Directory integrated and the result is the need for multiple authentication sources; a directory service for internal applications and typically one authentication source per application in the cloud.
Working with multiple authentication sources of this type is complex because there are only limited options to synchronize user accounts between the sources — also known as federation support — such as Microsoft ADFS and the SAML standard.
4. More manual actions
Vendors that do not offer federation support — for example, several vendors of electronic portals and HR systems — offer a Web browser that administrators can use to directly manage the cloud application management. This requires personnel to manually manage the creation of accounts for new employees and partners, and disabling accounts for employees and partners who are no longer part of the organization.
Although typically very well organized, the web portals require a large number of manual operations. This is time consuming and subject to errors. Some applications will allow a bulk upload via a .CSV file but this still requires manual intervention to create the file, upload and verify which can produce a lot of work. In some cases, vendors have developed a link to user accounts to fully automate the process. This is also known as provisioning. The link retrieves information from the portal where the information is contained, and processes it to the electronic learning environment.
5. Password and naming conventions
Another issue that often arises is the standards for naming conventions and passwords. What works or is required in one system, may not work in another. For example, a user ID in the network may be based on the login name and in the cloud application may require the e-mail address. This makes the exchange of user account data between both environments very complex. This same issue can arise with password conventions. Complex passwords are usually required within the network, for example, the requirements of a combination of characters and numbers, however, you may not be able to utilize this convention within the cloud applications. Another factor to consider is the password expiration cycle — one system may be on a 90-day cycle while another might require a change every 30 days. Synchronizing passwords between the network and cloud applications can be tricky and proper planning is required prior to implementation.
6. What if the connection drops?
Vendors that provide links between the network and cloud applications often utilize event-driven synchronization between systems (i.e. when a change occurs, it is propagated immediately between the network and the cloud). However, they may not have a procedure for handling a temporarily dropped connection. Suppose a bulk upload to create a new employee accounts occurs but in the middle of the transfer, the connection with the cloud application drops. The result can be a tremendous amount of manual work to see which records have or have not been created. Cloud applications may not provide a notification that synchronization was successful.
7. Bulk actions
Processing bulk actions in the cloud is sometimes restricted or denied by the application. For example, imagine you need to create user accounts for several thousand employees, partners or clients students in a hosted e-mail system at the beginning of the school year. There are cloud applications that restrict the number of actions that can be implemented at one time or even require that administrative work be done after work hours to avoid overload on the network. While not all cloud application vendors are restrictive in this fashion, several are and this can impose extra work on the IT department.
8. Connecting import scripts
Frequently, various systems within a single network require the same information. The IT department wants to avoid duplicate manual input of information whenever feasible as it is inefficient and can lead to errors. In many cases scripts are created to load the data from an authoritative system to all dependent applications. Usually, a script will be required for each dependent system as the data elements and requirements will be unique. With the advent of cloud applications, this is more difficult to achieve as these solutions do not always provide a methodology to utilize traditional scripts.
Every organization has to deal with tight budgets, strict federal or local regulations and all are under great pressure to constantly seek ways to work more efficiently. Working with cloud applications can, in many cases, mean that the user and access control is not optimal or effective and requires more attention. Suppliers of cloud solutions give little priority to the development of better management of user accounts and access rights in their applications. They are obviously working with the development of new features and business-oriented functionality.
For more information, please visit our website.
1. Large amount of information
The flow of information within the business environment is exponentially larger, and with greater frequency, than a few years ago. Organizations have to deal with a large number of users (employees, partners and even clients in some situations) and also many changes; for example, an employee leaves the organization. Previously, it was possible to perform necessary account management process during a pre-established and given time, like monthly or quarterly. Today, this is no longer feasible and the data must be refreshed weekly or even daily. Also a factor, custom scripts often do not work with cloud applications.
2. Different structure
It is a major challenge for the IT department to manage all identities, roles and the data that exists in the various cloud solutions. Many solutions use proprietary authorization and authentication structures. It is common that the same data is required in different systems, but the varying structures make it very difficult to manage in a centralized fashion.
3. Multiple authentication sources
Active Directory, or other directory service, such as Novell eDirectory or Apple Open Directory, is normally the central authorization point for users and most likely controls access to other internal applications and systems. Cloud applications are typically not Active Directory integrated and the result is the need for multiple authentication sources; a directory service for internal applications and typically one authentication source per application in the cloud.
Working with multiple authentication sources of this type is complex because there are only limited options to synchronize user accounts between the sources — also known as federation support — such as Microsoft ADFS and the SAML standard.
4. More manual actions
Vendors that do not offer federation support — for example, several vendors of electronic portals and HR systems — offer a Web browser that administrators can use to directly manage the cloud application management. This requires personnel to manually manage the creation of accounts for new employees and partners, and disabling accounts for employees and partners who are no longer part of the organization.
Although typically very well organized, the web portals require a large number of manual operations. This is time consuming and subject to errors. Some applications will allow a bulk upload via a .CSV file but this still requires manual intervention to create the file, upload and verify which can produce a lot of work. In some cases, vendors have developed a link to user accounts to fully automate the process. This is also known as provisioning. The link retrieves information from the portal where the information is contained, and processes it to the electronic learning environment.
5. Password and naming conventions
Another issue that often arises is the standards for naming conventions and passwords. What works or is required in one system, may not work in another. For example, a user ID in the network may be based on the login name and in the cloud application may require the e-mail address. This makes the exchange of user account data between both environments very complex. This same issue can arise with password conventions. Complex passwords are usually required within the network, for example, the requirements of a combination of characters and numbers, however, you may not be able to utilize this convention within the cloud applications. Another factor to consider is the password expiration cycle — one system may be on a 90-day cycle while another might require a change every 30 days. Synchronizing passwords between the network and cloud applications can be tricky and proper planning is required prior to implementation.
6. What if the connection drops?
Vendors that provide links between the network and cloud applications often utilize event-driven synchronization between systems (i.e. when a change occurs, it is propagated immediately between the network and the cloud). However, they may not have a procedure for handling a temporarily dropped connection. Suppose a bulk upload to create a new employee accounts occurs but in the middle of the transfer, the connection with the cloud application drops. The result can be a tremendous amount of manual work to see which records have or have not been created. Cloud applications may not provide a notification that synchronization was successful.
7. Bulk actions
Processing bulk actions in the cloud is sometimes restricted or denied by the application. For example, imagine you need to create user accounts for several thousand employees, partners or clients students in a hosted e-mail system at the beginning of the school year. There are cloud applications that restrict the number of actions that can be implemented at one time or even require that administrative work be done after work hours to avoid overload on the network. While not all cloud application vendors are restrictive in this fashion, several are and this can impose extra work on the IT department.
8. Connecting import scripts
Frequently, various systems within a single network require the same information. The IT department wants to avoid duplicate manual input of information whenever feasible as it is inefficient and can lead to errors. In many cases scripts are created to load the data from an authoritative system to all dependent applications. Usually, a script will be required for each dependent system as the data elements and requirements will be unique. With the advent of cloud applications, this is more difficult to achieve as these solutions do not always provide a methodology to utilize traditional scripts.
Every organization has to deal with tight budgets, strict federal or local regulations and all are under great pressure to constantly seek ways to work more efficiently. Working with cloud applications can, in many cases, mean that the user and access control is not optimal or effective and requires more attention. Suppliers of cloud solutions give little priority to the development of better management of user accounts and access rights in their applications. They are obviously working with the development of new features and business-oriented functionality.
For more information, please visit our website.
Friday, June 14, 2013
4 Time-Saving Healthcare IT Industry Trends
As the U.S. economy slowly improves, healthcare facility IT budgets are likely to remain flat, or see only modest increases, in 2013. This means that IT departments will continue to look for ways to make their organizations and infrastructures run more efficiently.
Below are four areas that will be of particular interest to the technology departments in the healthcare industry. Self-service applications for end users' healthcare facilities will likely be looking for time-saving ways to eliminate end-user calls to the IT help desk, so we’ll likely see an uptick in self-service applications for IT end users.
No. 1: Self-Service Applications for End Users
Self-service reset password applications have been around for several years now and continue to prove their value. End users enroll via a series of challenge questions and, should they forget their password, are able to reset directly from the network login screen or website. This eliminates a call to the help desk, and allows the employee to become productive immediately instead of waiting on the help desk phone queue.
No. 2: Cloud Applications in the Healthcare Industry
As solutions like Gmail and Office 365 continue to gain traction in healthcare, the ability to provision and deprovision accounts in a timely fashion becomes critical to controlling costs. While many health systems have implemented identity management solutions for Active Directory (AD), implementing a seamless process to these cloud applications can be a challenge.
Though both Google and Microsoft offer tools to synchronize AD with their respective products, they reportedly fall short in many areas and can make account management a tedious chore. Many vendors now offer advanced tools that allow for easy synchronization and management of accounts in these, and many other, healthcare cloud applications.
No. 3: Use of Single Sign-On
In hospitals and healthcare settings, both authorized and unauthorized people often use the workstation computers, meaning that those unauthorized people can view restricted information if accounts are not securely managed. Yet, clinicians frequently share a common username and password with peers to avoid wasting time switching between user profiles.
By reducing the amount of time required to log in, clinicians can easily and securely access patient information as they quickly move from room to room. It is even possible to integrate “Follow Me,” which allows users who have opened applications on Citrix and/or Terminal Server to continue their work on another computer. Overall, clinicians will be able to focus less on signing in and more on caring for patients.
No. 4: Security and Audit of the Healthcare Industry
As in past years, ensuring security of the network and providing accurate reporting to auditors will have a large impact on the IT department, both in time and money. The IT department needs to provide employees with the correct access rights required to applications and network functional areas, while also ensuring unnecessary access is never granted.
The application also creates the appropriate Exchange mailbox and creates a home folder for the employee on the appropriate share drive. By ensuring the proper access rights, it makes the audit process that much easier and ensures compliance at all times.
For more information, please visit our website.
Below are four areas that will be of particular interest to the technology departments in the healthcare industry. Self-service applications for end users' healthcare facilities will likely be looking for time-saving ways to eliminate end-user calls to the IT help desk, so we’ll likely see an uptick in self-service applications for IT end users.
No. 1: Self-Service Applications for End Users
Self-service reset password applications have been around for several years now and continue to prove their value. End users enroll via a series of challenge questions and, should they forget their password, are able to reset directly from the network login screen or website. This eliminates a call to the help desk, and allows the employee to become productive immediately instead of waiting on the help desk phone queue.
No. 2: Cloud Applications in the Healthcare Industry
As solutions like Gmail and Office 365 continue to gain traction in healthcare, the ability to provision and deprovision accounts in a timely fashion becomes critical to controlling costs. While many health systems have implemented identity management solutions for Active Directory (AD), implementing a seamless process to these cloud applications can be a challenge.
Though both Google and Microsoft offer tools to synchronize AD with their respective products, they reportedly fall short in many areas and can make account management a tedious chore. Many vendors now offer advanced tools that allow for easy synchronization and management of accounts in these, and many other, healthcare cloud applications.
No. 3: Use of Single Sign-On
In hospitals and healthcare settings, both authorized and unauthorized people often use the workstation computers, meaning that those unauthorized people can view restricted information if accounts are not securely managed. Yet, clinicians frequently share a common username and password with peers to avoid wasting time switching between user profiles.
By reducing the amount of time required to log in, clinicians can easily and securely access patient information as they quickly move from room to room. It is even possible to integrate “Follow Me,” which allows users who have opened applications on Citrix and/or Terminal Server to continue their work on another computer. Overall, clinicians will be able to focus less on signing in and more on caring for patients.
No. 4: Security and Audit of the Healthcare Industry
As in past years, ensuring security of the network and providing accurate reporting to auditors will have a large impact on the IT department, both in time and money. The IT department needs to provide employees with the correct access rights required to applications and network functional areas, while also ensuring unnecessary access is never granted.
The application also creates the appropriate Exchange mailbox and creates a home folder for the employee on the appropriate share drive. By ensuring the proper access rights, it makes the audit process that much easier and ensures compliance at all times.
For more information, please visit our website.
Subscribe to:
Posts (Atom)