Maintain Sanity and Security For Your Business Without Breaking the Bank
When dealing with IT management for business support and growth, many small businesses are forced to do more with less, which can actually result in poorly-designed security measures.
Simple and effective steps and strategies that are also budget-friendly can have a huge impact on a business’s position in their industry market and allow leaders to focus on more pressing business matters.
The following tips provide examples of how several organizations are taking such aggressive results-oriented action:
1. Improve Security Methods
Businesses often require employees to remember several different and complex passwords, which also need to be changed regularly according to company guidelines. To remember the passwords, employees often write them down and then store them somewhere to refer to later. These methods create a higher risk for security breaches for the business.
At All Star Automotive, in Baton Rouge, employees in every position throughout the company needed to log in to several different applications to perform their jobs. Each employee needed to remember log-in credentials for nine or more applications, which became frustrating. The solution? Single sign-on.
By implementing a single sign-on solution, employees no longer have to remember several different credentials. They simply log in once and the single sign-on system takes over the log-in process thereafter, initiating an automatic log in to all the applications and systems for which the employee is authorized.
2. Reduction of Helpdesk Tickets
The IT department is often inundated with calls from users requesting help with issues that are simple, but are time consuming. This takes time away from other more technical projects that the IT department could be focusing on.
At Lifestyle Hearing, based in Canada, user accounts for employees needed to be created and controls put in place by the IT department. By automating their account management system, the human resources department now has controlled access through a web-based form to create an account that allows the company to easily enter the employee’s information, define their profiles and which systems they need access to.
Since HR now handles all account management tasks, the IT department has saved substantial time and is able to focus on other issues.
3. Timely System Updates and User Management
Managing end-user accounts for up-to-date access and accurate information can be difficult. These tasks are often performed manually and consume a large amount of time for IT employees.
At Springs Global of Fort Mill, South Carolina, information in the IT database was often inaccurate because information would only get changed when someone had noticed a difference and made the appropriate modifications.
To alleviate these issues, an automated account management solution was implemented to synchronize their HR system, Cyborg, with Active Directory each evening. This, in turn, populates other internal systems such as SharePoint, help desk software and the Exchange Global Address List. With changes made each night, employee information is now current and up to date.
4. Delegation
Account management can be a time-consuming task for IT employees, and can take them away from working on higher level projects. Though the task could be handed off to other to the least experienced employees within an organization, this can cause a security risk.
Springs Global faced this situation and wanted to find a way to provide help desk administrators the ability to perform certain active directory tasks without giving them elevated rights. By automating its account management, the company now uses a “forms” system that allows HR employees to make minor changes, but not have elevated rights in the domain so that the systems remain secure.
This is done through several digital forms that allow HR employees to easily enter only the requested information in order to reduce error and ensure security.
By taking these four actions, leading organizations in a variety of market sectors have actually streamlined their efficiency and achieved measurable results, while saving time and money and securing access to their critical information.
These simple solutions mean long-term improvements for any organization making the changes and can improve overall operation of IT throughout a system.
For more information, please visit www.tools4ever.com
Friday, March 28, 2014
Friday, March 14, 2014
Reduce your talent-related costs with automated access-management solution
HR professionals at retail organizations know all too well that employee turnover can be extremely high - sometimes in excess of 70%. This means that talent might get hired, on-boarded and leave the organization in a matter of months – and the IT department doesn't even know about them. This is a very costly process and retail organizations have found that automated access-management solutions can help bring this expense down.
Many global retail organizations have implemented identity and access-management solutions as they realize an account management solution can automate the provisioning process, eliminating many hours of work and unnecessary costs.
In addition, many retail organizations use automated access-management solutions to improve the security of their networks. What's very interesting is that they're assigning their HR department to manage these solutions. Here's why:
Reduce your talent-related costs with automated access-management solution
By using automated access-management solutions, HR departments are better able to manage employees and their on- and off-boarding while reducing the load on the IT departments. Since high employee turnover rates often require a full-time IT staff member to manage these tasks, automating the process allows for fewer IT positions to manage this. IT folks can then be reassigned to higher priorities or you can reduce their positions reduced, meaning the resources can be used in other areas of the business.
Organizations without such solutions or those without a plan to manage the process of automating this portion of the hiring process face several issues because of the high employee turnover rates.
Fore more information, please visit our website: www.tools4ever.com
Many global retail organizations have implemented identity and access-management solutions as they realize an account management solution can automate the provisioning process, eliminating many hours of work and unnecessary costs.
In addition, many retail organizations use automated access-management solutions to improve the security of their networks. What's very interesting is that they're assigning their HR department to manage these solutions. Here's why:
Reduce your talent-related costs with automated access-management solution
- Once talent leaves the business, they're able to make changes to his or her profile as all accounts connected to that person are automatically disabled.
- This helps to ensure that employees who are no longer with the company can't access anything on the network once they've left. Since HR is the first to know about the turnover of talent, it makes sense to have this responsibility assigned to this department.
By using automated access-management solutions, HR departments are better able to manage employees and their on- and off-boarding while reducing the load on the IT departments. Since high employee turnover rates often require a full-time IT staff member to manage these tasks, automating the process allows for fewer IT positions to manage this. IT folks can then be reassigned to higher priorities or you can reduce their positions reduced, meaning the resources can be used in other areas of the business.
Organizations without such solutions or those without a plan to manage the process of automating this portion of the hiring process face several issues because of the high employee turnover rates.
Fore more information, please visit our website: www.tools4ever.com
Friday, March 7, 2014
No need to be skeptical about BYOD with these 5 measures
Many organizational leaders remain skeptical of implementing a BYOD program because of the horror stories they hear about data breaches, access to the technology and employees taking advantage of the program. But like many landmark advances to the way business gets done, BYOD and the number of programs is likely only going to increase as it is one obvious solution for creating efficiency throughout a business environment.
There are several options for securing a successful strategy. The following five ways can ensure a successful BYOD strategy and free leaders from the problems that may sometimes cause:
1. Set up a BYOD policy from the beginning
By setting up a set of rules from the beginning, employees will know exactly what is expected from them so that there is no confusion about what using their own devices in the workplace means. This also will allow organization leaders the ability to define any repercussions should employees misuse or take advantage of the use of BYOD.
2. Use an IAM solution to register devices
In addition to all of the employee accounts, admins also will have to set up and register all employee devices. In the beginning especially there will be a large influx of new devices that need to be added, which is extremely time consuming if it is done manually. An IAM solution allows admins to easily add the new devices by simply adding them in Active Directory.
If desired, they can also allow end users to register the devices themselves. End users simply fill out a web form that is set up for a work flow request, which will then be automatically be sent to the appropriate manager or department for approval.
3. A process for disabling users
Allowing employees to use their own devices can lead to a security risk once the employee is no longer with the company. Since employees will be keeping the devices, they may potentially still be able to access the company’s network. An automated account management solution will allow managers to easily disable the user from all systems and applications with just one click, ensuring that the network stays secure.
4. Set guidelines for the types of devices allowed
One of the top issues with BYOD is that there are many different types, brands, operating systems, etc. for devices. When employees register their device with the company, they then expect the IT department to support it and resolve any issues with the device, which can be a headache for IT. An organization needs to set, from the beginning, which types and brands of devices they are going to support. They can then use an IAM solution, which easily can monitor and ensure that only these devices are registered and used. When a user then tries to register a device, only those which the company supports will be able to be registered.
5. Security for compliance and audit needs
It is important that the organization ensures that BYOD also meets audit and compliance needs. IAM software will help the organization to ensure that on their device users only has access to the systems and applications which they are supposed to. This information can then also be easily accessed when it comes to audit time.
For more information, please visit our website: www.tools4ver.com
There are several options for securing a successful strategy. The following five ways can ensure a successful BYOD strategy and free leaders from the problems that may sometimes cause:
1. Set up a BYOD policy from the beginning
By setting up a set of rules from the beginning, employees will know exactly what is expected from them so that there is no confusion about what using their own devices in the workplace means. This also will allow organization leaders the ability to define any repercussions should employees misuse or take advantage of the use of BYOD.
2. Use an IAM solution to register devices
In addition to all of the employee accounts, admins also will have to set up and register all employee devices. In the beginning especially there will be a large influx of new devices that need to be added, which is extremely time consuming if it is done manually. An IAM solution allows admins to easily add the new devices by simply adding them in Active Directory.
If desired, they can also allow end users to register the devices themselves. End users simply fill out a web form that is set up for a work flow request, which will then be automatically be sent to the appropriate manager or department for approval.
3. A process for disabling users
Allowing employees to use their own devices can lead to a security risk once the employee is no longer with the company. Since employees will be keeping the devices, they may potentially still be able to access the company’s network. An automated account management solution will allow managers to easily disable the user from all systems and applications with just one click, ensuring that the network stays secure.
4. Set guidelines for the types of devices allowed
One of the top issues with BYOD is that there are many different types, brands, operating systems, etc. for devices. When employees register their device with the company, they then expect the IT department to support it and resolve any issues with the device, which can be a headache for IT. An organization needs to set, from the beginning, which types and brands of devices they are going to support. They can then use an IAM solution, which easily can monitor and ensure that only these devices are registered and used. When a user then tries to register a device, only those which the company supports will be able to be registered.
5. Security for compliance and audit needs
It is important that the organization ensures that BYOD also meets audit and compliance needs. IAM software will help the organization to ensure that on their device users only has access to the systems and applications which they are supposed to. This information can then also be easily accessed when it comes to audit time.
For more information, please visit our website: www.tools4ver.com
Friday, February 14, 2014
Automated Identity and Access Management Reduces Security Risks
In today’s technology filled world, the proliferation of user credentials, such as user names and passwords, has grown exponentially. As such, requirements for managing employee access requirements continue to evolve at an unprecedented pace.
As new solutions are put in place to protect a company’s data, the average employee is forced to remember more and more password and login combinations. For example, the typical employee must remember six sets of user credentials. At the same time, top executives within a firm may need to remember as many as 12 or more password and login credentials.
In many cases, the jumble of logins and access passwords becomes a bit of a mess for employees and the company to manage, not to mention the costs associated with loss of employee productivity and work time. The time spent digging for passwords might be considered inconsequential, but the opposite is often true.
According to analyst firms Gartner and IDC, each have reported that password-related calls from employees occupy between 25 percent and 40 percent of all inquiries to the helpdesk. As staggering as the amount of time spent manually resetting and managing employee accounts is, it may pale in comparison with how much the average cost of each call to the helpdesk, which typically ranges between $10 and $31 a piece.
On top of this, an employee that’s lost access to internal systems and programs typically loses 20 minutes of productive work time for each call placed to the helpdesk.
And the costs don’t stop there. Though more difficult to figure, there are risks associated with users, who are desperate to avoid the call to the helpdesk, when they write down credentials on pieces of paper and stick them to monitors or store them underneath keyboards, for example. Doing so creates a great deal of risk and exposes confidential company information to the outside world.
Mitigate the Risk
Technologies exist from numerous vendors to significantly reduce the costs and risks associated with password management issues. Effective password reset applications have been around and utilized for several years. The best example of this can be found on a bank or financial institution’s website. For locked accounts, users must answer a series of challenge questions to gain access to their requested information.
For business looking to emulate these examples and do away with manual-, time- and cash-consuming processes, once the system is implemented with the self-service password reset tool, employees and end users enroll in it and going forward, if they ever lose their passwords they can simply reset them on their own whenever they need without assistance from the IT staff or helpdesk.
Strengthening the Security of Self-Service Resets
There will forever be fear from some individuals who believe that by allowing a single sign on self-service password reset function, they are making it much easier for the security of their systems to be compromised. As you might image, there are simple solutions to addresses these concerns, too.
The best example may be two-factor authentication. Two-factor authentication can be accomplished by a user providing a one-time PIN code via SMS or an alternate email address. These password self-service applications typically eliminate up to 95 percent of password-related calls to the helpdesk.
Two factor-authentication can also be used to reduce password-related issues is single sign on applications. These products reduce the number of credentials required to access accounts and information from the previously mentioned log in credentials (ranging from six to 12) to one.
Perhaps the best case for this comes from a recent study by the Ponemon Institute, which found that employees spend on average nine-and-a-half minutes each day logging into the applications needed to perform their jobs.
Another recent survey by Tools4ever revealed that respondents overwhelmingly (67 percent of the sample) stated they spend too much time logging in and out of applications to access information, while 85 percent of respondents agreed that efficiencies would be created by using only one set of credentials.
The most common benefit of two-factor authentication is the reduction of the credentials being written down and stored on or near the desktop by employees, as previously mentioned. Another feature of two-factor authentication is pairing it with biometrics or scan cards in conjunction with credentials and or a PIN code, which further increases the network security.
Also, as many applications require a password change because of time passage (for example, every three months users must update their passwords), an single sign on solution can anonymously reset the password so an end user is never even aware of their password. This reduces the chance of a terminated employee gaining access to sensitive systems from home if their account is not revoked in a timely fashion.
In addition, as password management solutions mature with the market, prices of the solutions have continued to drop and the expediency with which an implementation can be executed is getting significantly shorter.
Self-service password reset solutions can be deployed in one or two days and provide an ROI in as little as one month. SSO solutions typically are deployed across one or two weeks and provide and ROI in as little as three months or less. ROIs of these solutions are typically based on hard dollar savings only and do not take into account soft dollar savings associated with the increase of security or decrease in associated risks of leaving sensitive systems potentially exposed, which is where the real long-term gains are made for those that implement the systems.
For more information, please visit our website - www.tools4ever.com
As new solutions are put in place to protect a company’s data, the average employee is forced to remember more and more password and login combinations. For example, the typical employee must remember six sets of user credentials. At the same time, top executives within a firm may need to remember as many as 12 or more password and login credentials.
In many cases, the jumble of logins and access passwords becomes a bit of a mess for employees and the company to manage, not to mention the costs associated with loss of employee productivity and work time. The time spent digging for passwords might be considered inconsequential, but the opposite is often true.
According to analyst firms Gartner and IDC, each have reported that password-related calls from employees occupy between 25 percent and 40 percent of all inquiries to the helpdesk. As staggering as the amount of time spent manually resetting and managing employee accounts is, it may pale in comparison with how much the average cost of each call to the helpdesk, which typically ranges between $10 and $31 a piece.
On top of this, an employee that’s lost access to internal systems and programs typically loses 20 minutes of productive work time for each call placed to the helpdesk.
And the costs don’t stop there. Though more difficult to figure, there are risks associated with users, who are desperate to avoid the call to the helpdesk, when they write down credentials on pieces of paper and stick them to monitors or store them underneath keyboards, for example. Doing so creates a great deal of risk and exposes confidential company information to the outside world.
Mitigate the Risk
Technologies exist from numerous vendors to significantly reduce the costs and risks associated with password management issues. Effective password reset applications have been around and utilized for several years. The best example of this can be found on a bank or financial institution’s website. For locked accounts, users must answer a series of challenge questions to gain access to their requested information.
For business looking to emulate these examples and do away with manual-, time- and cash-consuming processes, once the system is implemented with the self-service password reset tool, employees and end users enroll in it and going forward, if they ever lose their passwords they can simply reset them on their own whenever they need without assistance from the IT staff or helpdesk.
Strengthening the Security of Self-Service Resets
There will forever be fear from some individuals who believe that by allowing a single sign on self-service password reset function, they are making it much easier for the security of their systems to be compromised. As you might image, there are simple solutions to addresses these concerns, too.
The best example may be two-factor authentication. Two-factor authentication can be accomplished by a user providing a one-time PIN code via SMS or an alternate email address. These password self-service applications typically eliminate up to 95 percent of password-related calls to the helpdesk.
Two factor-authentication can also be used to reduce password-related issues is single sign on applications. These products reduce the number of credentials required to access accounts and information from the previously mentioned log in credentials (ranging from six to 12) to one.
Perhaps the best case for this comes from a recent study by the Ponemon Institute, which found that employees spend on average nine-and-a-half minutes each day logging into the applications needed to perform their jobs.
Another recent survey by Tools4ever revealed that respondents overwhelmingly (67 percent of the sample) stated they spend too much time logging in and out of applications to access information, while 85 percent of respondents agreed that efficiencies would be created by using only one set of credentials.
The most common benefit of two-factor authentication is the reduction of the credentials being written down and stored on or near the desktop by employees, as previously mentioned. Another feature of two-factor authentication is pairing it with biometrics or scan cards in conjunction with credentials and or a PIN code, which further increases the network security.
Also, as many applications require a password change because of time passage (for example, every three months users must update their passwords), an single sign on solution can anonymously reset the password so an end user is never even aware of their password. This reduces the chance of a terminated employee gaining access to sensitive systems from home if their account is not revoked in a timely fashion.
In addition, as password management solutions mature with the market, prices of the solutions have continued to drop and the expediency with which an implementation can be executed is getting significantly shorter.
Self-service password reset solutions can be deployed in one or two days and provide an ROI in as little as one month. SSO solutions typically are deployed across one or two weeks and provide and ROI in as little as three months or less. ROIs of these solutions are typically based on hard dollar savings only and do not take into account soft dollar savings associated with the increase of security or decrease in associated risks of leaving sensitive systems potentially exposed, which is where the real long-term gains are made for those that implement the systems.
For more information, please visit our website - www.tools4ever.com
Friday, February 7, 2014
Why Implementing a BYOD Solution and IAM Solution Go Hand in Hand
Implementing a bring-your-own-device (BYOD) strategy can be an extremely beneficial undertaking but if implemented on its own, it can also create several problems. For example, many security issues can arise, as well as a great deal of time spent by the IT department setting up and monitoring all the new devices.
This alone is why it’s necessary that a mobile identity and access management (IAM) solution be implemented in conjunction with BYOD. Such a solution allows companies to receive the full benefit of BYOD without having to deal with the many issues that come along with it.
Here are some reasons why BYOD and mobile IAM go hand in hand and should be implemented together.
Cost Savings
One of the main reasons that companies implement BYOD is to lower their costs associated with purchasing a large number of computers or tablets. Though BYOD may lower costs of technology, if not implemented correctly, the strategy can result in higher costs in areas such as the time and support from the IT department. Without an IAM solution in place, IT employees will first have to deal with the large influx of new devices being used with their network. This can be extremely time consuming, since it has to be done manually, and each device needs to be added.
With an IAM solution in place, IT employees can easily add new devices by simply listing them in Active Directory. If desired, they can also allow end users to register the devices themselves. End users simply fill out a web form that is set up for a work flow request, which then will be automatically sent to the appropriate manager or department for approval. This completely removes IT’s need for intervention.
After implementation, an IAM solution will continue to enhance BYOD and ensure low cost and less attention from IT. IAM also allows IT administrators to easily add, make changes or disable users who are using mobile devices from one place, rather than requiring them to make changes in each system or application.
Securing the company’s infrastructure
Though BYOD means employees are using their own devices instead of company provided technology, employees still need access to the company’s network, systems and applications. This can become an issue when employees leave the company, since they keep their devices, possibly allowing them access to company data.
Organizations need to ensure that when employees leave, they no longer have access to the company’s network and data. Though the solution seems simple – disable users from the system and applications to which they have access – this often, more times than not, goes unnoticed and users remains active with access to all systems as if they were employees of the organization.
The reason for this is that IT must be notified of the employee’s leave, then must manually disable the user from all systems and applications. If an IAM solution is implemented once an employee leaves, a manager can automatically disable the user and deactivate account access, ensuring the security of the company’s data.
Easily control devices registered
One of the most important things companies can do to ensure a successful BYOD implementation is to be in control of BYOD and set rules and criteria that require employees to use their own devices from the beginning. Though this makes sense in theory, it is often difficult to do since companies often need to control and monitor hundreds or thousands of employees. This is why organizations need a solution that monitors the devices registered for them.
There are many different types and brands of devices with various different operating systems. Once an organization decides which they are going to support, this can be set up in their mobile IAM solution. When a user tries to register a device, only those that the company supports will be able to be registered with the organization.
Overall, BYOD and an IAM solutions work together, providing an organization with an optimal solution for a mobile workforce. Many of the issues commonly associated with BYOD can be easily eliminated, allowing the company to reap the best of the program’s benefits.
For more information , please visit our website.
This alone is why it’s necessary that a mobile identity and access management (IAM) solution be implemented in conjunction with BYOD. Such a solution allows companies to receive the full benefit of BYOD without having to deal with the many issues that come along with it.
Here are some reasons why BYOD and mobile IAM go hand in hand and should be implemented together.
Cost Savings
One of the main reasons that companies implement BYOD is to lower their costs associated with purchasing a large number of computers or tablets. Though BYOD may lower costs of technology, if not implemented correctly, the strategy can result in higher costs in areas such as the time and support from the IT department. Without an IAM solution in place, IT employees will first have to deal with the large influx of new devices being used with their network. This can be extremely time consuming, since it has to be done manually, and each device needs to be added.
With an IAM solution in place, IT employees can easily add new devices by simply listing them in Active Directory. If desired, they can also allow end users to register the devices themselves. End users simply fill out a web form that is set up for a work flow request, which then will be automatically sent to the appropriate manager or department for approval. This completely removes IT’s need for intervention.
After implementation, an IAM solution will continue to enhance BYOD and ensure low cost and less attention from IT. IAM also allows IT administrators to easily add, make changes or disable users who are using mobile devices from one place, rather than requiring them to make changes in each system or application.
Securing the company’s infrastructure
Though BYOD means employees are using their own devices instead of company provided technology, employees still need access to the company’s network, systems and applications. This can become an issue when employees leave the company, since they keep their devices, possibly allowing them access to company data.
Organizations need to ensure that when employees leave, they no longer have access to the company’s network and data. Though the solution seems simple – disable users from the system and applications to which they have access – this often, more times than not, goes unnoticed and users remains active with access to all systems as if they were employees of the organization.
The reason for this is that IT must be notified of the employee’s leave, then must manually disable the user from all systems and applications. If an IAM solution is implemented once an employee leaves, a manager can automatically disable the user and deactivate account access, ensuring the security of the company’s data.
Easily control devices registered
One of the most important things companies can do to ensure a successful BYOD implementation is to be in control of BYOD and set rules and criteria that require employees to use their own devices from the beginning. Though this makes sense in theory, it is often difficult to do since companies often need to control and monitor hundreds or thousands of employees. This is why organizations need a solution that monitors the devices registered for them.
There are many different types and brands of devices with various different operating systems. Once an organization decides which they are going to support, this can be set up in their mobile IAM solution. When a user tries to register a device, only those that the company supports will be able to be registered with the organization.
Overall, BYOD and an IAM solutions work together, providing an organization with an optimal solution for a mobile workforce. Many of the issues commonly associated with BYOD can be easily eliminated, allowing the company to reap the best of the program’s benefits.
For more information , please visit our website.
Friday, January 31, 2014
Authentication Challenges in the Cloud
As the cloud continues to expand within the commercial world and cloud services such as Google Apps, GoToMeeting, and Office 365 being widely deployed, working with cloud applications have user and access management consequences that need to be addressed.
Controlling who has access to specific applications and the corresponding data is even more complicated with cloud applications than with a typical office intranet. Providers of cloud solutions give little priority to developing better management of user accounts and access rights in their applications; they are more occupied with developing new, business-oriented features.
Consequently, user and access management in cloud applications entails a number of challenges such as:
1. Single Authentication
Active Directory is the central link in the chain for user access to applications and systems. The traditional LAN-based applications often have specific integration, such as LDAP, with the central user account directory. Working with cloud applications means more authentication sources. In addition to the corporate Active Directory network log-in, users also need to remember their credentials for each cloud application utilized.
There are only a few possibilities for synchronizing user accounts between both authentication sources, (like AD Federation Services from Microsoft and the SAML standard). In this manner, end-users can log in transparently to the cloud applications. However, Federation is not a replacement for provisioning and basic user account management. Maintaining roles within a cloud application and linking accounts to central authentication remains an important task with which access to specific data is regulated.
A single-sign-on (SSO) solution for the cloud would help in this situation. Vendors that offer SSO for cloud base the credentials on those that already exist in Active Directory. This allows the user to log in to all of their cloud applications with just their AD credentials.
2. Manual Actions
Providers who do not support Federation, such as many providers of e-learning environments and HR systems, frequently offer a web-browser that managers can use to control access to the cloud application directly. However, there is no automatic provisioning and this necessitates a sequence of manual operations. This process is time consuming and error prone. Also, when it’s possible to import a basic CSV file into the cloud application, it still requires manual intervention by the application manager. This can result in a lot of unnecessary work.
For example, consider the procedure required when an employee leaves the organization. This procedure often occurs in phases: first the user log-in is removed, then the account is removed, data transferred to a different user, and, finally, an email notification is sent to the manager. All these phases require a separate manual operation for user management in the cloud application. In this case, an automated account management solution would assist in the process. A solution such as this would synchronize user accounts via the HR system, so that any changes made in HR, such as disabling a user would automatically be synchronized to all connected accounts in all applications.
3. Naming and Password Conventions
Conventions governing naming standards and passwords are often inconsistent between network and cloud applications. In the network, a user ID might be based on the log-in name, and in the cloud it might be the email address. This complicates exchanging user account details between the environments, and, in many cases, differences also apply to password conventions.
When extremely complex passwords are required in the corporate network, cloud applications might not be able to handle this type of password. The possibility also exists that the cloud application requires a different duration for password expiration than within the corporate network. Synchronizing passwords between the network and cloud applications can be exceedingly difficult. In this case, automated solutions can be helpful as they can enforce a standard naming convention across all applications while allowing for uniqueness when more than one employee has the same name.
An enterprise SSO solution can mitigate the password complexity issues by “remembering” the user’s password and providing it automatically each time the user logs into the application. Further, an SSO application can also routinely reset the password in the background, or prompt the user to do so, when expiration occurs.
4. Organizational Structure
The reporting hierarchy structure within an organization is often utilized to assign authorizations to employees based on their role or position, commonly referred to as role-based access control (RBAC). Within the corporate network, this structure is contained in an HR system or within Active Directory.
Cloud applications normally cannot translate this organizational structure, and the web-based provisioning functionality they offer does not offer a robust method for incorporating this level of detail. Naturally, it is possible to transfer the entire organizational structure to the cloud application, but this requires an enormous volume of management activity when something in the hierarchy changes.
RBAC in an automated account management solution can assist with this issue. It allows access to various components of the cloud applications to be based on the end user’s organizational role. In this way access will be controlled on the basis of the department or title in the HR system.
5. Bulk actions
Performing bulk actions in cloud applications is occasionally rejected by the application. Consider, for example, schools that want to create a thousand user accounts for students in a cloud application, such as an e-learning system. Some cloud applications that impose restrictions on the number of actions that can be carried out in one pass or require that no management activities are undertaken during working hours to prevent overloads on their network.
A robust provisioning application can adhere to the processing rules imposed by cloud applications by breaking up the number of requests to be processed in one connection and/or limiting the execution to specific time-frames.
Working with cloud applications generally means that organizations no longer have user and access management in their own hands, and that the rules and service level agreements of the cloud applications apply. User and access management are of secondary importance to business requirements. If it is requisite for an organization to have control of user and access management, there are third-party developers that provide software solutions to ease the transition to cloud-based applications.
For more information, please visit our website.
Controlling who has access to specific applications and the corresponding data is even more complicated with cloud applications than with a typical office intranet. Providers of cloud solutions give little priority to developing better management of user accounts and access rights in their applications; they are more occupied with developing new, business-oriented features.
Consequently, user and access management in cloud applications entails a number of challenges such as:
1. Single Authentication
Active Directory is the central link in the chain for user access to applications and systems. The traditional LAN-based applications often have specific integration, such as LDAP, with the central user account directory. Working with cloud applications means more authentication sources. In addition to the corporate Active Directory network log-in, users also need to remember their credentials for each cloud application utilized.
There are only a few possibilities for synchronizing user accounts between both authentication sources, (like AD Federation Services from Microsoft and the SAML standard). In this manner, end-users can log in transparently to the cloud applications. However, Federation is not a replacement for provisioning and basic user account management. Maintaining roles within a cloud application and linking accounts to central authentication remains an important task with which access to specific data is regulated.
A single-sign-on (SSO) solution for the cloud would help in this situation. Vendors that offer SSO for cloud base the credentials on those that already exist in Active Directory. This allows the user to log in to all of their cloud applications with just their AD credentials.
2. Manual Actions
Providers who do not support Federation, such as many providers of e-learning environments and HR systems, frequently offer a web-browser that managers can use to control access to the cloud application directly. However, there is no automatic provisioning and this necessitates a sequence of manual operations. This process is time consuming and error prone. Also, when it’s possible to import a basic CSV file into the cloud application, it still requires manual intervention by the application manager. This can result in a lot of unnecessary work.
For example, consider the procedure required when an employee leaves the organization. This procedure often occurs in phases: first the user log-in is removed, then the account is removed, data transferred to a different user, and, finally, an email notification is sent to the manager. All these phases require a separate manual operation for user management in the cloud application. In this case, an automated account management solution would assist in the process. A solution such as this would synchronize user accounts via the HR system, so that any changes made in HR, such as disabling a user would automatically be synchronized to all connected accounts in all applications.
3. Naming and Password Conventions
Conventions governing naming standards and passwords are often inconsistent between network and cloud applications. In the network, a user ID might be based on the log-in name, and in the cloud it might be the email address. This complicates exchanging user account details between the environments, and, in many cases, differences also apply to password conventions.
When extremely complex passwords are required in the corporate network, cloud applications might not be able to handle this type of password. The possibility also exists that the cloud application requires a different duration for password expiration than within the corporate network. Synchronizing passwords between the network and cloud applications can be exceedingly difficult. In this case, automated solutions can be helpful as they can enforce a standard naming convention across all applications while allowing for uniqueness when more than one employee has the same name.
An enterprise SSO solution can mitigate the password complexity issues by “remembering” the user’s password and providing it automatically each time the user logs into the application. Further, an SSO application can also routinely reset the password in the background, or prompt the user to do so, when expiration occurs.
4. Organizational Structure
The reporting hierarchy structure within an organization is often utilized to assign authorizations to employees based on their role or position, commonly referred to as role-based access control (RBAC). Within the corporate network, this structure is contained in an HR system or within Active Directory.
Cloud applications normally cannot translate this organizational structure, and the web-based provisioning functionality they offer does not offer a robust method for incorporating this level of detail. Naturally, it is possible to transfer the entire organizational structure to the cloud application, but this requires an enormous volume of management activity when something in the hierarchy changes.
RBAC in an automated account management solution can assist with this issue. It allows access to various components of the cloud applications to be based on the end user’s organizational role. In this way access will be controlled on the basis of the department or title in the HR system.
5. Bulk actions
Performing bulk actions in cloud applications is occasionally rejected by the application. Consider, for example, schools that want to create a thousand user accounts for students in a cloud application, such as an e-learning system. Some cloud applications that impose restrictions on the number of actions that can be carried out in one pass or require that no management activities are undertaken during working hours to prevent overloads on their network.
A robust provisioning application can adhere to the processing rules imposed by cloud applications by breaking up the number of requests to be processed in one connection and/or limiting the execution to specific time-frames.
Working with cloud applications generally means that organizations no longer have user and access management in their own hands, and that the rules and service level agreements of the cloud applications apply. User and access management are of secondary importance to business requirements. If it is requisite for an organization to have control of user and access management, there are third-party developers that provide software solutions to ease the transition to cloud-based applications.
For more information, please visit our website.
Friday, January 24, 2014
HR’s Role in Identity and Access Management
In today’s complex business environment, one task that can seem more elusive to automate than it actually is the granting of access to employees of the company’s network, email system and other applications.
In most organizations, paper forms or emails are sent from hiring managers to members of HR or IT departments to initiate this process, resulting in manual entry into the requisite applications for on-boarding employees and time delays of a few hours to several days or weeks before an employee is actually fully able to receive access to all systems and maneuver the organizations internal systems.
In the meantime, newly hired employees never reach productivity levels that could be had their rights been established properly from the beginning. The result is often waned enthusiasm of employees for their new job because they’ve become mired in the system.
A similar scenario often unfolds when an employee leaves the organization. Phone calls and emails start the process of deactivating the access rights, but delays and lapses are inevitable and can lead to a huge security risk as employees remain active for a period of time long enough for the departing employee to access private organizational information.
Solving the New Hire Access Dilemma
In the vast majority of cases, members of the HR department are the first or second to know when an employee is to be hired. The department’s employees typically enter the new hire’s profile into the HR department’s corresponding system with all appropriate data -- department, employee number, manager, etc. – and in some cases they send an email to the IT department letting them know a network access account and email need to be created. The IT department may need to go back to the hiring manager for approvals and any special access instructions that must be met.
An automated process can set off a simple entry process of the new employee record in the HR system to create the account in Active Directory and the email application. Further, a workflow process can be started whereby a hiring manager receives the employee’s log in credentials and a link to an internal website where special access can be requested. Once the manager completes the form, a further workflow can be sent if additional approval levels are required with the final step being a notification for IT to finish the provisioning.
For example, Lifestyle Hearing, a Hawkesbury, Ontario-based, company with 70 locations throughout Canada, automated this very process. The company rapidly expanded to more than 130 employees, which created many complications for the IT group. New departments and roles also needed to be created and formed on a regular basis. Since it started as a small company, many employees had responsibilities that included several roles requiring definition as the company grew.
This meant that user accounts needed to be created in multiple systems and tighter controls needed to be put in place. The task took about 30 minutes per employee, but only if all the correct information was provided from the beginning. If not, the employee needed to be tracked down in an attempt to get the information, and wait for a response, which could take an unlimited amount of time.
Lifestyle Hearing administrators knew it was critical to ensure all information was correct, but the process took too much time from too many people for it to be productive or worthwhile and had become a major drain on the organization.
Prior to putting an automated system in place, IT was a bottleneck because of the fact that employees in the department often had to handle other important tasks and they were not able to create accounts quickly for new employees. By automating their account management processes, HR now has controlled access through a web-based form to create an account that allows the IT department to easily enter the employee’s information, define user profiles and determine which systems they need access to.
Lifestyle Hearing previously had a four- to five-day window for employee account creation, but by automating, employees are now able to have their accounts before their first day and start working on day one.
Expediting Employee Access Termination
As equally important as providing new employees with prompt network access is ensuring that employees leaving an organization have their access to network accounts, email and other applications revoked in a timely fashion. While most employees leave on good terms, an upset or contentious employee can potentially cause damage to data or perform a mass emailing to clients, among other malicious attacks.
By automating, a manager can visit a web page and immediately revoke network and email account access of all terminated employees, as well as can put a terminate date in the HR system and have an automated process kick off on the appropriate date.
It is critical to the organization that departing employees have their access rights terminated in a timely fashion. To ensure this process runs smoothly, managers can access forms that allow them to search for an employee and revoke rights on demand. Another process runs once this action occurs to ensure emails are forwarded to the correct manager and any files left on the network are shared appropriately for review. This ensures continuity for any clients or projects the terminated employee may have been working with.
As the HR department is always involved with employee hiring and terminations, it makes sense to have them involved with the process of granting and revoking network and email access. Available systems make the impact negligible as to not occupy more the HR professional’s valuable time.
For ore information, please visit our website.
In most organizations, paper forms or emails are sent from hiring managers to members of HR or IT departments to initiate this process, resulting in manual entry into the requisite applications for on-boarding employees and time delays of a few hours to several days or weeks before an employee is actually fully able to receive access to all systems and maneuver the organizations internal systems.
In the meantime, newly hired employees never reach productivity levels that could be had their rights been established properly from the beginning. The result is often waned enthusiasm of employees for their new job because they’ve become mired in the system.
A similar scenario often unfolds when an employee leaves the organization. Phone calls and emails start the process of deactivating the access rights, but delays and lapses are inevitable and can lead to a huge security risk as employees remain active for a period of time long enough for the departing employee to access private organizational information.
Solving the New Hire Access Dilemma
In the vast majority of cases, members of the HR department are the first or second to know when an employee is to be hired. The department’s employees typically enter the new hire’s profile into the HR department’s corresponding system with all appropriate data -- department, employee number, manager, etc. – and in some cases they send an email to the IT department letting them know a network access account and email need to be created. The IT department may need to go back to the hiring manager for approvals and any special access instructions that must be met.
An automated process can set off a simple entry process of the new employee record in the HR system to create the account in Active Directory and the email application. Further, a workflow process can be started whereby a hiring manager receives the employee’s log in credentials and a link to an internal website where special access can be requested. Once the manager completes the form, a further workflow can be sent if additional approval levels are required with the final step being a notification for IT to finish the provisioning.
For example, Lifestyle Hearing, a Hawkesbury, Ontario-based, company with 70 locations throughout Canada, automated this very process. The company rapidly expanded to more than 130 employees, which created many complications for the IT group. New departments and roles also needed to be created and formed on a regular basis. Since it started as a small company, many employees had responsibilities that included several roles requiring definition as the company grew.
This meant that user accounts needed to be created in multiple systems and tighter controls needed to be put in place. The task took about 30 minutes per employee, but only if all the correct information was provided from the beginning. If not, the employee needed to be tracked down in an attempt to get the information, and wait for a response, which could take an unlimited amount of time.
Lifestyle Hearing administrators knew it was critical to ensure all information was correct, but the process took too much time from too many people for it to be productive or worthwhile and had become a major drain on the organization.
Prior to putting an automated system in place, IT was a bottleneck because of the fact that employees in the department often had to handle other important tasks and they were not able to create accounts quickly for new employees. By automating their account management processes, HR now has controlled access through a web-based form to create an account that allows the IT department to easily enter the employee’s information, define user profiles and determine which systems they need access to.
Lifestyle Hearing previously had a four- to five-day window for employee account creation, but by automating, employees are now able to have their accounts before their first day and start working on day one.
Expediting Employee Access Termination
As equally important as providing new employees with prompt network access is ensuring that employees leaving an organization have their access to network accounts, email and other applications revoked in a timely fashion. While most employees leave on good terms, an upset or contentious employee can potentially cause damage to data or perform a mass emailing to clients, among other malicious attacks.
By automating, a manager can visit a web page and immediately revoke network and email account access of all terminated employees, as well as can put a terminate date in the HR system and have an automated process kick off on the appropriate date.
It is critical to the organization that departing employees have their access rights terminated in a timely fashion. To ensure this process runs smoothly, managers can access forms that allow them to search for an employee and revoke rights on demand. Another process runs once this action occurs to ensure emails are forwarded to the correct manager and any files left on the network are shared appropriately for review. This ensures continuity for any clients or projects the terminated employee may have been working with.
As the HR department is always involved with employee hiring and terminations, it makes sense to have them involved with the process of granting and revoking network and email access. Available systems make the impact negligible as to not occupy more the HR professional’s valuable time.
For ore information, please visit our website.
Subscribe to:
Posts (Atom)