Healthcare organizations use a variety of systems containing personal data and collected information. As the quantity of this data continues to increase over time, and as the organizations continue to expand and develop, merge and downsize, not to mention constant employee turnover, there are a great many changes and countless systems managing this information, making it difficult to implement changes across the network in a convenient way. Moreover, if the wrong authorizations are assigned, it is not possible to ensure proper information security.
The ability to quickly anticipate the inflow, transfer and outflow of staff requires a transparent and uniform overview of all the personal data in a single source system. This is called core registration. In many organizations, core registration is absent or incomplete. In such a case, the security officer must ask the various systems administrators for information to find out exactly who an employee is, what they are authorized to do and to which resources they are able to access. After all, the required information is fragmented across various systems, such as the facility management system, Active Directory, the electronic health record and other systems involving complex authorizations, such as planning and scheduling applications.
Active Directory as a source system
Active Directory is often used as a source system for assigning authorizations, as well as keeping track of additional personal or organizational information. Authorizations may find expression, for instance, in Active Directory groups, with information such as the room number, title and department being added to user accounts. However, organizations that do so run into a number of limitations. First of all, Active Directory does not offer a location for arranging physical access. Neither is it very suitable for mapping out persons with multiple employment contracts that are active in various different departments.
In addition, probably the most important limitation for using Active Directory as a source system is authorizations, as a too limited overview of a person is obtained. Active Directory groups are often used to manage access to applications. However, with certain healthcare applications, authorizations are often not handled via Active Directory as it does not “dig deep enough” for this purpose. Users can only see whether someone has access to the application and not what somebody is allowed to do inside the application.
Human resources management system as a source
Some organizations use their human resources management (HRM) system as the source for implementing changes across the network. When an employee is added to the HRM system, a user account is created immediately. However, the HRM system is not exhaustive; freelancers, medical specialists from partnerships and other third parties are often not or only partially included in the system. Furthermore, although the HRM system contains a host of data, it does not contain all the information that is important for IT.
A HRM system only answers the question of “Who is this person and which role does he or she fulfil in the organization?” However, it does not contain information on the permissions people have (which user rights does an employee have in a certain system, for example) or the resources (phone, access pass, laptop) they have at their disposal.
This type of information must be derived from other systems. When somebody leaves the organization, the corresponding Active Directory account will be disabled automatically. Unfortunately, it is not easy to perform other required measures, such as blocking the access pass, collecting the mobile phone and removing the phone number from the phone systems. Disabling user accounts in cloud-based systems usually is an even more complex affair.
There are organizations that use role-based access control (RBAC) alongside the HRM system to set up authorization management. In this approach, authorizations are not assigned on an individual basis, but are based on pre-determined roles. These roles in turn comprise information on the department, title, location and cost center of an employee.
However, RBAC is not all encompassing when it comes to staff transfers. RBAC provides an overview of the authorizations an employee should receive for their new role and what their authorizations are in their current role. The current situation may indicate that an employee has received manual authorizations since they were initially provisioned, and they should be re-validated during their transfer to determine if these rights need to persist.
Identity Vault
Rather than using Active Directory or the HRM system as a source, a better solution would be to deliver these and other data in a single, uniform pane of glass: the core registration.
The objective of core registration is to have a single, leading registration for all identities across the organization. With core registration, personal data are retrieved from all sorts of sources (e.g. the HRM, scheduling, flex pool management, Active Directory and facility management system). These may include name, address and town details, information on the employment contract, the room number, title, manager of the employee, as well as used resources, such as the phone and access pass. All data are compiled in the core registration. This set of data is also known as an identity vault.
The core registration is leading for the assignment of physical and logical access. All authorizations across the network are loaded and stored in the core registration and made searchable. The core registration provides a 360-degree overview of people’s identity, what they are allowed to do and which resources they have at their disposal. If employees are not listed in the core registration, they will not have access to the network and no physical access to (parts of) the building.
Every change in the source system will result in a modification in the core registration. Since the data is searchable, the security officer can look up a person and directly see in which systems the person is present, under which identities and what the person in question is allowed to do. The security officer can also see for each department and team which rights are used by whom, so that any anomalies can be quickly identified.
License management and more
In addition to the benefits of setting up more efficient processes for the inflow, transfer and outflow of employees and proactively identifying and responding to security incidents, core registration can be used for audits. Because of the availability of a centralized dashboard for keeping track of who has access to which applications, it will be easier to pass software license audits. In this scenario, the dashboard will work as a business intelligence tool for authorizations.
Core registration can also be used to control the license costs. Using the technique role mining, insight can be provided into which applications are available on average for each organizational role. This matching may result in the conclusion that 90 percent of employees in a particular organizational role (e.g. nurse at the cardiology department) use a particular application, like the scheduling system. When it has been identified which applications are required for a particular organisation role, it will be easy to pinpoint employees in the same role who use different applications. In such cases, an additional check can be performed. After all, it is more than likely that the employee in question is unnecessarily incurring license costs.
Finally, any events triggered by the core registration will result in a network action. By linking the core registration to a provisioning system, these network actions can be implemented automatically. When an employee leaves the organization, the provisioning system will set in motion the procedure for shutting down the user account.
For more information, please visit our website.
Friday, September 12, 2014
Friday, September 5, 2014
Four Simple Solutions for Introducing Complex Passwords
Passwords are a pain and you’re on the hunt to make the management of them easier and less offensive. Complex passwords were initially introduced to improve the security of your systems, but the introduction of such passwords -- which also have to be changed regularly -- leads to resistance among your employees. After all, they have to remember of multitude of password/user name combinations. This results in insecure situations where employees write down passwords on Post-Its and many password reset requests to the helpdesk.
Here are four simple solutions that you can introduce for managing complex passwords that won’t cause frustration among users.
Reduce the number of passwords with single sign-on. Reduce the number of passwords and ensure that employees only have to remember one (complex) password instead of dozens. Single sign-on (SSO) offers the ability to do this. SSO lets employees log in just once, after which access is automatically granted to all applications and systems the user might open. So the staff member doesn’t have to log in afresh for each application. And that saves an average of three to five logins with varying passwords each day.
Perhaps you want to do away with even this one remaining password? In that case, SSO can be deployed in combination with an access pass. The security card your employees use to gain access to the premises or parts of the premises, then replaces the final password/user name combination. By presenting a card to or into a reader and, if required, entering a PIN code, the user is automatically logged in. When the employee again presents the card to a reader, he or she is then logged out.
Automatic password synchronization. Wouldn’t it be ideal if the same password/username combination could be used for every application? The difficulty here is that the passwords almost always have an expiry date and need to be renewed regularly. Typically, the expiry date is not the same for every application. For some applications a new password has to be set monthly, while other software might only require it once a year. It’s virtually impossible for users to reset a newly introduced password in all the other required applications so that the password would then indeed be identical everywhere.
However you can actually automate this very well with solutions for password synchronization, which ensure that passwords are and remain synchronous in multiple systems. The newly set password is then immediately intercepted and forwarded to all other applications.
Help users to create strong passwords. Employees often find it difficult to come up with complex passwords. Some applications insist that the password must contain an uppercase letter, a punctuation mark or a figure. Or that the password must differ from the old one by X percentage.
That’s why users need some help in creating new, strong passwords. Password creation tools assist users in producing their passwords. The established complexity rules are shown when users configure a new password, and they are notified whether the relevant requirements have been met.
Let users reset their passwords themselves. As mentioned earlier, the introduction of complex passwords leads to an increase in the number of password reset requests to the helpdesk. To ease the burden on the helpdesk, it’s possible to let users reset their passwords themselves. Users identify themselves by correctly answering a number of personal questions (e.g. “What’s your mother’s maiden name?”) and can then reset their own passwords, without the intervention of the helpdesk.
A combination of these solutions means time-consuming registration procedures are a thing of the past and the helpdesk is relieved of the problems. Users benefit from maximum user-friendliness, while productivity rises.
Learn more at our website.
Here are four simple solutions that you can introduce for managing complex passwords that won’t cause frustration among users.
Reduce the number of passwords with single sign-on. Reduce the number of passwords and ensure that employees only have to remember one (complex) password instead of dozens. Single sign-on (SSO) offers the ability to do this. SSO lets employees log in just once, after which access is automatically granted to all applications and systems the user might open. So the staff member doesn’t have to log in afresh for each application. And that saves an average of three to five logins with varying passwords each day.
Perhaps you want to do away with even this one remaining password? In that case, SSO can be deployed in combination with an access pass. The security card your employees use to gain access to the premises or parts of the premises, then replaces the final password/user name combination. By presenting a card to or into a reader and, if required, entering a PIN code, the user is automatically logged in. When the employee again presents the card to a reader, he or she is then logged out.
Automatic password synchronization. Wouldn’t it be ideal if the same password/username combination could be used for every application? The difficulty here is that the passwords almost always have an expiry date and need to be renewed regularly. Typically, the expiry date is not the same for every application. For some applications a new password has to be set monthly, while other software might only require it once a year. It’s virtually impossible for users to reset a newly introduced password in all the other required applications so that the password would then indeed be identical everywhere.
However you can actually automate this very well with solutions for password synchronization, which ensure that passwords are and remain synchronous in multiple systems. The newly set password is then immediately intercepted and forwarded to all other applications.
Help users to create strong passwords. Employees often find it difficult to come up with complex passwords. Some applications insist that the password must contain an uppercase letter, a punctuation mark or a figure. Or that the password must differ from the old one by X percentage.
That’s why users need some help in creating new, strong passwords. Password creation tools assist users in producing their passwords. The established complexity rules are shown when users configure a new password, and they are notified whether the relevant requirements have been met.
Let users reset their passwords themselves. As mentioned earlier, the introduction of complex passwords leads to an increase in the number of password reset requests to the helpdesk. To ease the burden on the helpdesk, it’s possible to let users reset their passwords themselves. Users identify themselves by correctly answering a number of personal questions (e.g. “What’s your mother’s maiden name?”) and can then reset their own passwords, without the intervention of the helpdesk.
A combination of these solutions means time-consuming registration procedures are a thing of the past and the helpdesk is relieved of the problems. Users benefit from maximum user-friendliness, while productivity rises.
Learn more at our website.
Friday, August 29, 2014
Benefits of SSO for all businesses
Single sign-on (SSO) solutions benefit system end users, allowing them to quickly log on to their accounts by entering only one set of credentials and thereafter automatically logging them into all their systems and applications. In addition to this benefit, SSO provides other features that can further help end users and system admins throughout any organization.
Additional advantages of SSO, that are often not discussed, include:
Reduction in calls to the helpdesk
Often, since end users are required to remember several different sets of log in credentials, many of which are complicated and require special characters, they have trouble remembering each combination of user name and password. This leads to them calling the helpdesk to reset their passwords. With an SSO solution, end users only need to remember one set of credentials, which drastically reduces calls to the helpdesk and allows them to focus on more important tasks.
Integrates with other solutions
SSO is often able to integrate with other beneficial software, such as self-service password resetting and user provisioning. This allows organizations the ability to easily integrate SSO with solutions they might already have in place or with new software. For password resets, applications that require a new password every month or so, SSO can automatically generate a new password. With user provisioning, SSO can automatically provision a password for a new user.
Follow me
Another additional feature that can be added to SSO is the principle of “follow me.” This allows end users that need to work on different computers, such as doctors in the hospital setting, to easily do so by being able to log in on one computer and then quickly log out and continue their work on another computer. With “follow me,” users can quickly move to different work stations and do not have to open all applications that they were previously working on.
Fast user switching
In situations where users need to log in and out quickly, SSO can be very beneficial. Fast user switching allows users to quickly log on and have all of their applications started and logged in to on public computers. This can further be simplified by allowing the user to quickly swipe a pass card and have the same actions take place. Once they remove the card they are automatically signed out of all applications and the computer.
Fulfills compliance
SSO allows organizations to easily fulfill compliance and regulations. One way in which this is true is that an SSO solution can allow system admins to easily revoke access for a user in a single action, instead of having to go through each application. A report can also easily be generated to show which users have access to what applications to ensure that no users have access to information or applications that they shouldn’t. Lastly, SSO solutions can provide an additional check before the user logins to any critical application by requiring them to enter an additional PIN code or smart card.
Reduction of risks
A SSO solution not only makes the log on process more convenient and faster for the end user, it also makes the company’s information and applications more secure. When employees need to remember several different credentials they often write them down and keep them by their computers, which increases risk of someone unauthorized logging in. With and SSO solution the user only has to remember one set of credentials, reducing the chance that they will write them down.
For more information, please visit our website.
Additional advantages of SSO, that are often not discussed, include:
Reduction in calls to the helpdesk
Often, since end users are required to remember several different sets of log in credentials, many of which are complicated and require special characters, they have trouble remembering each combination of user name and password. This leads to them calling the helpdesk to reset their passwords. With an SSO solution, end users only need to remember one set of credentials, which drastically reduces calls to the helpdesk and allows them to focus on more important tasks.
Integrates with other solutions
SSO is often able to integrate with other beneficial software, such as self-service password resetting and user provisioning. This allows organizations the ability to easily integrate SSO with solutions they might already have in place or with new software. For password resets, applications that require a new password every month or so, SSO can automatically generate a new password. With user provisioning, SSO can automatically provision a password for a new user.
Follow me
Another additional feature that can be added to SSO is the principle of “follow me.” This allows end users that need to work on different computers, such as doctors in the hospital setting, to easily do so by being able to log in on one computer and then quickly log out and continue their work on another computer. With “follow me,” users can quickly move to different work stations and do not have to open all applications that they were previously working on.
Fast user switching
In situations where users need to log in and out quickly, SSO can be very beneficial. Fast user switching allows users to quickly log on and have all of their applications started and logged in to on public computers. This can further be simplified by allowing the user to quickly swipe a pass card and have the same actions take place. Once they remove the card they are automatically signed out of all applications and the computer.
Fulfills compliance
SSO allows organizations to easily fulfill compliance and regulations. One way in which this is true is that an SSO solution can allow system admins to easily revoke access for a user in a single action, instead of having to go through each application. A report can also easily be generated to show which users have access to what applications to ensure that no users have access to information or applications that they shouldn’t. Lastly, SSO solutions can provide an additional check before the user logins to any critical application by requiring them to enter an additional PIN code or smart card.
Reduction of risks
A SSO solution not only makes the log on process more convenient and faster for the end user, it also makes the company’s information and applications more secure. When employees need to remember several different credentials they often write them down and keep them by their computers, which increases risk of someone unauthorized logging in. With and SSO solution the user only has to remember one set of credentials, reducing the chance that they will write them down.
For more information, please visit our website.
Friday, August 15, 2014
Challenges of managing information in the cloud
The cloud continues to be much discussed and the many benefits it offers organizations of all sizes. Rarely is it mentioned, though, that there are a number of complications that come with managing data there, especially in regard to end user accounts and access of applications.
Using cloud applications surely can impact the security, compliance and IT-related cost savings of an organization. In relation to identity and access management, when several cloud applications are implemented, provisioning, password management and the monitoring of access begins to become quite a challenge. Because of this, organizational leaders should seriously consider implementing an automated cloud identity management solution if they’re using or making a move.
Auto provisioning
Creating accounts in cloud applications can be time consuming for both the IT department and the end user. System administrators must manually create accounts for users, which often delays users having access for days and not being able to get their work done. With an automated cloud identity management solution, user accounts are automatically created, modified, enabled or disabled via a synchronization with the HR system. The helpdesk or manager handling the process can easily make changes in one place and automatically synchronize these changes to all cloud applications.
Security
When an organization begins to use several cloud applications, it often becomes difficult to determine that the correct people have the correct access to systems and applications. Users may have access to systems and applications that they shouldn’t, leaving data vulnerable to breach. With a role-based access control (RBAC) module, for example, system administrators can easily control access to the company’s cloud applications on the basis of an employee’s department or job title based on records from the human resource system. So doing, ensures that each employee has the correct access to systems, even in cloud applications.
Password issues
Passwords often become a problem when implementing numerous cloud applications. Since IT administrators need to manage passwords for countless users, who often have trouble remembering several sets of credentials, the responsibility falls on the IT department to deal with resetting these passwords when users forget them. A cloud SSO solution can be used so that end users only must remember one set of credentials for all of their cloud applications, which can be based on their existing Active Directory credentials. If for any reason a password needs to be reset, it can be changed in one place, Active Directory, and then be automatically synchronized with all cloud applications.
Audit
As more cloud applications are deployed in an organization, the need for reporting of whom is using what applications and systems become paramount. The complexity of managing this process is increased by the number of cloud applications deployed and the number of users accessing the systems. A centralized dashboard can be used in an automated identity management solution to easily see on overview of usage and logging in. This allows management to easily review the report for auditing purposes, as well as controlling license costs.
Overall, cloud IAM solutions offer benefits to end users, IT departments and even management. End users are able to receive their account access quickly and not have to wait to perform their jobs if locked out and IT has full control over the applications and authorizations without having to spend countless hours on account management.
For management, audit and compliance is made easier because of the solutions. They don’t need to spend money on expenses in relation to the applications or the helpdesk, and are able to receive the full benefits of using cloud applications as originally expected.
For more information, please visit our website.
Using cloud applications surely can impact the security, compliance and IT-related cost savings of an organization. In relation to identity and access management, when several cloud applications are implemented, provisioning, password management and the monitoring of access begins to become quite a challenge. Because of this, organizational leaders should seriously consider implementing an automated cloud identity management solution if they’re using or making a move.
Auto provisioning
Creating accounts in cloud applications can be time consuming for both the IT department and the end user. System administrators must manually create accounts for users, which often delays users having access for days and not being able to get their work done. With an automated cloud identity management solution, user accounts are automatically created, modified, enabled or disabled via a synchronization with the HR system. The helpdesk or manager handling the process can easily make changes in one place and automatically synchronize these changes to all cloud applications.
Security
When an organization begins to use several cloud applications, it often becomes difficult to determine that the correct people have the correct access to systems and applications. Users may have access to systems and applications that they shouldn’t, leaving data vulnerable to breach. With a role-based access control (RBAC) module, for example, system administrators can easily control access to the company’s cloud applications on the basis of an employee’s department or job title based on records from the human resource system. So doing, ensures that each employee has the correct access to systems, even in cloud applications.
Password issues
Passwords often become a problem when implementing numerous cloud applications. Since IT administrators need to manage passwords for countless users, who often have trouble remembering several sets of credentials, the responsibility falls on the IT department to deal with resetting these passwords when users forget them. A cloud SSO solution can be used so that end users only must remember one set of credentials for all of their cloud applications, which can be based on their existing Active Directory credentials. If for any reason a password needs to be reset, it can be changed in one place, Active Directory, and then be automatically synchronized with all cloud applications.
Audit
As more cloud applications are deployed in an organization, the need for reporting of whom is using what applications and systems become paramount. The complexity of managing this process is increased by the number of cloud applications deployed and the number of users accessing the systems. A centralized dashboard can be used in an automated identity management solution to easily see on overview of usage and logging in. This allows management to easily review the report for auditing purposes, as well as controlling license costs.
Overall, cloud IAM solutions offer benefits to end users, IT departments and even management. End users are able to receive their account access quickly and not have to wait to perform their jobs if locked out and IT has full control over the applications and authorizations without having to spend countless hours on account management.
For management, audit and compliance is made easier because of the solutions. They don’t need to spend money on expenses in relation to the applications or the helpdesk, and are able to receive the full benefits of using cloud applications as originally expected.
For more information, please visit our website.
Friday, August 8, 2014
How two factor authentication can easily add security for access
Organizations large and small can easily add security to their login procedures with two-factor authentication, which is a simple process that requires users to enter more than one piece of information to access accounts. For example, in addition to simply entering a user name and password, two-factor authentication requires use of another identifier, such as a smart card or a PIN code.
Major organizations are making use of two-factor authorization — Twitter and Google. And while its primary goal is to improve security of systems and applications, the solutions also provide additional features that can be of benefit to all organizations. Here are some of the uses, and features, of two-factor authentication that can benefit employees and their organization:
Easily customizable: System administrations can customize the two-factor authentication process to meet their needs. For example, rules can be created that mandate that during the time a user is logged into an organization’s systems, his smart card also must be in the reader the whole time the employee is working. In this scenario, if the user removes the card he is then automatically logged out of the system. On the other hand, rules also can be written that requires a user to present the card for a few seconds when first logging in for him to access all needed systems.
PIN code memory: Though end users have to enter a PIN code for two-factor authentication, the internal systems have the ability to remember PIN codes for a defined period of time. Users then only have to enter their PIN code once when first logging into the computer at the beginning of the workday and not again after that. Each time after, during the same day, employees or users only have to present their smart card to access systems and not their PIN. This ensures that systems are secure, but does not inconvenience users by requiring them to enter both the PIN code and card each time they login.
Self-service registration: When first implementing smart card use, end users can securely register their smart cards themselves, taking the burden off of the IT department. Once a user inserts his card, which is not registered into the reader, it will enable a user to assign their username and password to this card.
Advanced authentication for resetting passwords: Two-factor authentication can be used to enable users to reset their own passwords. In addition to answering a series of questions that they previously provided answers to, end users can be sent a code via SMS or email that they will have to enter before being able to reset their passwords.
PIN code sent via email or SMS: The PIN code or password that end users provide as one source of authentication does not have to be something that the user actually remembers; nor does it have to be the same password every time. A password PIN can be automatically generated and sent to the user via text message to her cell phone or to her email account, which she then inputs to gain access to her account.
For more information, please visit our website.
Major organizations are making use of two-factor authorization — Twitter and Google. And while its primary goal is to improve security of systems and applications, the solutions also provide additional features that can be of benefit to all organizations. Here are some of the uses, and features, of two-factor authentication that can benefit employees and their organization:
Easily customizable: System administrations can customize the two-factor authentication process to meet their needs. For example, rules can be created that mandate that during the time a user is logged into an organization’s systems, his smart card also must be in the reader the whole time the employee is working. In this scenario, if the user removes the card he is then automatically logged out of the system. On the other hand, rules also can be written that requires a user to present the card for a few seconds when first logging in for him to access all needed systems.
PIN code memory: Though end users have to enter a PIN code for two-factor authentication, the internal systems have the ability to remember PIN codes for a defined period of time. Users then only have to enter their PIN code once when first logging into the computer at the beginning of the workday and not again after that. Each time after, during the same day, employees or users only have to present their smart card to access systems and not their PIN. This ensures that systems are secure, but does not inconvenience users by requiring them to enter both the PIN code and card each time they login.
Self-service registration: When first implementing smart card use, end users can securely register their smart cards themselves, taking the burden off of the IT department. Once a user inserts his card, which is not registered into the reader, it will enable a user to assign their username and password to this card.
Advanced authentication for resetting passwords: Two-factor authentication can be used to enable users to reset their own passwords. In addition to answering a series of questions that they previously provided answers to, end users can be sent a code via SMS or email that they will have to enter before being able to reset their passwords.
PIN code sent via email or SMS: The PIN code or password that end users provide as one source of authentication does not have to be something that the user actually remembers; nor does it have to be the same password every time. A password PIN can be automatically generated and sent to the user via text message to her cell phone or to her email account, which she then inputs to gain access to her account.
For more information, please visit our website.
Friday, August 1, 2014
Continual IT Audits
Information audits are inconvenient, unpleasant and rarely fun. They are a headache because of the fact that when audit season comes around, they take resources away from several departments for extended periods of time while staff managing and leading them also must continue their other daily roles. Unfortunately, there is no getting around an audit, whether internal or external.
Several major compliance regulations in the United States including the Health Insurance Portability and Accountability Act (HIPAA), the Control Objectives for Information and Related Technology (COBIT) and Sarbanes Oxley Act (SOX) require businesses to ensure certain standards within their organizations, including protection of data and full disclosure. Organizations that do not comply face significant fines and potential punishment.
Since audits are mandatory, organizations need to instead find ways that make dealing with them simpler. This is why organizational leaders should instead focus on conducting continual audits or implementing solutions that can help them stay in line with their audit needs throughout the year. This allows them to perform the work for audits along the way instead of having to do it all at once.
Instead of an annual audit check followed by an extensive clean-up operation, several leading organizations are implementing solutions that allow them to exercise constant control over the identities in their networks, their lifecycles and their authorizations.
Continual Audits
To achieve continual audits, some organizations have utilized identity and access management solutions. An automated account management solution with role-based access control (RBAC) allows a manager to oversee and document exactly who has access to what, and any changes they are making. With RBAC in place, managers can easily see an overview of access and correct any issues that arise. This also makes it extremely easy to provide a list of employees who have access to critical data when it comes to audit time.
These same automated account management solutions allow for other tasks to be continually documented for audits in an organized manner. The system automatically logs which employee performs a particular management activity, as well as the time it occurred. Management reporting can be generated in a wide variety of formats meaning the organization always has an insight into the processes involved and whether they are in compliance with regulations.
Case In Point
The Salvation Army had relied on an inefficient paper system prior to its automated solution. The paper system was almost impossible to audit. The automated account management solution has completely resolved this issue and the organization can now easily meet requirements.
According to the Salvation Army’s Christian Cundall, head of messaging services, the organization needed to introduce a solution for user management and auditing for simple reasons. “We were experiencing 1,000 calls a month to our helpdesk for user account-related changes. Any change requests needed to be confirmed via fax, resulting in a large paper trail, which was impossible to audit. The faxes often contained errors and omissions, adding to the workload placed on our helpdesk; 90 percent of the work needed to be duplicated.”
“We were impressed by the ability to force users to comply with our naming conventions, and provide a full log on all actions for auditing purposes,” said Cundall.
For more information, please visit our website.
Several major compliance regulations in the United States including the Health Insurance Portability and Accountability Act (HIPAA), the Control Objectives for Information and Related Technology (COBIT) and Sarbanes Oxley Act (SOX) require businesses to ensure certain standards within their organizations, including protection of data and full disclosure. Organizations that do not comply face significant fines and potential punishment.
Since audits are mandatory, organizations need to instead find ways that make dealing with them simpler. This is why organizational leaders should instead focus on conducting continual audits or implementing solutions that can help them stay in line with their audit needs throughout the year. This allows them to perform the work for audits along the way instead of having to do it all at once.
Instead of an annual audit check followed by an extensive clean-up operation, several leading organizations are implementing solutions that allow them to exercise constant control over the identities in their networks, their lifecycles and their authorizations.
Continual Audits
To achieve continual audits, some organizations have utilized identity and access management solutions. An automated account management solution with role-based access control (RBAC) allows a manager to oversee and document exactly who has access to what, and any changes they are making. With RBAC in place, managers can easily see an overview of access and correct any issues that arise. This also makes it extremely easy to provide a list of employees who have access to critical data when it comes to audit time.
These same automated account management solutions allow for other tasks to be continually documented for audits in an organized manner. The system automatically logs which employee performs a particular management activity, as well as the time it occurred. Management reporting can be generated in a wide variety of formats meaning the organization always has an insight into the processes involved and whether they are in compliance with regulations.
Case In Point
The Salvation Army had relied on an inefficient paper system prior to its automated solution. The paper system was almost impossible to audit. The automated account management solution has completely resolved this issue and the organization can now easily meet requirements.
According to the Salvation Army’s Christian Cundall, head of messaging services, the organization needed to introduce a solution for user management and auditing for simple reasons. “We were experiencing 1,000 calls a month to our helpdesk for user account-related changes. Any change requests needed to be confirmed via fax, resulting in a large paper trail, which was impossible to audit. The faxes often contained errors and omissions, adding to the workload placed on our helpdesk; 90 percent of the work needed to be duplicated.”
“We were impressed by the ability to force users to comply with our naming conventions, and provide a full log on all actions for auditing purposes,” said Cundall.
For more information, please visit our website.
Friday, July 11, 2014
The Three Sides to Data Security
n today’s complex corporate and business network environments, controlling access to sensitive data is of utmost concern. The amount of security-related data stored across a network is immense for many organizations, and relating all this data to the user’s account information in Active Directory can be tricky and time consuming.
There are really three sides to proper data security.
The first step is ensuring that new employee accounts are created with the proper access rights when an employee joins the organization. The second is making sure those access rights remain accurate during the employee’s tenure. The third is revoking all access rights when the employee leaves.
Let’s take a more in-depth look at solutions for all three of these phases of data security.
Defining A Role
By using a role-based access control matrix in conjunction with an identity management solution, companies can ensure that accounts for new employees are always created with proper access rights.
The first step of this stage is to define the roles that employees should have in the organization. This is usually a combination of department, location, and job title.
While establishing the data access rights, group memberships, and application requirements for each role can be time consuming, the end result will allow a template for both new employee creation and an audit point in the future.
Software applications are available that will allow the linking of a human resource system to Active Directory for automatic account creation with all proper rights. Additionally, if there are special requirements, a workflow system can easily be established to allow manager and system owners to process approvals before access is granted.
Managing Access and Security
Access rights to data often tend to creep into multiple areas over an employees’ tenure with an organization.
For example, rights are assigned to one employee for special projects while one employee is covering for another on leave or when an employee changes departments and responsibilities. The revocation of these special or historical rights occurs infrequently at best.
Again, software solutions are available to analyze the rights of employees and make the information actionable. For the product to provide value, there are several items that should be considered as mandatory including the ability to detect:
Once an audit of access rights is performed, it can be compared against the baseline template for each employee role initially established. Any deltas can then be sent to managers and systems owners for verification or revocation of the rights.
Revoking Access
The final step in the data security process is one that is often overlooked or not performed in a timely fashion: the termination of access rights to the network, data and all applications, including cloud-based solutions, must be accomplished immediately upon an employee’s termination.
For example: a terminated sales rep had his network access revoked immediately upon departure, but the organization did not have a process in place to disable access in a timely manner to a cloud-based business intelligence application. The terminated employee realized the account was still live and proceeded to download more than 10,000 records over the course of the next 30 days at a cost to the company of more than $6,000.
The point of this story: imagine the costs if 20, 30, or 100 terminated employees did this very same thing in a short period of time.
When putting a process in place to handle terminated employees, the most common scenario is, once again, a link to the HR system.
When an employee is terminated, a synchronization process needs to be in place to handle the decommissioning of accounts in all internal and external systems. If feasible, using web services or application programming interfaces (API’s) to automate the process will save time and money in the long run. Where not feasible, an email workflow process should be established whereby system owners are notified to terminate the account and positive feedback required to establish the work has been completed.
It is imperative that organizations implement the necessary security measures to insure that access to data, groups and applications are right sized for an employee during their tenure. Equally critical is the revocation of all account access when they depart. Failure to meet these criteria can lead to theft of secure data and costly access to external applications.
For more information, please visit our website.
There are really three sides to proper data security.
The first step is ensuring that new employee accounts are created with the proper access rights when an employee joins the organization. The second is making sure those access rights remain accurate during the employee’s tenure. The third is revoking all access rights when the employee leaves.
Let’s take a more in-depth look at solutions for all three of these phases of data security.
Defining A Role
By using a role-based access control matrix in conjunction with an identity management solution, companies can ensure that accounts for new employees are always created with proper access rights.
The first step of this stage is to define the roles that employees should have in the organization. This is usually a combination of department, location, and job title.
While establishing the data access rights, group memberships, and application requirements for each role can be time consuming, the end result will allow a template for both new employee creation and an audit point in the future.
Software applications are available that will allow the linking of a human resource system to Active Directory for automatic account creation with all proper rights. Additionally, if there are special requirements, a workflow system can easily be established to allow manager and system owners to process approvals before access is granted.
Managing Access and Security
Access rights to data often tend to creep into multiple areas over an employees’ tenure with an organization.
For example, rights are assigned to one employee for special projects while one employee is covering for another on leave or when an employee changes departments and responsibilities. The revocation of these special or historical rights occurs infrequently at best.
Again, software solutions are available to analyze the rights of employees and make the information actionable. For the product to provide value, there are several items that should be considered as mandatory including the ability to detect:
- Direct access to a file/directory rather than access through a group membership.
- Access to a file/directory through multiple or nested group memberships.
- Groups and user accounts that are no longer present in Active Directory.
- Duplicate access privileges to a file/folder of a user or user group.
- Access to files/directories through a local or file system user account.
Once an audit of access rights is performed, it can be compared against the baseline template for each employee role initially established. Any deltas can then be sent to managers and systems owners for verification or revocation of the rights.
Revoking Access
The final step in the data security process is one that is often overlooked or not performed in a timely fashion: the termination of access rights to the network, data and all applications, including cloud-based solutions, must be accomplished immediately upon an employee’s termination.
For example: a terminated sales rep had his network access revoked immediately upon departure, but the organization did not have a process in place to disable access in a timely manner to a cloud-based business intelligence application. The terminated employee realized the account was still live and proceeded to download more than 10,000 records over the course of the next 30 days at a cost to the company of more than $6,000.
The point of this story: imagine the costs if 20, 30, or 100 terminated employees did this very same thing in a short period of time.
When putting a process in place to handle terminated employees, the most common scenario is, once again, a link to the HR system.
When an employee is terminated, a synchronization process needs to be in place to handle the decommissioning of accounts in all internal and external systems. If feasible, using web services or application programming interfaces (API’s) to automate the process will save time and money in the long run. Where not feasible, an email workflow process should be established whereby system owners are notified to terminate the account and positive feedback required to establish the work has been completed.
It is imperative that organizations implement the necessary security measures to insure that access to data, groups and applications are right sized for an employee during their tenure. Equally critical is the revocation of all account access when they depart. Failure to meet these criteria can lead to theft of secure data and costly access to external applications.
For more information, please visit our website.
Subscribe to:
Posts (Atom)