Simply Security - News, Views, and Opinions from Trend Micro

Posted on October 10th, 2012 in Internet Safety, Spotlight by Simply Security | Be the first to comment | Tags: Internet Safety, Spotlight

Identify and access management systems are critical for network security.

While network security is a vital aspect of business operations, there are multiple tiers that decision-makers must deal with on a regular basis. Identity and access management (IAM) is one of the most important factors when developing a robust data security program, as IT executives can only be sure their valuable digital assets are safe when they know who is accessing them and why.

While IAM has many challenges, one of the most prominent issues is that it has varying definitions among different people, according to InformationWeek Reports. Some security professionals see IAM as authorizing identities through multiple credentials as they make their way deeper into the infrastructure, while others see it as single sign-on.

"IAM is really about two things: first, making sure the 'good guys' have ready access to the things they need to do their jobs and, second, making sure the 'bad guys' don't. That's it," the report said.

Identity is the differentiation between these two parties, while access is determining how deep into the labyrinth these individuals can go.

Critical IAM factors necessary for strong data protection

IAM needs to apply across the entire infrastructure and virtual environment in the case of cloud computing. Neglecting to deploy IAM checkpoints will create vulnerabilities in the network, increasing the chance of data loss or intrusion, InformationWeek Reports said. There are several key concepts that need to be added to the IAM strategy to ensure only the appropriate users access sensitive solutions. These include, among others, authentication, authorization, identity, monitoring, provisioning and deprovisioning.

Identity is the basis of all IAM strategies, as it is the digital representation of a specific user while in the network. All other IAM processes revolve around an individual's identity. Authentication, for example, is the action completed that ensures an employee's computerized identity matches the one claimed to it, InformationWeek reported. The authorization procedure then provides access to a specific user based on their credentials, identity and availability to sensitive data.

Monitoring, provisioning and deprovisioning processes are all central aspects of data protection, as companies will lose control over their networks without these routines. Monitoring is widely recognized as observing any behavior in the infrastructure, ensuring users don't do anything out of the norm and potentially create security issues. If any problems do arise, IT departments can take away a user's digital identity through the deprovisioning process, InformationWeek Reported noted. Provisioning, on the other hand, is assigning credentials to specific employees.

Ensuring IAM systems work appropriately

While the concept of IAM may seem promising, only proper implementations of the concepts will reap any positive results.

"There is no shortage of technologies that support particular goals of identity but there's no one product that 'solves' the identity problem," the report said. "Instead, like everything else worth doing, it's about planning and strategy. The strategy you come up with should drive product selection."

A separate report by CIO also noted that decision-makers need to frequently audit their IAM systems to ensure they continually meets business and employee demands. IT executives should be able to provide trails showing which users accessed what aspects of the network and why. By correctly leveraging monitoring tools, organizations can guarantee they have the ability to observe operations inside the network. If a company fails to deploy the proper auditing tools, it will not be able to ensure the infrastructure is safe from malicious outsiders, insiders or negligent employees.

Data Security News from SimplySecurity.com by Trend Micro