HPL Identity Analytics – Next Generation

After the good success of HPL Identity Analytics case studies and its transfer to Vistorm (in the broader context of Security Analytics), it is now time to think about new potential application areas in the IAM space and even beyond, including governance and assurance aspects.

Some customers’ input highlights the need to better understand the lifecycle management of privilege users. This is a critical aspect with major implications in terms of organisational’s risk exposure.

In this context, we are interested in exploring organisational processes that are complementary to the operational ones, including Personnel Vetting, Compliance Checking, Job Design and SoD Management.

Other application areas for our Analytics approach are in the cloud computing environment, e.g. exploring the impact of adopting different IAM models and approaches in the cloud (public and private) in terms of risks, productivity, compliance, costs, etc.

Does this community has any particular area/topic, in the IAM space, that is perceived being critical and worth exploring?


--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Identity and Access Management: The Next Big Thing …

One of the drivers and motivations of this blog is to debate and explore the evolution of Security and Identity and Access Management (IAM) – beyond the current solutions and approaches – and identify new trends and opportunities.

Let’s focus on the IAM area – at least in this blog post.

I must say that in the last 5 years there has been a strong consolidation of the IAM offerings and suites available on the market. They are pretty much equivalent as they offer similar functionalities in a well defined set of areas.

A promising area (perceive as the next big thing, 3-5 years ago), Identity Federation Management, has not really (yet) taken off, as far as I know, outside enterprise environments and for low-risk transactions on the web. New challenges posed by access control and identity management in the Cloud might indeed revamp this area, but it has to be fully proven …

Is “classic” IAM rapidly commoditising? I really think so … Are there major margins of growth for traditional IAM solution providers? I am not convinced (but I’ll like to hear about rigorous and substantiated market forecasts …).

So, what is the next big thing in this space? What is really going to change the IAM landscape and differentiate from what is currently out there?

This is a question open to all readers. Feel free to send your views and opinions.

Here are my initial thoughts.

First of all, it would be more correct to think about what “the next big thing” is going to be for specific verticals (e.g. consumers, enterprises, etc.) …

In the context of enterprises, I am currently reflecting on various inputs and experience that I am maturing by interacting with customers and consultants.

Organisations are increasingly questioning the large and expensive investments in the IAM space. The classic message that “you should buy this IAM suite and related service as it will help you reduce costs & risks and increase productivity (trust us)” is not going down so well anymore. From what I understand, customers increasingly want a clear assessment and evidence underpinning these statements.

This is more and more reflected by an approach to IAM driven by rigorous Risk Assessment – driven by business awareness, knowledge of suitable trade-offs and an understanding of the risk appetite of the organisation as well as the threat landscape. Decision makers in this space are moving up the management ladder, from the lower-level IT/CISO office to Risk Managers and/or CIOs.

Today risk assessment and investment decisions are achieved with ad-hoc approaches by using (effective but) general purpose Risk Assessment frameworks, such as ISO 2700x and equivalent. How to simplify this process? How to provide fine-grained risk assessment that takes into account the analysis of various options and scenarios as well as providing what-if analysis? How to evaluate the actual appropriateness and impact in investing on specific IAM controls? How to package all this as a service to be offered (among others) for making informed decisions in the IAM space?

I am more and more convinced that one of the next big things in IAM will be in addressing this gap, i.e. providing a simplified, rigorous and scientific approach to evaluate risks in organisations and pinning down (among other security aspects) to the suitable IAM investments and solutions, tailored to the specific organisational realities.

This is what we are exploring at HP Labs, in the broader space of security, with Security Analytics and, for IAM, in the specific context of HP Labs Identity Analytics.

I am very interested in your opinion and the (inevitable) different views of what the next big thing in IAM is going to be …


--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Applied HPL Identity Analytics: Personnel Vetting Processes

In the context of our Security Analytics work (in particular of HP Labs Identity Analytics) I am looking for public documentation, links and information about how personnel vetting processes are currently carried out in the industry.

Some interesting examples (discussing at high level the steps to get different degrees of security clearance), of relevance to governmental environments, are the following:

• http://www.security-clearance.org.uk/
• http://www.cabinetoffice.gov.uk/media/111428/spf.pdf
  

The vetting process is indeed very important in reducing organisational risks and in making informed decisions on which credentials and access rights to give to personnel. It complements other two aspects that have been previously discussed in this blog:

• Operational aspects: provisioning and deprovisioning processes
• Governance aspects: monitoring, compliance checking and audit

The idea is to use our HP Labs Identity Analytics methodology and tools to model this process and explore the involved risks as well as tension points between business managers/stakeholders (requiring personnel as fast as possible to deal with their business needs) and risk/security assessors (requiring that full due diligence is carried out before granting any access to personnel) – by identifying suitable metrics.

We believe our analytic models can be used not only to explore potential policy compromises (what happens if we relax our vetting policies on certain aspects) and their impact on risk, but also to assess how realistic some of these policies are (i.e. how likely, given the current processes, that they are going to be violated).

Any input on documentation and references is really welcome.

In addition, we are keen in identifying 1-2 potential serious candidates (medium/large organisations) that would be interested in trialling this Identity Analytics activity, in a joint case study with HP Labs.

Identity Analytics as a Service: Packaging Solutions for Risk Assessment in IAM

As I mentioned in a previous blog post of mine, we successfully delivered an analytic assessment of the risk related to the IAM operational processes for a major HP customer. This provided good insights and key taking points to the customer as well as useful feedback for our Security Analytics work, in particular in the context of HP Labs Identity Analytics.

On one hand we are now liaising with HP businesses in order to transfer this as a service, by packaging our IAM analytic solutions. Some exciting activities are happening with Vistorm and other HP businesses in this space.

On the other hand, I am interested in further expanding the Identity Analytics offering, beyond the risk assessment for provisioning and deprovisioning processes.

More specifically, I aim at creating “various analytic” templates for different critical IAM areas which will be part of the overall “Identity Analytics as a Service” offering and will be used to address specific customer needs.

Based on various inputs received from customers (and from our analysis), a few critical areas have already emerged as relevant for a full assessment of the associated risks. This includes:

Vetting and accreditation processes, specifically for critical users
Compliance checking and governance processes
SoD assessment processes

Of course these three areas go beyond IAM, but they have a specific and important impact on this area.

I am in the process of gathering insights about these key processes, various involved steps and potential failure points. The aim is to model them, define metrics to convey the involved risks and provide decision support to customers by means of “what-if” analysis (simulations).

Your help would be appreciated if you could provide input and/or any public information/links/documents/requirements about:

The above three areas. Which types of process steps are currently in place? Any case study?
Additional areas, related to IAM, you believe you/your customers might be interested in assessing in order to determine their risk exposure


--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Security Analytics as a Service - Important IAM Case Study Successfully Delivered

Good news. We successfully delivered an important case study in Security Analytics, in the context of IAM (provisioning and deprovisioning processes) for a major customer (no details can be provided due to confidentiality agreements).

This consisted of a detailed risk assessment analysis of their current IAM access management processes – based on agreed metrics – and a related “what-if” analysis of the consequences of adopting degrees of IAM automation.

This provided good insights and key taking points to the customer as well as useful feedback for our Security Analytics work, in particular in the context of HP Labs Identity Analytics.

We indeed want to run Security Analytics as a business Service. In this context, Vistorm is going to play a key role, as described here. Specifically, for Security Analytics applied to IAM, we can think at “Identity Analytics as a Service”.

I can see two main threads of coming activities:

• Paid Security Analytics Services (carried out by Vistorm, in collaboration with HP Labs) – for standard security analytics assessments, in IAM areas that have already been templated and explored
• Exploratory case studies (lead by HP Labs, in collaboration with Vistorm) in IAM areas that require additional investigations, for examples a few leading-edge ones, discussed here
  

Security Analytics as a Service - in particular in the context of IAM, is going to help strategic decision makers to clarify their priorities and support their decisions, in processes and investments that quite often are in the order of million of dollars.


--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Applying HP Labs Identity Analytics to the IAM area

In two recent posts of mine, I provided additional information about what the HP Labs Identity Analytics is and how it relates to the Security Analytics initiative.

In the past three years we have been doing a lot of work in applying this methodology and approach (along with out tools) to different IAM areas.

At this stage, I thought it would be of interest to share additional details about some of these areas of relevance where HP Labs Identity Analytics has been successfully used and how this has been achieved. This includes:

• Access Management area: in a few case studies carried out with customers we explored their current access management processes, inclusive of their provisioning and deprovisioning processes. We investigated aspects of concerns, such as their risk exposure and productivity – by agreeing specific metrics. We kept into accounts tradeoffs of relevance to the customers. We considered risk exposure due to: privileged hanging accounts generated by process failures, misbehaviours by employees and managers, steps that could be easily bypassed. We factored in the implications due to specific threat environments. We used modelling and simulations to deal with “what-if” analysis, for example by adding more IAM automation or changing some of the existing processes, etc.
• Compliance Checking and Auditing area: we explored the effectiveness of an organisation compliance checking teams, their capabilities in identifying and remediating violations and failures (e.g. SOX compliance), based on assumptions coming from the fields, such as applications and services involved, population of users and their accounts, likelihood of failures in the process of managing access rights, etc. We used modelling and simulations to compare and contrast the outcomes of these compliance checking processes against auditing processes, to identify ways of further improvements
• Data Leakage: we used modelling and simulation to investigate how employees use, store, handle and disclose confidential data and the overall impact in terms of data leakage. We considered the organisational data flows, involving people, systems and organisational groups. We factored in the risk mitigation introduced by existing organisational controls (e.g. DRM, encryption, interception and filtering of emails). We explored how changes in processes, behaviours and control points affect the organisational data leakage. Specific areas of investigation have been around the adoption of (1) social networking by employees and (2) usage of collaborative/sharing tools and the impact on data leakage.
• Job Design: we used modelling and simulations to explore the implications of specific job designs, i.e. the impact that the definition of roles and the association of access rights (for a population of workers) has on an organisation, under different assumptions and hypothesis. Specifically we investigated the impact in terms of risks and how changes can affect this risk – by keeping into account operational constraints, people skills and potential threats
• Password Management: we used social studies, coupled with modelling and simulations to explore the impact that people’s behaviours, system constraints and organisational policies have on passwords and their management. We investigated the risk exposure that organisations have, as a consequence of this, and how this risk could vary by changing some of the involved factors, such as password policies and IT control points.
  

Additional areas I am currently exploring (from an R&D perspective) include:

• Cloud computing, impact and effectiveness of related IAM solutions in managing accounts and protecting resources - from the perspective of different stakeholders
• Identity and Privacy assurance: which most suitable approach to adopt to increase the level on assurance on how identities, credentials and personal data are used, managed and disclosed – from the perspective of different stakeholders
• Role of Federated Identity Management, within and across organisations. Impact on productivity, costs and risk exposure
• Role of different Authentication mechanisms and their actual impact both in terms of mitigating risks and dealing with productivity & costs aspects
• Economics of IAM
  

Again, various case studies, investigations and analysis have been carried out with a top-down approach, driven by customers’ needs, their questions/problems and an understanding of the involved business and IT processes, people behaviours and threat environment.

Additional public material on our HP Labs Identity Analytics work can be found here.


--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

On Security Analytics: Putting the Science into Security Management

In a previous post of mine, I mentioned the Security Analytics initiative. I promised to provide more details. Here they are.

I attach a datasheet called “Security Analytics: Putting the Science into Security Management”, by Vistorm (an HP Company).

The IAM area (and the HP Labs Identity Analytics activity) is covered in Security Analytics. Hopefully the datasheet will provide more details.

Here is an extract from the introduction:

“As the pressure on business increases so does the complexity of the security challenges. As a result security teams are finding it increasingly harder to achieve, measure and communicate a measurable reduction in business risk.

So how should a security team determine the best possible strategy: How much should be spent; what should be prioritised; what trades-offs to accept between lowered risk and business disruption; how to champion and justify security decisions to the business?

Vistorm, an HP Company and HP Labs have a shared vision for next generation security management: one that helps our clients achieve a measurable reduction in business risk along with a lower long term investment in information security.

Security Analytics is at the heart of this vision and is about creating tools and methodologies to address rigorously the challenges that security teams face in driving more effective security strategies. …”

Here are more details about the currently available Packaged Security Analytics:

“By combining Vistorm’s expertise in security governance with HP Labs’ expertise in security research we are able to offer a packaged consulting engagement featuring repeatable, short term engagements to address security management challenges (people, process, policy and technology) in two key areas:

• Vulnerability and threat management (VTM), and
• Identity and access management (IAM).

The value of these engagements is:

• a rigorous exploration of your (VTM or IAM) system, with prediction and ‘what-if’ capabilities
• shared multi-stakeholder understanding of the business and security trade-offs
• justified decision making
• the introduction of science into your information security management system (ISMS), and the opportunity to expand.”

--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

HP Labs Identity Analytics – What is this all about?

Thanks to the readers that sent me many comments and questions about my recent post about HP Labs Identity Analytics.

An interesting request I received was to provide more details about HP Labs Identity Analytics and compare and contrast it against other initiatives using a similar “label”.

Indeed, the “Identity Analytics” label is becoming more and more a buzzword, with different meanings depending on who uses it.

In the context of HP Labs (HPL), Identity Analytics is part of the wider Security Analytics R&D project and initiative aiming at providing strategic decision support in the (information) security space.

In a coming post I will describe, in more details, how HP Labs are currently transferring Security Analytics (inclusive of Identity Analytics), its approach, methodology and related tools to HP business groups and the kind of services to be provided to customers.

However, in this post, I am going to address the request mentioned above.

So what is “HPL Identity Analytics” all about? How is it different from other initiatives?

Let’s start by discussing what HPL Identity Analytics is about.

As mentioned in past blogs, HPL Identity Analytics aims at providing strategic decision support to security decision makers (e.g. CISOs) in the space of IAM.

HPL Identity Analytics has so far used in case studies and customer engagements.

We start by understanding customers’ problems and their key questions. For example: what is the risk exposure of my company, related to the management of access control and access rights? How effective are my IAM provisioning and deprovisioning processes? What are the implications of increasing/decreasing my IAM investments, in terms of productivity, security risks, compliance and costs? Which degree of risk mitigation is actually introduced? Which IAM investment trade-offs should I consider?

By using modelling techniques we represent, with a rigorous and scientific approach, current organisational IAM processes (e.g. access management processes, provisioning/deprovisioning, authentication and authorization approaches, compliance management, auditing, etc.) their impact on underlying IT infrastructures, people behaviours and various implications due to internal and external threats. We capture the core cause-effect relationships that are at the base of process failures and of relevance to a variety of concerns, including risk exposure, productivity, costs, etc.

We jointly define the metrics and measures with the customers to ensure that we can convey the relevant findings and outcomes in a way that actually address their questions and problems.

We develop models in collaboration with the customers, by understanding their processes and operational contexts. We iterate models and use simulations to ensure they are representative of the reality.

Then, we use our modelling to carry out what-if analysis, i.e. to explore different scenarios, where, for example, we simulate the introduction of new IAM controls or process changes. We convey the outcomes to the customers by means of report, to create awareness of the implications of their potential choices.

For more information, please read some of the technical reports and documentation available here.

So how is HP Labs Identity Analytics different?

Our approach is top down.

Most of the other approaches are bottom-up. They aim at collecting and processing large amounts of data from the IT infrastructure and IAM solutions. They use business intelligence to aggregate data and present it.

These approaches are definitely valuable and work fine if you have full control of the IT infrastructure, if all your systems are instrumented and if the deployed solution is pervasive. However, my personal experience (based on some evidence gathered from customers …) is that most organisational realities are far from this ideal situation. Different organisational groups within enterprises can have different IAM processes in place, ranging from ad-hoc to automated ones. Different IAM solutions might have been deployed. There is scarcity of information. Processes can be broken, bypassed or adapted to needs. Furthermore, in many cases only coarse grained assumptions are made about the potential (internal and external) threats, their actual impacts and how the current controls effectively address them, on ongoing bases.

In these cases, I believe that it might be problematic making sense of what actually happens in the organisation just with a bottom-up approach. As an analogy, it would be like trying to understand what a complex, distributed solution does at the business level, by trying to analyse snippets of assembler code …

With the top-down Identity Analytics approach, developed at HP Labs, we focus on the root causes; we capture the essence of the involved processes, people behaviours and threats. We model the cause-effect relationships that are of relevance to answer the problems highlighted by the decision makers.

We indeed need data coming from the field (empirical data), however this data consists of very specific information, relevant to describe the processes and modelled entities. In absence of data, various hypotheses are explored, with “what-if” analysis.

In summary, we are talking about two different approaches to Identity Analytics, the HP Labs’ one being the only one (I am aware of) that comes from a top-down perspective.

I personally believe that the best of the two approaches (top-down and bottom up) should be combined and dynamically tuned together, to fully address customers’ needs, based on their specific contexts and organisational situations.

--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---