I recently gave a presentation at the IEEE Policy 2011 Symposium, about “Risk Assessment and Decision Support for Enterprise Security Policies”. Good discussions and debates.
My presentation is now available online. The abstract of the related paper follows:
“This paper presents and discusses our work to provide organizations with risk assessment and decision support capabilities when dealing with their strategic security policies. We aim at achieving this by using a rigorous and scientific methodology (and tools) which leverages modeling and simulation techniques. This methodology helps organizations to assess their risk exposure. It factors in policy implementation at the operational level along with relevant threats, processes, interactions and people behaviors. It provides “what-if” analysis by illustrating the consequences of making policy changes and investments. We introduce our methodology and tools and then illustrate how this approach has been successfully used in a real case study with one of our major customers. This case study focused on the organization’s access management processes and related policies: it helped to inform strategic security policies and support changes of current processes. Additional work is planned in this space.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Showing posts with label Identity Analytics. Show all posts
Showing posts with label Identity Analytics. Show all posts
Friday, July 1, 2011
Wednesday, March 9, 2011
Security and Identity Analytics
I have got a paper accepted at the coming IEEE Policy 2011 Symposium.
This paper is based on a recent HPL Technical Report I published, on “Risk Assessment and Decision Support for Security Policies and Related Enterprise Operational Processes”.
Looking forward at presenting this work.
Interestingly, this paper describes work that we did jointly with a major HP customer, in the space of Security Analytics and Identity Access Management.
This work de-risked Security Analytics in this area: it is now one of the Security Analytics capabilities offered as a service by HP Information Security.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
This paper is based on a recent HPL Technical Report I published, on “Risk Assessment and Decision Support for Security Policies and Related Enterprise Operational Processes”.
Looking forward at presenting this work.
Interestingly, this paper describes work that we did jointly with a major HP customer, in the space of Security Analytics and Identity Access Management.
This work de-risked Security Analytics in this area: it is now one of the Security Analytics capabilities offered as a service by HP Information Security.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Friday, August 20, 2010
Applying Security/Identity Analytics to Cloud Computing
In previous posts of mine, I provided additional information about what the HP Labs Identity Analytics is and how it relates to the Security Analytics initiative. I then provided an overview of various IAM areas where to apply Identity and Security Analytics.
Related to this, an interesting area where Identity/Security Analytics can be applied is Cloud Computing.
Organisations (and their decision makers) need to make decisions about adopting cloud-based resources and services in their businesses. They need to explore relevant trade-offs, i.e. lower costs (and perhaps better efficiency) vs. potentially losing control on IT and exposing themselves to additional threats and risks.
In this context, IAM solutions and emerging related frameworks can provide some of the required controls (e.g. via trusted federation, cloud-based compliance and assurance management, etc.).
On the other hand, the IAM frameworks and solutions we know are too enterprise-biased/focused: IAM needs to go through a profound transformation to fully address the needs and requirements of managing identities, profiles and user access rights in cloud environments.
This without keeping into account that individuals - both as private people and employees - are themselves increasingly making decisions about adopting cloud computing solutions for personal and work related matters (consumerisation of the enterprise).
I discussed some of these concepts and dynamics in previous presentations, such as “The Future of Identity in the Cloud” and “The Future of the Information Society”
Security/Identity Analytics can help to explore these trade-offs, related investment options and threats.
Furthermore, Security/Identity Analytics can be used to explore “what-if” scenarios, based on different assumptions and risk mitigation capabilities introduced by different IAM frameworks and other related controls (based on different models and assumptions).
I indeed believe that there is a need for a more rigorous, scientific analysis of this space as well as a better understanding of the impact of various IAM approaches in the Cloud and their actual added values.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Related to this, an interesting area where Identity/Security Analytics can be applied is Cloud Computing.
Organisations (and their decision makers) need to make decisions about adopting cloud-based resources and services in their businesses. They need to explore relevant trade-offs, i.e. lower costs (and perhaps better efficiency) vs. potentially losing control on IT and exposing themselves to additional threats and risks.
In this context, IAM solutions and emerging related frameworks can provide some of the required controls (e.g. via trusted federation, cloud-based compliance and assurance management, etc.).
On the other hand, the IAM frameworks and solutions we know are too enterprise-biased/focused: IAM needs to go through a profound transformation to fully address the needs and requirements of managing identities, profiles and user access rights in cloud environments.
This without keeping into account that individuals - both as private people and employees - are themselves increasingly making decisions about adopting cloud computing solutions for personal and work related matters (consumerisation of the enterprise).
I discussed some of these concepts and dynamics in previous presentations, such as “The Future of Identity in the Cloud” and “The Future of the Information Society”
Security/Identity Analytics can help to explore these trade-offs, related investment options and threats.
Furthermore, Security/Identity Analytics can be used to explore “what-if” scenarios, based on different assumptions and risk mitigation capabilities introduced by different IAM frameworks and other related controls (based on different models and assumptions).
I indeed believe that there is a need for a more rigorous, scientific analysis of this space as well as a better understanding of the impact of various IAM approaches in the Cloud and their actual added values.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Tuesday, July 13, 2010
If “Identity Management is a Pain in the Backside” is Identity Analytics the Cure?
I fully agree with the content of this article, called “Identity management is a pain in the backside”.
The IAM area is complex. It requires huge investments (often millions of $) and usually it ends up with expensive deployed IAM solutions that only partially address the needs and mitigate the risk exposure of organisations.
In particular the provisioning and deprovisioning processes are critical as they expose organisations at many security risks. I have been hearing this message from many customers.
Part of the problem is that it is difficult, even for expert decision makers, to understand what the implications (and the impact) are of making decisions and investments in IAM. Various aspects should to be taken into account, including the relevant IAM and business processes, people behaviours, the threat environment, current IT infrastructure and systems, etc.
This is why at HP Labs are exploring approaches to address this type of issues, broadly in the context of security and, more specifically, in the context of IAM.
Our HP Labs Security and Identity Analytics methodology (and modelling & simulation tools) has already been validated in a few core case studies with customers from the financial and government environment.
I would like to remind that this Security and Identity Analytics approach is a top-down approach, based on a rigorous scientific methodology, to provide decision support to strategic decision makers: modelling and simulation techniques are applied to represent the involved processes, IT systems, people behaviours and threats. What-if analysis is carried out to explore options. This is different from more traditional bottom-up analytic approaches, aiming at providing support by analysing and correlating wide sets of low-level data.
As discussed in this blog post of mine, I am interested in applying Identity Analytics in a few additional case studies with customers.
Thanks to the many organisations and people that have already stated their interest in engaging in a case study. I am planning to wait 1-2 additional weeks and then I’ll choose 1-2 companies to start engaging with.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
The IAM area is complex. It requires huge investments (often millions of $) and usually it ends up with expensive deployed IAM solutions that only partially address the needs and mitigate the risk exposure of organisations.
In particular the provisioning and deprovisioning processes are critical as they expose organisations at many security risks. I have been hearing this message from many customers.
Part of the problem is that it is difficult, even for expert decision makers, to understand what the implications (and the impact) are of making decisions and investments in IAM. Various aspects should to be taken into account, including the relevant IAM and business processes, people behaviours, the threat environment, current IT infrastructure and systems, etc.
This is why at HP Labs are exploring approaches to address this type of issues, broadly in the context of security and, more specifically, in the context of IAM.
Our HP Labs Security and Identity Analytics methodology (and modelling & simulation tools) has already been validated in a few core case studies with customers from the financial and government environment.
I would like to remind that this Security and Identity Analytics approach is a top-down approach, based on a rigorous scientific methodology, to provide decision support to strategic decision makers: modelling and simulation techniques are applied to represent the involved processes, IT systems, people behaviours and threats. What-if analysis is carried out to explore options. This is different from more traditional bottom-up analytic approaches, aiming at providing support by analysing and correlating wide sets of low-level data.
As discussed in this blog post of mine, I am interested in applying Identity Analytics in a few additional case studies with customers.
Thanks to the many organisations and people that have already stated their interest in engaging in a case study. I am planning to wait 1-2 additional weeks and then I’ll choose 1-2 companies to start engaging with.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Sunday, July 4, 2010
Looking for a customer engagement (case study) in Security Analytics – IAM, Access Management & Provisioning/Deprovisioning Processes
I am in the process of successfully finalising a case study with a major HP customer, in the government area, in collaboration with Vistorm (an HP company).
The customer was interested in better understanding their current risk exposure due to their access management processes and the impact of adopting IAM automation.
An IAM case study has been jointly run to:
1. Identify suitable metrics to convey their risk exposure (e.g. in terms of verall time to provision/deprovision user accounts, impact of hanging accounts, shared accounts, super user accounts, etc.)
2. Model their current access management processes (specifically their provisioning and deprovisioning processes) and run simulations
3. Convey to the customer an estimate of their current risk exposure, based on shared assumptions
4. Model and simulate the impact on the risk exposure in case IAM automation were adopted
In this case study I used our HPL Security and Identity Analytics methodology, jointly with our modelling and simulation tools.
It really helped us to refine our approach, get a template of IAM provisioning/deprovisioning processes and the customer to have a better understanding of their risk exposure and impact of various investment options.
I am now looking for another “customer” (medium-large organisation, possibly), interested in running a similar case study, to have a second validation point and get further input, possibly in a different business context. As counterpart, you will an assessment of your IAM processes and a “what-if” analysis.
Please do not hesitate to contact me for any question and/or to get more details about engaging in a Security Analytics case study with HP Labs.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
The customer was interested in better understanding their current risk exposure due to their access management processes and the impact of adopting IAM automation.
An IAM case study has been jointly run to:
1. Identify suitable metrics to convey their risk exposure (e.g. in terms of verall time to provision/deprovision user accounts, impact of hanging accounts, shared accounts, super user accounts, etc.)
2. Model their current access management processes (specifically their provisioning and deprovisioning processes) and run simulations
3. Convey to the customer an estimate of their current risk exposure, based on shared assumptions
4. Model and simulate the impact on the risk exposure in case IAM automation were adopted
In this case study I used our HPL Security and Identity Analytics methodology, jointly with our modelling and simulation tools.
It really helped us to refine our approach, get a template of IAM provisioning/deprovisioning processes and the customer to have a better understanding of their risk exposure and impact of various investment options.
I am now looking for another “customer” (medium-large organisation, possibly), interested in running a similar case study, to have a second validation point and get further input, possibly in a different business context. As counterpart, you will an assessment of your IAM processes and a “what-if” analysis.
Please do not hesitate to contact me for any question and/or to get more details about engaging in a Security Analytics case study with HP Labs.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Part II: Looking for Case studies and information about (Security) Compliance Management Processes with Organisations
In a previous post of mine, I wrote that: “In the context of the HP Labs Security and Identity Analytics projects, I am interested in exploring how to use modelling and simulations to support decision makers in making strategic decisions on compliance management, within their organisations. …”
Thanks to all the people who provided their input and feedback.
I would like to clarify also a few points:
1. I am indeed looking for different case studies involving compliance management, e.g. for SOX, PCI, etc.
2. My specific interest is on the actual organisational processes and steps that have been put in place to deal with the compliance requirements.
The goal is to use our modelling and simulation approach to represent these processes and make further deductions, based on what-if analysis.
Of course, public case studies and/or non-confidential information is welcome in the context mentioned above.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Thanks to all the people who provided their input and feedback.
I would like to clarify also a few points:
1. I am indeed looking for different case studies involving compliance management, e.g. for SOX, PCI, etc.
2. My specific interest is on the actual organisational processes and steps that have been put in place to deal with the compliance requirements.
The goal is to use our modelling and simulation approach to represent these processes and make further deductions, based on what-if analysis.
Of course, public case studies and/or non-confidential information is welcome in the context mentioned above.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Wednesday, June 30, 2010
Looking for Case studies and information about (Security) Compliance Management Processes with Organisations
In the context of the HP Labs Security and Identity Analytics projects, I am interested in exploring how to use modelling and simulations to support decision makers in making strategic decisions on compliance management, within their organisations.
What are the best investments that could be made in a specific organisational context, based on the compliance needs and issues to be addressed? What are the suitable trade-offs? How to best complement this analysis with traditional risk management approaches?
In order to make progress, I am looking for case studies and/or information about processes and steps carried out within organisations to deal with compliance management and related aspects.
Any input is really welcome.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
What are the best investments that could be made in a specific organisational context, based on the compliance needs and issues to be addressed? What are the suitable trade-offs? How to best complement this analysis with traditional risk management approaches?
In order to make progress, I am looking for case studies and/or information about processes and steps carried out within organisations to deal with compliance management and related aspects.
Any input is really welcome.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Friday, May 21, 2010
Update - Keynote Speaker at IEEE i-Society 2010
As mentioned in a previous blog post of mine, I have been invited to be a Keynote speakers at IEEE i-Society 2010, the International Conference on Information Society.
Thanks to those people that sent me their input and suggestions. I kept into account the input and feedback in the speech abstract that I sent to the organisers:
“We are living in interesting times. New trends affect the information society (organisations and people), such as: increased availability of services in the cloud; the adoption of web 2.0 and social networking for personal and business purposes; pervasive mobile computing; the consumerization of the enterprise.
Along with many new opportunities for people and organisations, we are also assisting to the raise of new security and privacy threats and an increased role played by the organised cybercrime.
People and organisations are going to be more and more impacted by these trends and threats. Organisations need to better understand the dynamic threat environment they are fighting against and where to effectively make their security investments. More assurance and trust is required on the Internet.
This keynote discusses these trends, briefly analyses emerging threats and provides an overview of the organised cybercrime ecosystem. It highlights a few needs and research opportunities in key areas, including: automation of security lifecycle management, economics of security, security analytics, trusted virtualisation, identity assurance and privacy management. Related work done by HP Labs in this space - in collaboration with the UK research community - is presented and discussed.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Thanks to those people that sent me their input and suggestions. I kept into account the input and feedback in the speech abstract that I sent to the organisers:
“We are living in interesting times. New trends affect the information society (organisations and people), such as: increased availability of services in the cloud; the adoption of web 2.0 and social networking for personal and business purposes; pervasive mobile computing; the consumerization of the enterprise.
Along with many new opportunities for people and organisations, we are also assisting to the raise of new security and privacy threats and an increased role played by the organised cybercrime.
People and organisations are going to be more and more impacted by these trends and threats. Organisations need to better understand the dynamic threat environment they are fighting against and where to effectively make their security investments. More assurance and trust is required on the Internet.
This keynote discusses these trends, briefly analyses emerging threats and provides an overview of the organised cybercrime ecosystem. It highlights a few needs and research opportunities in key areas, including: automation of security lifecycle management, economics of security, security analytics, trusted virtualisation, identity assurance and privacy management. Related work done by HP Labs in this space - in collaboration with the UK research community - is presented and discussed.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Monday, April 19, 2010
An Update on HPL R&D Activities on Identity Analytics
At HP Labs, we are making good progress in our R&D activities in the space of IAM Analytics.
As a reminder, the goal of our Identity Analytics activity (aka IAM Analytics) is to provide strategic decision maker with decision support tools to make informed decisions by exploring available options and trade-offs by means of what-if analysis.
Our approach differs from common bottom-up approaches that are driven by data analysis and subsequent extrapolations of patterns. Based on a top-down approach, Identity Analytics at HP Labs takes into account strategic aspects of relevance to decision makers (business processes, IT systems, people behaviours, costs, etc.) as well as the implications of dynamic threat environments. Models are developed and simulations carried out to make predictions, by exploring different assumptions, investment options and decision makers’ viewpoints.
Recent developments of our research activity include the exploration of IAM Economics and how a better understanding of strategic preferences of decision makers can help the decision making process.
The updated HPL Identity Analytics web page providing an overview of the project and recent publications can be found here.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
As a reminder, the goal of our Identity Analytics activity (aka IAM Analytics) is to provide strategic decision maker with decision support tools to make informed decisions by exploring available options and trade-offs by means of what-if analysis.
Our approach differs from common bottom-up approaches that are driven by data analysis and subsequent extrapolations of patterns. Based on a top-down approach, Identity Analytics at HP Labs takes into account strategic aspects of relevance to decision makers (business processes, IT systems, people behaviours, costs, etc.) as well as the implications of dynamic threat environments. Models are developed and simulations carried out to make predictions, by exploring different assumptions, investment options and decision makers’ viewpoints.
Recent developments of our research activity include the exploration of IAM Economics and how a better understanding of strategic preferences of decision makers can help the decision making process.
The updated HPL Identity Analytics web page providing an overview of the project and recent publications can be found here.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Identity Analytics and Economics of IAM – Presentation at IFIP/IEEE BDIM 2010
Due to recent “volcanic activities”, I could not attend the 5th IFIP/IEEE International Workshop on Business-driven IT Management 2010 - BDIM 2010, Osaka, Japan.
However, I have been able to give a remote presentation of the topic discussed in my accepted paper:
“Marco Casassa Mont, Yolanta Beres, David Pym, Simon Shiu - Economics of Identity and Access Management: Providing Decision Support for Investments”
My full presentation (MS .ppt) is available here. An abstract of the paper (and presentation) follows:
“Identity and Access Management (IAM) is a key enabler of enterprise businesses: it supports automation, security enforcement and compliance. However, most enterprises struggle with their Identity and Access Management strategy. Discussions on IAM primarily focus at the IT operational level, rather than targeting strategic decision makers' issues, at the business level. Organisations are experiencing an increasing number of internal and external threats and risks: there is scarcity of resources and budget to address them all. Decision makers (e.g. CIOs, CISOs) need to prioritise their choices and motivate their requests for investments. This applies for investments in IAM vs. other possible security or business investments that could be made by the organisation. In this context, a range of possible IAM investment options has an effect on multiple strategic outcomes of interest, such as assurance, agility, security, compliance, productivity and empowerment. We have developed a repeatable approach and methodology to help organisations work through this complex problem space and determine an appropriate strategy, by providing them with decision support capabilities. The proposed approach, validated in collaboration with security and IAM experts, couples economic modeling (which explores decision makers' preferences between the different outcomes) with system modeling & simulations to predict the consequences (likely outcomes) associated with different investment choices and map them against decision makers' preferences, in order to identify the most suitable investment options. We illustrate how this methodology has been applied in an IAM case study, in a business-driven context with core enterprise services. This work is in progress. We discuss current results and next steps.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
However, I have been able to give a remote presentation of the topic discussed in my accepted paper:
“Marco Casassa Mont, Yolanta Beres, David Pym, Simon Shiu - Economics of Identity and Access Management: Providing Decision Support for Investments”
My full presentation (MS .ppt) is available here. An abstract of the paper (and presentation) follows:
“Identity and Access Management (IAM) is a key enabler of enterprise businesses: it supports automation, security enforcement and compliance. However, most enterprises struggle with their Identity and Access Management strategy. Discussions on IAM primarily focus at the IT operational level, rather than targeting strategic decision makers' issues, at the business level. Organisations are experiencing an increasing number of internal and external threats and risks: there is scarcity of resources and budget to address them all. Decision makers (e.g. CIOs, CISOs) need to prioritise their choices and motivate their requests for investments. This applies for investments in IAM vs. other possible security or business investments that could be made by the organisation. In this context, a range of possible IAM investment options has an effect on multiple strategic outcomes of interest, such as assurance, agility, security, compliance, productivity and empowerment. We have developed a repeatable approach and methodology to help organisations work through this complex problem space and determine an appropriate strategy, by providing them with decision support capabilities. The proposed approach, validated in collaboration with security and IAM experts, couples economic modeling (which explores decision makers' preferences between the different outcomes) with system modeling & simulations to predict the consequences (likely outcomes) associated with different investment choices and map them against decision makers' preferences, in order to identify the most suitable investment options. We illustrate how this methodology has been applied in an IAM case study, in a business-driven context with core enterprise services. This work is in progress. We discuss current results and next steps.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Friday, February 12, 2010
The Economics of IAM: On the need to move the focus of IAM from the Operational Level to the Strategic Level
I noticed that most of the discussions on IAM are really focused on the operational and functional aspects. As eventually decision makers (with a budget) need to make investment decisions in this space, the usual arguments about ROIs and business-level cost/benefit analysis are made by starting from this perspective.
But, is this really what CIOs/CISOs and related strategic decisions makers want to hear? After been exposed to various interactions with people covering these roles, I believe this is not really the type of message they are looking for.
In these days, strategic decision makers (that have a budget and make investment decisions …) need to balance a variety of aspects and constraints derived from the business, legislation, governance, IT, security, etc. They need to cope with various tension points and mediate different viewpoints within the organisation; as a consequence they need to explore the various trade-offs and identify the most suitable investment choices consistently with their ever shrinking budgets.
So, arguments made in the context of IAM should move away from a pure technological/IT viewpoint (that is anyway still very important …) to encompass an holistic view that takes into account the complexity of the business, legislative and IT world they operate on a daily basis.
I believe that the economics of IAM, in a wider context of the economics of security, is a discipline and area that really need to be explored.
I personally believe this is a fascinating area where various contributions can be made. The HP Labs work on Identity Analytics, Economics of IAM and Security Analytics is really meant to make progress in this direction.
I am currently carrying on various case studies with HP customers. They are extremely valuable to refine ideas and build decision strategic support solutions. I am very keen in getting any additional input/viewpoints and (unusual) case studies to make further progress in this space.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
But, is this really what CIOs/CISOs and related strategic decisions makers want to hear? After been exposed to various interactions with people covering these roles, I believe this is not really the type of message they are looking for.
In these days, strategic decision makers (that have a budget and make investment decisions …) need to balance a variety of aspects and constraints derived from the business, legislation, governance, IT, security, etc. They need to cope with various tension points and mediate different viewpoints within the organisation; as a consequence they need to explore the various trade-offs and identify the most suitable investment choices consistently with their ever shrinking budgets.
So, arguments made in the context of IAM should move away from a pure technological/IT viewpoint (that is anyway still very important …) to encompass an holistic view that takes into account the complexity of the business, legislative and IT world they operate on a daily basis.
I believe that the economics of IAM, in a wider context of the economics of security, is a discipline and area that really need to be explored.
I personally believe this is a fascinating area where various contributions can be made. The HP Labs work on Identity Analytics, Economics of IAM and Security Analytics is really meant to make progress in this direction.
I am currently carrying on various case studies with HP customers. They are extremely valuable to refine ideas and build decision strategic support solutions. I am very keen in getting any additional input/viewpoints and (unusual) case studies to make further progress in this space.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
HPL Technical Reports – Economics of Identity and Access Management: Providing Decision Support for Investments
I recently published (jointly with a few HPL colleagues) two HPL Technical Reports on the topic of “Economics of Identity and Access Management (IAM)”: HPL-TR-11 (executive summary) and HPL-TR-12 (detailed description of the case study)
These two documents discuss a case study aiming at integrating economics to security analytics methodologies, to provide strategic decision support in the IAM space:
“Identity and Access Management (IAM) is a key enabler of enterprise businesses: it supports automation, security enforcement and compliance. However, most enterprises struggle with their Identity and Access Management strategy. Discussions on IAM primarily focus at the IT operational level, rather than targeting strategic decision makers' issues, at the business level. Organisations are experiencing an increasing number of internal and external threats and risks: there is scarcity of resources and budget to address them all. Decision makers (e.g. CIOs, CISOs) need to prioritise their choices and motivate their requests for investments. This applies for investments in IAM vs. other possible security or business investments that could be made by the organisation. In this context, a range of possible IAM investment options has an effect on multiple strategic outcomes of interest, such as assurance, agility, security, compliance, productivity and empowerment. We have developed a repeatable approach and methodology to help organizations work through this complex problem space and determine an appropriate strategy, by providing them with decision support capabilities. The proposed approach, validated in collaboration with security and IAM experts, couples economic modeling (which explores decision makers' preferences between the different outcomes) with system modeling & simulations to predict the consequences (likely outcomes) associated with different investment choices and map them against decision makers' preferences, in order to identify the most suitable investment options. We illustrate how this methodology has been applied in an IAM case study, in a business-driven context with core enterprise services. This work is in progress. We discuss current results and next steps.”
A related paper discussing this work has recently been accepted at the 5th IEEE/IFIP Business Driven IT Management Workshop, BDIM 2010.
In addition to current engagements with HP customers, I am also looking for additional (interesting/unusual) case studies involving IAM aspects where to further refine this approach.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
These two documents discuss a case study aiming at integrating economics to security analytics methodologies, to provide strategic decision support in the IAM space:
“Identity and Access Management (IAM) is a key enabler of enterprise businesses: it supports automation, security enforcement and compliance. However, most enterprises struggle with their Identity and Access Management strategy. Discussions on IAM primarily focus at the IT operational level, rather than targeting strategic decision makers' issues, at the business level. Organisations are experiencing an increasing number of internal and external threats and risks: there is scarcity of resources and budget to address them all. Decision makers (e.g. CIOs, CISOs) need to prioritise their choices and motivate their requests for investments. This applies for investments in IAM vs. other possible security or business investments that could be made by the organisation. In this context, a range of possible IAM investment options has an effect on multiple strategic outcomes of interest, such as assurance, agility, security, compliance, productivity and empowerment. We have developed a repeatable approach and methodology to help organizations work through this complex problem space and determine an appropriate strategy, by providing them with decision support capabilities. The proposed approach, validated in collaboration with security and IAM experts, couples economic modeling (which explores decision makers' preferences between the different outcomes) with system modeling & simulations to predict the consequences (likely outcomes) associated with different investment choices and map them against decision makers' preferences, in order to identify the most suitable investment options. We illustrate how this methodology has been applied in an IAM case study, in a business-driven context with core enterprise services. This work is in progress. We discuss current results and next steps.”
A related paper discussing this work has recently been accepted at the 5th IEEE/IFIP Business Driven IT Management Workshop, BDIM 2010.
In addition to current engagements with HP customers, I am also looking for additional (interesting/unusual) case studies involving IAM aspects where to further refine this approach.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Tuesday, August 25, 2009
Good R&D Progress in the Space of Identity (and Security) Analytics
Good progress has been made in the R&D space of Identity Analytics at HP Labs (in the broader context of Security Analytics).
Various IAM case studies have been explored, investigating how event-driven probabilistic modelling, coupled with economic studies, can be used to help decision makers to make decision on investments, identify suitable metrics & policies, better understand the impact of choices, trade-offs and risk implications.
We got a few papers accepted in international conferences, in particular at IEEE Policy 2009 Symposium, Trust Economics 2009 Workshop and IEEE MetriSec 2009 – covering various IAM aspects.
A few HP Labs Technical Reports are now publicly available:
- HPL-2009-173 Adrian Baldwin, Marco Casassa Mont, David Pym, Simon Shiu - System Modelling for Economic Analysis of Security Investments: A Case Study in Identity and Access Management - HPL-2009-173
- HPL-2009-142 Yolanta Beres, Marco Casassa Mont, Jonathan Griffin, Simon Shiu - Using Security Metrics Coupled with Predictive Modelling and Simulation to Assess Security Processes - HPL-2009-142
- HPL-2009-138 Anna Squicciarini, Marco Casassa Mont, Sathya Dev Rajasekaran - Towards an Analytic Approach to Evaluate Enterprises’ Risk Exposure to Social Networks - HPL-2009-138
- HPL-2009-57 Marco Casassa Mont, Adrian Baldwin, Simon Shiu - Identity Analytics - User provisioning Case Study: Using Modelling and Simulation for Policy Decision Support - HPL-2009-57, 2009
- HPL-2009-56 Adrian Baldwin, Marco Casassa Mont, Simon Shiu - Using Modelling and Simulation for Policy Decision Support in Identity Management - HPL-2009-56, 2009
- HPL-2008-84 Marco Casassa Mont, Adrian Baldwin, Simon Shiu - On Identity Analytics: Setting the Context- HPL-2008-84, 2008
I am looking for input and feedback, in particular additional case studies where to apply our approach and techniques.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: my original HP blog can be found here ---
Wednesday, July 22, 2009
New HP Labs Technical Report – “Systems Modelling for Economic Analyses of Security Investments: A Case Study in Identity and Access Management”
A new HP Labs Technical Report has been released, in the area of Security and Identity Analytics, called “Systems Modelling for Economic Analyses of Security Investments: A Case Study in Identity and Access Management” by Adrian Baldwin, Marco Casassa Mont, David Pym and Simon Shiu:
“Identity and Access Management (IAM) is a key issue for systems security managers such as CISOs. More specifically, it is a difficult problem to understand how different investments in people, process, and technology affect the intended security outcomes. We position this problem within the framework of optimal control models in macroeconomics, and use a process model to understand the dynamics of the utility of possible trade-offs between investment, access, and security incidents (breaches). A utility function is used to express the security manager's IAM preferences, and the functional behaviour of its components is described via a process model. Executing our process model as Monte Carlo simulations, we illustrate the behaviour of the utility function for varying levels of investment and threat, and so provide the beginnings of a decision-support tool for systems security managers.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: my original HP blog can be found here ---
“Identity and Access Management (IAM) is a key issue for systems security managers such as CISOs. More specifically, it is a difficult problem to understand how different investments in people, process, and technology affect the intended security outcomes. We position this problem within the framework of optimal control models in macroeconomics, and use a process model to understand the dynamics of the utility of possible trade-offs between investment, access, and security incidents (breaches). A utility function is used to express the security manager's IAM preferences, and the functional behaviour of its components is described via a process model. Executing our process model as Monte Carlo simulations, we illustrate the behaviour of the utility function for varying levels of investment and threat, and so provide the beginnings of a decision-support tool for systems security managers.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: my original HP blog can be found here ---
Monday, June 29, 2009
EEMA e-Identity: Presentation on the Future of the Identity in the Cloud
I recently attended the EEMA e-Identity Conference, in London, 25-26 June 2009. There have been interesting presentation and good talks.
I also gave a presentation on “The Future of Identity in the Cloud: Requirements, Risks and Opportunities”:
“This presentation aims at: setting the context about Identity in the Cloud; discussing related identity management issues along with core requirements (coming from users and organisations); illustrating, from an HP Labs’ perspective, future possible models, approaches and IT infrastructures to handle Identity in the Cloud.
The introduction of the presentation sets some background: it gives an overview of Cloud Computing and its implications, in terms of service provisioning, security, privacy and identity management. In particular it discusses the paradigm shift from a close & controlled approach (within enterprises) to potentially, on-the-fly composable and customisable services, in the Cloud.
Use cases are introduced to illustrate “common” usage and management tasks involving Identity in the Cloud - from both user and organisational perspectives, including the implications of having to deal with Identity in composable and dynamic services. New emerging, related threats and risks are briefly discussed, such as the potential growth of bogus service providers, targeted attacks to the weakest points in the service provisioning chain and identity thefts.
This will lead to a discussion of key requirements, determined by new interaction models and service-provisioning paradigms in the Cloud, including: control of identity flows and management of distributed user accounts; trust and reputation about service providers in the Cloud; identity assurance; transparency about security practices; privacy (including consent and revocation).
I will then discuss current (categories of) identity management solutions and approaches that deal with aspects of Identity in the Cloud (such as identity federation, identity brokering, Identity 2.0, etc.), along with their pros and cons and failures to address some of the core requirements (such as assurance, trust and privacy control).
The final part of this presentation challenges current assumptions and approaches and illustrates future directions, by presenting HP Labs’ medium and long–term vision about how the underlying Cloud infrastructure is going to evolve along with its implication in terms of Identity and Identity Management. This includes the paradigm shifts introduced by the usage of trusted virtualisation, remote attestation of platform capabilities (Trusted Computing Platforms) and identity-driven computational environment (coming from the cloud) that could run on local systems (e.g. at the user side); new emerging identity management models driven by identity-aware platforms and policy-driven delegation of credentials; the role that Security and Identity Analytics can play, by using modelling and simulation, to help organisations to evaluating and predicting the consequences of using services in the Cloud, based on assumptions made on the underlying identity management model and existing threats.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: my original HP blog can be found here ---
I also gave a presentation on “The Future of Identity in the Cloud: Requirements, Risks and Opportunities”:
“This presentation aims at: setting the context about Identity in the Cloud; discussing related identity management issues along with core requirements (coming from users and organisations); illustrating, from an HP Labs’ perspective, future possible models, approaches and IT infrastructures to handle Identity in the Cloud.
The introduction of the presentation sets some background: it gives an overview of Cloud Computing and its implications, in terms of service provisioning, security, privacy and identity management. In particular it discusses the paradigm shift from a close & controlled approach (within enterprises) to potentially, on-the-fly composable and customisable services, in the Cloud.
Use cases are introduced to illustrate “common” usage and management tasks involving Identity in the Cloud - from both user and organisational perspectives, including the implications of having to deal with Identity in composable and dynamic services. New emerging, related threats and risks are briefly discussed, such as the potential growth of bogus service providers, targeted attacks to the weakest points in the service provisioning chain and identity thefts.
This will lead to a discussion of key requirements, determined by new interaction models and service-provisioning paradigms in the Cloud, including: control of identity flows and management of distributed user accounts; trust and reputation about service providers in the Cloud; identity assurance; transparency about security practices; privacy (including consent and revocation).
I will then discuss current (categories of) identity management solutions and approaches that deal with aspects of Identity in the Cloud (such as identity federation, identity brokering, Identity 2.0, etc.), along with their pros and cons and failures to address some of the core requirements (such as assurance, trust and privacy control).
The final part of this presentation challenges current assumptions and approaches and illustrates future directions, by presenting HP Labs’ medium and long–term vision about how the underlying Cloud infrastructure is going to evolve along with its implication in terms of Identity and Identity Management. This includes the paradigm shifts introduced by the usage of trusted virtualisation, remote attestation of platform capabilities (Trusted Computing Platforms) and identity-driven computational environment (coming from the cloud) that could run on local systems (e.g. at the user side); new emerging identity management models driven by identity-aware platforms and policy-driven delegation of credentials; the role that Security and Identity Analytics can play, by using modelling and simulation, to help organisations to evaluating and predicting the consequences of using services in the Cloud, based on assumptions made on the underlying identity management model and existing threats.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: my original HP blog can be found here ---
New HP Labs Technical Report: Towards an Analytic Approach to Evaluate Enterprises’ Risk Exposure to Social Networks
A new HP Labs Technical Report has been recently released, called “Towards an Analytic Approach to Evaluate Enterprises’ Risk Exposure to Social Networks” (authors: Anna Squicciarini, Marco Casassa Mont, Sathya Dev Rajasekaran):
“This paper aims at exploring the impact on enterprises of the adoption of Social Networks by employees. It analyses the risks that enterprises could face and suggests a methodology to answer questions, such as: what are the actual risks for an organization, given a specific context? How to assess these risks? What are the most significant approaches that can be taken to mitigate them? What are the financial and organizational implications for an organization in implementing any of the possible approaches?”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: my original HP blog can be found here ---
“This paper aims at exploring the impact on enterprises of the adoption of Social Networks by employees. It analyses the risks that enterprises could face and suggests a methodology to answer questions, such as: what are the actual risks for an organization, given a specific context? How to assess these risks? What are the most significant approaches that can be taken to mitigate them? What are the financial and organizational implications for an organization in implementing any of the possible approaches?”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: my original HP blog can be found here ---
Thursday, March 12, 2009
Twitter and its Privacy and Identity Management Implications
I recently started using Twitter (my link: http://twitter.com/MCasassaMont).
Twitter it getting more and more popular within (and across) organisations in particular for geographically distributed teams, to share their activities and whereabouts.
I am interested to better understand this tool, in particular in terms of its identity and privacy implications and long term repercussions for individuals and organisations.
I see some interesting research to be potentially carried out in the context of the Identity Analytics R&D project at HP Labs and UK TSB EnCoRe project.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: my original HP blog can be found here ---
Twitter it getting more and more popular within (and across) organisations in particular for geographically distributed teams, to share their activities and whereabouts.
I am interested to better understand this tool, in particular in terms of its identity and privacy implications and long term repercussions for individuals and organisations.
I see some interesting research to be potentially carried out in the context of the Identity Analytics R&D project at HP Labs and UK TSB EnCoRe project.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: my original HP blog can be found here ---
Thursday, December 18, 2008
Identity Analytics: from a compliance-based to a risk-based approach
Here is a recent, interesting article called “Banks Need to Take Risk-Based Approach to Data Management”:
“Banks need to approach their data privacy and security from a risk point of view, according to experts with New York-based Deloitte. The firm held a webcast Tuesday that discussed how financial institutions can transform themselves from being compliance-driven organizations to risk-driven organizations, two models that are distinct, Edward Powers, a principal with the firm's security and privacy practice, said.
Over the last six to eight months, Powers said he has seen a continued sensitive to risk among financial institutions. "At the same time, I've seen significant moves to downsize budgets and human resources. This is creating strain. Most organizations are now optimizing around the things that are most urgent."”
Interestingly, this reiterates a trend and approach that I have been describing for a while, especially from a security and identity management perspective. I would extend this not only to Banks (and the FI sector), but also to enterprises and Government Agencies.
I believe that, from an identity and privacy perspective, modeling and simulation (coupled with social science and economics) can provide additional support to help decision makers to better understand the consequences of their risk posture along with explaining and predicting the impact of their choices.
Further information about our vision, based on Identity Analytics, has been provided in a few recent blog posts of mine (here, here and here), where I also discussed our view towards strategic decision support for Identity Management (and privacy …).
--- NOTE: my original HP blog can be found here ---
“Banks need to approach their data privacy and security from a risk point of view, according to experts with New York-based Deloitte. The firm held a webcast Tuesday that discussed how financial institutions can transform themselves from being compliance-driven organizations to risk-driven organizations, two models that are distinct, Edward Powers, a principal with the firm's security and privacy practice, said.
Over the last six to eight months, Powers said he has seen a continued sensitive to risk among financial institutions. "At the same time, I've seen significant moves to downsize budgets and human resources. This is creating strain. Most organizations are now optimizing around the things that are most urgent."”
Interestingly, this reiterates a trend and approach that I have been describing for a while, especially from a security and identity management perspective. I would extend this not only to Banks (and the FI sector), but also to enterprises and Government Agencies.
I believe that, from an identity and privacy perspective, modeling and simulation (coupled with social science and economics) can provide additional support to help decision makers to better understand the consequences of their risk posture along with explaining and predicting the impact of their choices.
Further information about our vision, based on Identity Analytics, has been provided in a few recent blog posts of mine (here, here and here), where I also discussed our view towards strategic decision support for Identity Management (and privacy …).
--- NOTE: my original HP blog can be found here ---
Monday, December 15, 2008
Identity Analytics: Providing Strategic Decision Support for Identity Management
I believe that “Enterprise Identity Management” is quickly maturing and, in some way, commoditizing, at least from a product and solution perspective. In this context, thinking about Identity Management (IdM) purely from a technical perspective is showing its limitations.
Decisions on IdM aspects are increasingly made at the strategic level, as outsourcing, cost saving, balancing security with enterprise agility and usability are becoming the main drivers. Strategic discussions on IdM include understanding the implications of new emerging scenarios and risks, such as the adoption of web 2.0 technologies within enterprises, new identity attacks (phishing, whaling, etc.), increased numbers of M&A and workforce reorganizations, IdM Outsourcing and adopting IdM as a Service.
Key decision makers in this space, i.e. CIOs/CISOs, are driven by business needs and risk management. Some of the questions we have been exposed to include:
Decisions on IdM aspects are increasingly made at the strategic level, as outsourcing, cost saving, balancing security with enterprise agility and usability are becoming the main drivers. Strategic discussions on IdM include understanding the implications of new emerging scenarios and risks, such as the adoption of web 2.0 technologies within enterprises, new identity attacks (phishing, whaling, etc.), increased numbers of M&A and workforce reorganizations, IdM Outsourcing and adopting IdM as a Service.
Key decision makers in this space, i.e. CIOs/CISOs, are driven by business needs and risk management. Some of the questions we have been exposed to include:
- What is the trade-off between reducing risk in tightening the access to critical applications vs. the loss in productivity as access rights are more limited and time taken to gain these access rights will increase?
- Is it better to spend a limited budget on user education or implementing a given technical control, such as automating user provisioning/deprovisioning or providing two-factor authentication?
- Should users and business units be allowed to run their own IT solutions or is it better to have centrally managed services?
- What is the impact of emerging collaboration technologies such as blogging, Wikis and second life?
- Do changes to working patterns such as greater mobility lead to additional risks?
In a few recent blog posts of mine (here and here) I discussed our view and approach towards strategic decision support for Identity Management, based on Identity Analytics.
Your input is always welcome, in particular in terms of providing additional case studies and IdM areas we could apply our approach to.
--- NOTE: my original HP blog can be found here ---
Friday, November 14, 2008
Part II: On Applying Modelling and Simulation Techniques to Identity Management
Thanks to the readers that sent comments to me (interestingly, by email …), about my previous post on “Applying Modeling and Simulation techniques to Identity Management”. Feel also free to post your comments directly on the blog.
An interesting question I received was about the overall scope of the R&D work on Identity Analytics, i.e. if it only strictly applies to the Identity Management space.
I would say that the scope is wide. The goal is to include also economics aspects, people’s behaviours, privacy and privacy management elements along with any IT and business aspects of relevance for the analysed scenario/case study. Our models and simulations indeed represent the (risk mitigation) effects of identity controls: they do it in the context of the scenario of interest, by including the representation of involved processes, data storage, information flows along with relevant applications and services.
The outcomes of our models can vary, depending on the questions we want to answer, such as ROIs in using specific IdM solutions, trade-offs in investments, impact of controls and security on usability, etc.
Hope this answer the question.
Please have also a look at the Demos2k model attached to our recent HP Labs Technical Report HPL-2008-186, for a few illustrative examples of the above points.
--- NOTE: my original HP blog can be found here ---
An interesting question I received was about the overall scope of the R&D work on Identity Analytics, i.e. if it only strictly applies to the Identity Management space.
I would say that the scope is wide. The goal is to include also economics aspects, people’s behaviours, privacy and privacy management elements along with any IT and business aspects of relevance for the analysed scenario/case study. Our models and simulations indeed represent the (risk mitigation) effects of identity controls: they do it in the context of the scenario of interest, by including the representation of involved processes, data storage, information flows along with relevant applications and services.
The outcomes of our models can vary, depending on the questions we want to answer, such as ROIs in using specific IdM solutions, trade-offs in investments, impact of controls and security on usability, etc.
Hope this answer the question.
Please have also a look at the Demos2k model attached to our recent HP Labs Technical Report HPL-2008-186, for a few illustrative examples of the above points.
--- NOTE: my original HP blog can be found here ---
Subscribe to:
Posts (Atom)