Thanks to all the people that contacted me with interest on how HP Labs has applied HP Security Analytics techniques for Risk Analysis in the context of Incident Management Processes. I would like to remind that this HP Labs capability (along with related technologies and know-how) have now been transferred to HP Enterprise Security Services (HP ESS). Please feel free to contact HP ESS representatives if you would like to use the service.
An example of the benefits and risk assessment capabilities that can be achieved with Security Analytics (specifically in the space of Security Operation Centers and their Incident Management Processes) has been docuemented in a recent HP Labs Technical Report has been recently called “Security Analytics – Risk Analysis for an Organisation’s Incident Management Processes”:
“This document is an example of the type of report an organisation would receive at the end of a HP Security Analytics engagement. The focus is on the analysis of the security risks and performance of the organisation’s Security Incident & Events Management (SIEM) Processes and related Security Operation Centre (SOC)’s activities. HP Labs carried out the underlying R&D work in collaboration with HP Enterprise Security Services and involved analysis of processes, probabilistic modeling, simulation and “what-if” analysis for some of HP’s key customers. The outcome of this was a set of case studies from which we have been able to create this more general anonymised report illustrating the richness of the risk assessment and “what-if” analysis that has been carried out.
The lifecycle management of security is critical for organisations to protect their key assets, ensure a correct security posture and deal with emerging risks and threats. It involves various steps, usually carried out on an ongoing, regular basis, including: risk assessment; policy definition; deployment of controls within the IT infrastructure; monitoring and governance. In this context, Security Incident & Events Management play a key role. Even the best information security practices and investments in security controls cannot guarantee that intrusions – accidental and criminal activities – and/or other malicious acts will not happen. Controls can fail, be bypassed or become inadequate over time; new threats emerge. Managing such incidents requires detective and corrective controls to minimise adverse impacts, gather evidence, and learn from previous situations in order to improve over time. These incident management processes are usually run in the context of a SOC and/or as part of specialised Computer Security Incident Response Teams (CSIRTS), built on top of SOCs.
Even with SIEM in place, a potential major risk for the organisation arises due to delays introduced in assessing and handling known incidents: this may postpone the successful resolution of critical security incidents (e.g. devices exposed on the Internet, exploitation of privileged accounts, deployed malware, etc.) and allow for further exploitation. Another related risk can be introduced by sudden and/or progressive changes of the threat landscape, due to changing economic and social scenarios, new business activities or process failings within the existing IT services. This might create unexpected volumes of new events and alerts to be processed by the security team and as such, introduce additional delays. Hence, it is important for an organisation to understand the risk exposure due to their Incident Management processes, explore potential future scenarios (e.g. changes in available resources or threats landscapes or adoption of Cloud solutions) and identify suitable ways to address related issues, e.g. by introducing process changes and/or making investments in security controls.
HP Security Analytics is uniquely positioned to provide the analysis of the involved risks, explore what-if scenarios and provide decision support for decision makers. This type of Security Analytics assessments is now available as a service, provided by HP ESS.”.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Showing posts with label predictions. Show all posts
Showing posts with label predictions. Show all posts
Friday, November 30, 2012
Monday, February 11, 2008
New Forrester’s Report: “Identity Management Market Forecast: 2007 to 2014”
An article written by Tim Wilson, called “Identity Management Ready to Skyrocket”, provides an overview of the content of a new Forrester’s Report, “Identity Management Market Forecast: 2007 to 2014”. Have a look to get same insights …
The executive summary of this Forrester’s report follows:
“The identity management — or identity and access management (IAM) — market will grow from nearly $2.6 billion in 2006 to more than $12.3 billion in 2014 (including revenues from both products and implementation services). Provisioning accounts for half of IAM market revenues today, but it will account for nearly two-thirds of all IAM revenues by 2014. Even after years of healthy adoption rates, the IAM market is actually just beginning its trajectory toward broad adoption and deep penetration. Moreover, during the next seven years, we will also see buying behavior migrating from point products to identity suites — and, to a lesser extent, from products to managed services. Meanwhile, vendors will decompose products into service-oriented architecture (SOA)-enabled functions, repackaged in the form of identity-as-a-service (IDaaS)”.
I read the actual report. I found the section on “Future Directions for Identity Management” interesting but, in my view, there are no major surprises …
--- NOTE: my original HP blog can be found here ---
The executive summary of this Forrester’s report follows:
“The identity management — or identity and access management (IAM) — market will grow from nearly $2.6 billion in 2006 to more than $12.3 billion in 2014 (including revenues from both products and implementation services). Provisioning accounts for half of IAM market revenues today, but it will account for nearly two-thirds of all IAM revenues by 2014. Even after years of healthy adoption rates, the IAM market is actually just beginning its trajectory toward broad adoption and deep penetration. Moreover, during the next seven years, we will also see buying behavior migrating from point products to identity suites — and, to a lesser extent, from products to managed services. Meanwhile, vendors will decompose products into service-oriented architecture (SOA)-enabled functions, repackaged in the form of identity-as-a-service (IDaaS)”.
I read the actual report. I found the section on “Future Directions for Identity Management” interesting but, in my view, there are no major surprises …
--- NOTE: my original HP blog can be found here ---
Thursday, October 25, 2007
2012: A Day in the Life of John Webber
How digital-personae, identity management and web 2.0 will impact, influence and reshape people lives and organisations during the next 5 years? What is going to be “hot” in 2012?
Difficult questions … A few colleagues of mine and I tried to explore future scenarios and opportunities in the space of digital identity and identity management. We wrote a story, “2012: A Day in the Life of John Webber”. We would like to share it with this community, to open a debate and exchange opinions. Enjoy it …
--- 2012: A Day in the Life of John Webber ---
“John Webber is a young, ambitious professional. He has a very intense life with interests spanning work, social and political aspects, many friends spread all over the world and a girlfriend. He is accustomed to using new technologies and web 3.0 services: he sees them as a way to simplify his life and enable the broad, rich set of personal and digital interactions that he requires on daily basis in his life.
John works for a multinational enterprise. He uses his mobile appliances (laptop, office PC, smartphone, etc.) in an interchangeable way, to interact with colleagues, send/receive multimedia e-mails and edit reports and critical information for his company. On a daily basis he accesses state-of-the art enterprise services, to collaborate with project colleagues all over the word. This is a simple and gratifying experience thanks to the latest generation, enterprise web 3.0 collaborative, integrated services – where multimedia information is easily collected, stored and indexed for future usage, as well as securely and privately protected, based on the “value” of the content.
John gets access to all these services with his “personae-selector” (virtual) device, installed on his Smartphone. Recognizing John using multiple biometric sensors, the device suggests a persona relevant to the current context or allows John to override the automatic selection. This (virtual) device securely interacts with other of John’s devices and authorised enterprise devices (including that new, secure Printer, and associated Print 3.0 services, recently deployed in John’s office).
John is aware that to be successful in his job, he needs to have constant interactions with other professionals and experts around the world: he wants to exchange opinions and have an early understanding of new trends and exciting initiatives. This is now a recognised need and common practice within modern enterprises.
John runs a few, interactive, multimedia external blogs to expose his views, start discussions and get feedback. He is aware of confidentiality aspects that might rise from his interactions with external people: he uses ad-hoc personae to interact with these services, by exposing a profile and information compatible with his company’s business policies and his privacy preferences. An online, trusted “personal guardian angel” service, accessible via his “personae-selector” (virtual) device, helps him to handle these different personae and to get reminders about the context he is interacting with.
The multinational he works for is aware that people and information are the most valuable assets in these days. On one hand it recognises the need to enable collaborative interactions of its employees with the external world. On the other hand it is aware of potential risks and threads for its own security and businesses.
Thanks to the new generation of “Identity Risk Management and Assessment” services jointly run by the CIO/CPO Offices, enterprise officers periodically scan various sources on the web (including social networks, blogs, etc.) against any improper leak of confidential data or information that could harm enterprise business and employees. This service provides reports on critical issues and confidential and personalised suggestions (on how to mitigate risks) to employees, in case of any problem.
Today, John works from home. It is his girlfriend’s (Alice) birthday. This is special occasion he wants to properly celebrate. By using his home laptop he accesses his preferred “federated service provider community” and in few minutes makes all the required arrangements to celebrate this event: buying Alice’s preferred flowers at “Flowers’R Us”, arranging for an exclusive dinner at the “Genuine Italian Food Restaurant” and buying that jewellery ring that Alice desired so much.
From his laptop John securely links to his “personae-selector” (virtual) device to authenticate and access these various service providers in a transparent way – thanks to their integrated single-sign-on capabilities (via interoperable Liberty Alliance 3.0, OpenId 3.0 and CardSpace 3.0 protocols). In 5 minutes, he buys flowers (to be delivered at the restaurant), arranges for a table at the restaurant and buys the present for Alice. His interactions with these service providers is smooth and simple, as it is mediated by a “joint-collaboration” between his “personae-selector” device and the “personal guardian angel” service, that ensure that a “personae-handover” process happens across various service providers (i.e. different personae are automatically used in different contexts) and the right credentials (including credit card details) and contextual data are exposed based on John’s privacy preferences and interaction policies.
The service providers involved above use the latest, state-of-the-art “Personae-aware” Identity and Privacy Management Services to seamlessly engage in federated contexts and properly handle and process personal information disclosed by John. They ensure his privacy preferences are enforced along with current world-wide (privacy and data protection) legislation. They also use a new generation of “Risk Management and Assessment” services to check their own compliance to business objectives and legislation and automatically report any violation (and start remediation steps). Consistently with this, they offer John a tailored (persona-aware) service experience, in suggesting a customised but not invasive interaction.
It is still early for John to meet with Alice. A good opportunity for John to socialise with his friends spread all over the world and engage in these social networks he likes so much. John connects to a few of them by using appropriate personae (thanks to the help of his “personae-selector” device) and starts posting and chatting.
John is aware that he his using multiple personae and the implications and possible risks that exposing information on the web could have, such as correlation, deductions and misuse of this information to commit crimes. His trusted “personal guardian angel” service helps him to keep track of John’s personae, automatically updating changes and providing additional, useful services. John chooses to have all his interactions on the internet monitored by his trusted “personal guardian angel” service: he configures it to monitor his social network interactions and warn him of any danger, in particular related to disclosure of personal details and information. This has been a wise choice: the interactions with a new guy - Charles, a friend of his friend Bob is strange. His questions and request for work information are going in a direction that could be dangerous. The “personal guardian angel” service warns John of the risks of disclosing some information and the implications this could have for his work and social life. John decides that it is best to drop the call …
Reminded of these potential dangers, John, whilst he is dressing up to go out with Alice, starts a “Personae-Risk Scan” check via his “personal guardian angel” service. This checks for any information directly/indirectly exposed on the web or via his various social network links (Facebook 3.0, MySpace 3.0, LinkedIn 3.0, YouTube 3.0, Second and Third Life 3.0, etc.) and service accounts. It compares retrieved information against perceived threads and risks and provides a meaningful, user friendly report along with suggestion on how to mitigate problems. This time John is lucky: nothing to worry about.
Alice is going to be a little bit late. Why not doing a back-up of John “personae-selector” (virtual) device – as prompted by the device itself? After all it is a “virtual” device: a few seconds and its entire content is securely copied and protected in his new Smartphone along with an image of its personae and preferences.
This was a good move: at the restaurant, perhaps distracted by the good Italian food, a thief steals his current Smartphone with his “personae-selector” (virtual) device. No problem: just the hassle of reporting this (online) to the police. He can carry on celebrating with Alice.
The thief didn’t realise he had no way to access the content and use the device, thanks to its biometric-based protection and encrypted content. It is a “useless tool” to be thrown away at the first opportunity. So he does.
This is good for John: the discarded device is quickly located via GPS and the collaboration with its “personal guardian angel” service. The device is back home the next day.”
--- NOTE: my original HP blog can be found here ---
Difficult questions … A few colleagues of mine and I tried to explore future scenarios and opportunities in the space of digital identity and identity management. We wrote a story, “2012: A Day in the Life of John Webber”. We would like to share it with this community, to open a debate and exchange opinions. Enjoy it …
--- 2012: A Day in the Life of John Webber ---
“John Webber is a young, ambitious professional. He has a very intense life with interests spanning work, social and political aspects, many friends spread all over the world and a girlfriend. He is accustomed to using new technologies and web 3.0 services: he sees them as a way to simplify his life and enable the broad, rich set of personal and digital interactions that he requires on daily basis in his life.
John works for a multinational enterprise. He uses his mobile appliances (laptop, office PC, smartphone, etc.) in an interchangeable way, to interact with colleagues, send/receive multimedia e-mails and edit reports and critical information for his company. On a daily basis he accesses state-of-the art enterprise services, to collaborate with project colleagues all over the word. This is a simple and gratifying experience thanks to the latest generation, enterprise web 3.0 collaborative, integrated services – where multimedia information is easily collected, stored and indexed for future usage, as well as securely and privately protected, based on the “value” of the content.
John gets access to all these services with his “personae-selector” (virtual) device, installed on his Smartphone. Recognizing John using multiple biometric sensors, the device suggests a persona relevant to the current context or allows John to override the automatic selection. This (virtual) device securely interacts with other of John’s devices and authorised enterprise devices (including that new, secure Printer, and associated Print 3.0 services, recently deployed in John’s office).
John is aware that to be successful in his job, he needs to have constant interactions with other professionals and experts around the world: he wants to exchange opinions and have an early understanding of new trends and exciting initiatives. This is now a recognised need and common practice within modern enterprises.
John runs a few, interactive, multimedia external blogs to expose his views, start discussions and get feedback. He is aware of confidentiality aspects that might rise from his interactions with external people: he uses ad-hoc personae to interact with these services, by exposing a profile and information compatible with his company’s business policies and his privacy preferences. An online, trusted “personal guardian angel” service, accessible via his “personae-selector” (virtual) device, helps him to handle these different personae and to get reminders about the context he is interacting with.
The multinational he works for is aware that people and information are the most valuable assets in these days. On one hand it recognises the need to enable collaborative interactions of its employees with the external world. On the other hand it is aware of potential risks and threads for its own security and businesses.
Thanks to the new generation of “Identity Risk Management and Assessment” services jointly run by the CIO/CPO Offices, enterprise officers periodically scan various sources on the web (including social networks, blogs, etc.) against any improper leak of confidential data or information that could harm enterprise business and employees. This service provides reports on critical issues and confidential and personalised suggestions (on how to mitigate risks) to employees, in case of any problem.
Today, John works from home. It is his girlfriend’s (Alice) birthday. This is special occasion he wants to properly celebrate. By using his home laptop he accesses his preferred “federated service provider community” and in few minutes makes all the required arrangements to celebrate this event: buying Alice’s preferred flowers at “Flowers’R Us”, arranging for an exclusive dinner at the “Genuine Italian Food Restaurant” and buying that jewellery ring that Alice desired so much.
From his laptop John securely links to his “personae-selector” (virtual) device to authenticate and access these various service providers in a transparent way – thanks to their integrated single-sign-on capabilities (via interoperable Liberty Alliance 3.0, OpenId 3.0 and CardSpace 3.0 protocols). In 5 minutes, he buys flowers (to be delivered at the restaurant), arranges for a table at the restaurant and buys the present for Alice. His interactions with these service providers is smooth and simple, as it is mediated by a “joint-collaboration” between his “personae-selector” device and the “personal guardian angel” service, that ensure that a “personae-handover” process happens across various service providers (i.e. different personae are automatically used in different contexts) and the right credentials (including credit card details) and contextual data are exposed based on John’s privacy preferences and interaction policies.
The service providers involved above use the latest, state-of-the-art “Personae-aware” Identity and Privacy Management Services to seamlessly engage in federated contexts and properly handle and process personal information disclosed by John. They ensure his privacy preferences are enforced along with current world-wide (privacy and data protection) legislation. They also use a new generation of “Risk Management and Assessment” services to check their own compliance to business objectives and legislation and automatically report any violation (and start remediation steps). Consistently with this, they offer John a tailored (persona-aware) service experience, in suggesting a customised but not invasive interaction.
It is still early for John to meet with Alice. A good opportunity for John to socialise with his friends spread all over the world and engage in these social networks he likes so much. John connects to a few of them by using appropriate personae (thanks to the help of his “personae-selector” device) and starts posting and chatting.
John is aware that he his using multiple personae and the implications and possible risks that exposing information on the web could have, such as correlation, deductions and misuse of this information to commit crimes. His trusted “personal guardian angel” service helps him to keep track of John’s personae, automatically updating changes and providing additional, useful services. John chooses to have all his interactions on the internet monitored by his trusted “personal guardian angel” service: he configures it to monitor his social network interactions and warn him of any danger, in particular related to disclosure of personal details and information. This has been a wise choice: the interactions with a new guy - Charles, a friend of his friend Bob is strange. His questions and request for work information are going in a direction that could be dangerous. The “personal guardian angel” service warns John of the risks of disclosing some information and the implications this could have for his work and social life. John decides that it is best to drop the call …
Reminded of these potential dangers, John, whilst he is dressing up to go out with Alice, starts a “Personae-Risk Scan” check via his “personal guardian angel” service. This checks for any information directly/indirectly exposed on the web or via his various social network links (Facebook 3.0, MySpace 3.0, LinkedIn 3.0, YouTube 3.0, Second and Third Life 3.0, etc.) and service accounts. It compares retrieved information against perceived threads and risks and provides a meaningful, user friendly report along with suggestion on how to mitigate problems. This time John is lucky: nothing to worry about.
Alice is going to be a little bit late. Why not doing a back-up of John “personae-selector” (virtual) device – as prompted by the device itself? After all it is a “virtual” device: a few seconds and its entire content is securely copied and protected in his new Smartphone along with an image of its personae and preferences.
This was a good move: at the restaurant, perhaps distracted by the good Italian food, a thief steals his current Smartphone with his “personae-selector” (virtual) device. No problem: just the hassle of reporting this (online) to the police. He can carry on celebrating with Alice.
The thief didn’t realise he had no way to access the content and use the device, thanks to its biometric-based protection and encrypted content. It is a “useless tool” to be thrown away at the first opportunity. So he does.
This is good for John: the discarded device is quickly located via GPS and the collaboration with its “personal guardian angel” service. The device is back home the next day.”
--- NOTE: my original HP blog can be found here ---
Subscribe to:
Posts (Atom)