Evidian

Reduce theoperational risk
for financial services

Controlling operationnal risks via
identity and access management

Reducing operational risks
In the financial sector, data protection is amatter of the utmost strategic importance.
In a growing environment characterized
by incomplete regulations and close
links between market players, with thehandling of ever larger amounts of capitaland increasingly sophisticated financial
products, operational risks have taken on
considerable significance.
By rationalizing access to sensitive data
and managing access and identities in a
structured and coherent way, banks andfinancial companies can fundamentally
reduce their exposure to operational risks.
In a sensitive environment, application
access security procedures must be
reinforced and simplified. Proactive
management of operational risks yields
productivity gains and enhances security inall your financial activities.

02

Solutions to control youroperational risks
By looking at the legislation, we can referto the Federal Reserve’s Operations andSystems Risk (Management Information
Systems) - Internal Control Questionnaire Section 2040.4 . Is access to the automatedsystems adequately protected?
• Do access rights, passwords, and logon ID’s
protect key databases from corruption?
• Are ‘‘write or edit’’ commands restricted to alimited set of individuals?
• Are specific functions assigned to a limited
set of individuals? Are access rights
reviewed periodically?
• Does the system have an audit report formonitoring user access?
• Is access logon information stored inrecords for audit trail support?

Managing financial risks means looking
beyond the traditional categories of credit
risk and market risk. A significant proportionof operational risks involve human beings
accessing electronic data.
The Evidian Access Management solution
makes it easier to manage operational risks
by structuring identities, roles and access tosensitive applications used in the banking IT
systems.

Evidian, a provider of secure
identity and accessmanagement solutions
Evidian is the European market leader in its
segment. This offer was rated “Leader” by
KuppingerCole Analysts.
With Evidian Access Management, abanking and finance company canachieve end-to-end control over accessmanagement, from internal to external user
access and from managed to unmanaged
terminals. The Evidian solution allows
simplifying and controlling the access tothe “extended” enterprise for employees,
partners and customers.
With Evidian Identity and AccessGovernance, it is possible to define andapply a role-based policy and risk model,thus segregating tasks and ensuring theconfidentiality and integrity of its data. Thisway, the financial entity can permanently
ensure, that only the right people accessthe right resources with the required rights
for the right business reasons. The Evidian
solution offers the possibility to certify
the compliance with regulations and the
involvement of the business individuals
using business-aligned processes.

Controlling internal fraud“The Basel Accord introduces operationalrisks as a factor to be taken into accountwhen assessing the banks’ minimal
capital requirements.” Evidian offers acomprehensive range of solutions to ideallysuit risk management in an investmentbanking and trading room environment by
reducing operational risks with a secure
multifactor authentication, Single Sign-On,
easy-to-audit and report access.

Trading rooms
Trading rooms are high-risk environments,
not only due to the “sensitive” data andapplications at stake, but also due to the
speculative approach adopted by thetraders. The transactions performed areclosely monitored and controlled in the backoffice. But how can you be sure of the true
identity of the people carrying out thesetransactions?
The work of traders is of great strategic
importance to a bank. Their key role in the
trading room calls for constant focus andstress management. Their work is managed,
supervised and controlled in a very precise
way. However, identity control is often aweak link, as increasing the number ofidentification devices would reduce trader
productivity.
In the trading rooms, trader desks arecharacterized by the need to use clusters
of workstations with several screens whichallow traders to access relevant applications
available on-premises and in the cloud.
The most common prominent trader
behavior is the sharing of access toapplications (accounts) and workstations.
This behavior introduces several operationalrisks.

• Vulnerability of access with weakpasswords: although passwords are
regularly changed, how many tradersin the bank are using #Password1 as
a password within most accessed
applications, and changing it to#Password2 will not reduce thevulnerability risk.
• Poor auditability of user access to theworkstations, applications, accounts:
analytical tools use historical and online
data to produce KPIs, analyzing andcontrolling processes, contributing to the
optimization of the security policy andprocedures. A personal identification andverification allow building a reliable audit
without repudiation risks.

Rogue Traders
What measures banks have in place toprotect trading room activities againstrogue trading?
Among others, the most common
requirements are Risk & IT controls,
segregation of duties, internal review, audit
and reporting, periodic rights certification,strong policies and control, procedures, andmonitoring by the top management.

These main operational risks are:• Passwords disclosed between users,
open access to user sessions: desks,
workstations, application accessible
without the possibility to identify andrestrict privileges, refraining usage of“preventative” systems being the nextedge of the risk management.

Title of the document text

03

Multifactor Authentication to control and facilitate trader access
Evidian Access Management for trading
rooms is specialized in authentication
and access management solutions usedprimarily in large financial institutions, suchas banks, stock exchanges and investment
firms.

With the Evidian solution, a single, robustmeans of authentication (smart card,
proximity card, biometrics, one-time
password, smartphone, etc.) is all that isrequired for a trader to access all of his
displays, monitors, servers and financial
applications.
When traders identify themselves, their
entire “cluster” of workstations and screens
are activated, enabling them to access

all their applications. Once they remove
their card, their workstations become
inaccessible. However, their financial
applications can still be monitored by othercolleagues thanks to transparent locking.
The Evidian solution provides the same user
experience with a biometric authentication,a tap on go authentication with a proximity
card and any other supported Windows
authentication experience.

A single authentication with password, smart card, biometrics, one-time password, smartphone, SSPR…
to open the Windows session. A single action to lock the Windows sessions on all the workstations.

A solution designed with trader efficiency in mind
Evidian has developed its access security
and risk management solutions inpartnership with a number of international
corporate investment and wealthmanagement banks. Evidian’s experienceenabled it to take into account real-life
everyday scenarios, allowing traders to work04

securely while improving their efficiency andproductivity with a proven enhancement ofuser experience.
Thus, Evidian software authenticates theuser’s identity and displays his application
environment. This simplifies the day-to-day

organization of the trader’s work and makes
it possible to monitor the identity andlocation of anyone attempting to access thesystem and applications.

Access a delegated session

Delegate a session

A single action to delegate one of the sessions within the cluster.

Moreover, a trader can delegate or share apart or the whole set of his cluster of PCs
securely with an assistant, a colleague or
support, without having to close and reopen
Windows sessions.

Moreover, a trader can detach a part or thewhole set of his cluster of PCs securely.
A colleague can dynamically attach
available PC(s) to his cluster of PCs andopen new Windows session(s).

Access to the Windows session andapplications can be delegated, permanently
or temporarily, with restrictions toaccount(s) of application(s).

All access events are stored in a central
database, which can be used to audit
access to the PCs in the cluster and to
applications. The Evidian solution helps
to reduce the number of loss-generating

operational incidents. Relying on Microsoft
Active Directory repository, the solution iscost-efficient and doesn’t need to introduce
a specific repository.
The Evidian solution is based on astandard configuration of the software,
avoiding development, modificationof the applications and introduction of
hardware components and appliances inyour domain.

Access the session

Attach a workstation
Detach a workstation

A single action to detach a workstation and allow access to a colleague

Title of the document text

05

Internet Financial Services and
Branch networks

Secure Online services andMobile accesses

The growing number of internet Financial
Services and Branch networks spanningseveral geographical areas imposes
constraints in terms of employee, partnerand customer access management.

With Evidian Access Management, users
have a secure access to the extended
enterprise including on-premises, Cloud and
SaaS applications, using Identity Federation
based on industry standard protocols suchas SAML, OAUTH, OpenID Connect andSocial Identity.

• How can you make sure your security
policy is applied?
• How can you manage the applicationaccounts of thousands of employees?
• How can you let branches manage theirown users in a secure way?
• Which procedure to implement to secureand facilitate new user arrivals?

Managing access in branches
Internet Financial Services and Branchstaff often find restrictive the increasingly
demanding security rules. With theseconcerns in mind, Evidian Access
Management simplifies and rationalizes
access security by managing the application
authentication process on the user’s behalf.
Therefore, employees naturally comply withthe security policy.
Administrators modify, delete or adjustaccess rights from a central console.
They assign rights based on the role ofthe employees within the branch, thus
complying with task segregation rules.
An approval workflow integrated withapplication provisioning automates theauthorization process and makes financial
services available faster.
Since all access events are audited,
traceability and generation of reports are
facilitated.

Increasing employee efficiency
Within the branches, employees use several
applications, each protected by a password.
Forgotten passwords increase the numberof calls made to the help desk, damaging thecompany’s image and reducing customer
satisfaction.
Evidian Access Management eliminates thisproblem while increasing the user productivity.
A single means of identification (password,
smart card, proximity card, biometrics, Onetime-Password, Smartphone, etc.) gives accessto the Windows session. Enterprise SSO
transparently allows access to all authorized
applications and eliminates the need toremember or to type various identifiers andpasswords. Moreover it supports any typeof application without modification. Mobile
employees can still have secure access tocorporate web applications, even from outside
the company.

06

The solution natively allows the definitionof adaptive authentication policies with
out-of-the-box authentication methods
increasing the level of security required forthe authentication to sensitive services.
Supported authentication methods are:password, certificates, smart card, proximity
card, One-time-Password (OTP) via SMS,
OTP via email, Grid card, OTP via Apps on
Smartphone, Evidian QRentry...

Simplifying and strengthening
your security policy
With the Evidian IAM Suite, identity andaccess management becomes standard andsystematic; this makes control procedures
easier to maintain and document.
When staffing changes occur (newrecruitments, transfers, departures), theEvidian IAM Suite can trigger the creation ordeletion of accounts. The latter are allocatedin such a way that convergence between
application rights and your security policy

is facilitated. The application managers are
relieved from repetitive tasks in which errors
can easily occur.
The Evidian IAM Suite implements criticalprocedures such as account removal
and role-based task segregation. Unused
accounts are detected and, if necessary,deleted. Moreover, the central access audit
can also tell you precisely who in the branch
has used a generic account.
In the event of a staffing change, therelevant line managers are informed
through notifications (sent by an integrated
approval workflow). These managers canthen approve or reject the assignmentof new rights with just a few clicks. Oncethe manager has approved, the accountis activated automatically for the required
period of time.
The Evidian solution allows the organization
to have end-users, operational managers
and security officers accountable for theidentity and entitlement management
processes.
The efficiency of the security policy canbe measured at any time, for example, bydetermining the applications currently usedby an employee profile. As a result, you canregularly optimize your security procedures.

Delegating to Branches &Partners the management of
their users in a secure way
Opening Internet Finance Services to
Branches and Partners implies managing
the users and their rights of theorganizations that will access the Services.
The Evidian IAM Suite lets you delegate,
in a secure way, this management to theappropriate individual in each organization.
By implementing a user management
security policy, each request will have to bevalidated by the identified correspondent ineach organization and, when defined, evenbe validated by a central manager.
With this procedure, Branches and Partners
user management may be delegated to thenearest manager without taking any risk.

Facilitating the arrival of newusers in a secure way
In order to ease the planned arrival of new
employees or users in branches or partners,
accounts can be created in advance indeactivated mode. At the planned date forthe arrival or even some time before, theactivation process proposed by the Evidian
IAM Suite will inform the person that he has
to activate his account via a temporary link
sent by email. By clicking this link, the user
can then define his password to accessthe system, activating at the same time his
account and applications. The user is readyto start working.
Of course, this password must respect
a given format defined by the company.
Alternatively, this process can also be linked
to the activation of a strong authentication
device, previously given to the user.

EvidianEvidian is the Identity and Access
Management Atos.
Evidian is a software publisher that has
specialized for over 20 years in identity andaccess management (IAM) solutions. Everyday, more than 5 million users access theirapplications with Evidian solutions.
Evidian is the identity and accessmanagement solution of dozens of banks
and insurance companies in the UnitedStates, Europe, Africa, Asia and the Middle
East. It enables these organizations tocomply with their legal confidentialityand data integrity obligations, make theiremployees more efficient and autonomous,and improve the service they provide totheir customers.

Title of the document text07

Brochure

About Evidian
Evidian is the Identity and Access Management (IAM) software suite of Eviden.
Evidian IAM is the European leader in identity and accessmanagement with a presence which is growing rapidly
beyond Europe, particularly in Japan and the US.

CT_191021_LPM_Evidian_BR_Finance_Banking_enMore than 5,000,000 users in more than 900 organizations
throughout the world connect to their companies every day
and manage their access rights with Evidian identity andaccess management solutions.

For more information: evidian.com© Eviden. Evidian is the registered trademark of Eviden. All
products, brand names, service marks, trademarks and othernames mentioned in this document are proprietary to theirrespective owners and are protected by applicable trademark
and copyright laws. Evidian reserves the right to modify thecharacteristics of its products without prior notice.