Patent Publication Number: US-2006015930-A1

Title: Process for removing stale users, accounts and entitlements from a networked computer environment

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS  
      Not Applicable  
     FEDERALLY SPONSERED RESEARCH  
      Not Applicable  
     SEQUENCE LISTING OR PROGRAM  
      Not Applicable  
     BACKGROUND OF THE INVENTION  
      1. Field of Invention  
      A method for collecting, presenting to stake-holders, reviewing and cleansing data about users and their entitlements in a networked computer environment, called access certification, is presented.  
      2. Background of the Invention  
      The present invention, access certification, relates in general to a method for reviewing and correcting security, entitlements and user profile data in one or more networked computer systems. It generates changes to user, account and entitlement data in a networked computer environment in any, of the forms: 
      1. “User U no longer has legitimate reason to access the computer systems in question, so should be removed,” or     2. “User U no longer has legitimate reason to access account A on system S,” or     3. “There is no longer a reason to represent user U on system S with object O,” or     4. “User U no longer has legitimate reason to have entitlement E on system S.” or     5. “User U no longer has legitimate reason to have belong to group G on system S.”   

      These changes to security system databases are useful in order to remove unneeded security privileges, and so limit the security exposure (attack surface) of those systems.  
      Without this method, in most organizations, tend to accumulate entitlements and access to systems over time, as their responsibilities change. However, users do not normally lose no-longer-required entitlements in a reliable or timely manner. As a result, over time users accumulate security access to systems that are not appropriate to their responsibilities, and consequently these entitlements pose a security risk.  
      3. Objects and Advantages  
      The reductions in security access described in [1] are essential in order to reduce the set of security privileges (entitlements) that a malicious legitimate user might abuse, to reduce the harm that a user who makes an honest mistake in the course of using a computer system might cause, to reduce the ability of past members of an organization to abuse no-longer-legitimate access to systems in order to cause harm, and to reduce the set of accounts and entitlements that an intruder can target, possibly without raising any alarms because they belong to no-longer-present users.  
      In many organizations, obsolete or stale security, privileges are simply not removed at all, or if they are removed it is with an unreliable and slow process. These organizations are at risk because the prior state of the art in removing such privileges was too costly or difficult to implement.  
      In some organizations, periodic audits are carried out manually by teams of human auditors, in an effort to find and remove obsolete users, accounts and entitlements. Such audits are costly to carry, out, require significant investment of time and effort, and may focus on just one or a few systems, rather than every significant system and type of access in an organization.  
      In the course of manual audits, auditors may interview one or many managers or systems owners, in an effort to determine what users, accounts and entitlements are still appropriate. Since auditors can only interview one person (e.g., system owner or manager) at a time, this can be a very slow and time-consuming process.  
      Another pre-existing method for identifying obsolete users and accounts, but in most cases not entitlements, is to examine last login time/date records on each login account. Accounts whose last login time/date is older than some threshold are presumed to be inactive, and likely obsolete. Unfortunately, some systems do not track this data, especially those into which users do not log in themselves. Most systems do not log the last time that an entitlement was used, so this method does not normally apply to entitlements. In the event that an intruder has gained access to an obsolete account, and uses it regularly, that account will appear to be current and in use, and so will not be flagged as obsolete. To summarize, use of last login time/date gives only circumstantial evidence that an account or user profile may be obsolete, and offers no assistance at all for removing stale user entitlements.  
      A final pre-existing method for identifying obsolete users, accounts and entitlements is policy- and released provisioning. This method starts by defining a set of detailed roles, each of which identifies component accounts and entitlements on individual systems. The set of defined roles must be sufficient to capture the access requirements of all existing users. Next, every user is classified into one or more roles, such that all of their systems access requirements are expressed in terms of their role membership. Finally, the current accounts and entitlements of every user are collected, and compared to the accounts and entitlements predicted by the role model. Any differences between actual and predicted accounts and entitlements cause either direct changes to the user profiles or requests for change authorization by stake-holders (similar to the mechanism described in [23]).  
      Unfortunately, the policy- and role-based technique described in [9] is impractical in large organizations (e.g., with 10,000 or more users), as it requires the difficult definition of many detailed roles, and both initial and ongoing classification of users into these roles. The sheer volume of role definitions and user classification, combined with the dynamic nature of most organizations (users are hired, fired and moved quickly, sub-organizations are merged or divested, etc.), make effective role definitions and user classification nearly impossible to accomplish in practice.  
      Overall, prior strategies for finding and removing stale, obsolete or incorrect users, login accounts, user objects, group memberships and security entitlements from computer systems have been ineffective, incomplete, slow, costly or some combination of these.  
     SUMMARY  
      The reduction in users, accounts and entitlements that results from the method described in [1] helps to secure systems by reducing their attack surfaces, and is required in order to implement effective internal controls over systems, such that the set of users and their access to systems is both known and appropriate to business requirements.  
      Past strategies for finding and removing stale, obsolete or incorrect users, login accounts, user objects, group memberships and security entitlements from computer systems have not worked well, as described in [11]. The method described herein, which includes automated discovery of users, accounts and entitlements, and which leverages the business knowledge of managers in the organization to identify suspicious items (rather than attempting to define an ideal state using roles and policies), resolves the problems experienced by these past strategies. Namely: 
          1. The method relies only on data that already exists in most organizations—the accounts and entitlements that can be extracted directly from the computer systems in question, and organization chart data that is present in most HR systems, and in any case which can be produced or completed with a reasonable amount of effort.     2. The method does not require that a formal model of user entitlements be defined or maintained—both of which are too difficult to contemplate in real-world large organizations.     3. The method does not require that a users be classified into roles—which data is difficult to collect initially and costly to maintain over time.     4. The method is direct, essentially leveraging organizational knowledge held by managers, rather than circumstantial (e.g., examining last login records).     5. The method can be automated into a massively parallel process, where many managers are engaged simultaneously, and so can be completed quickly. This contrasts with manual audits, which are paper-based or interview-based, and essentially sequential and therefore slow.       

    
    
     DRAWINGS—FIGURES  
       FIG. 1  is a schematic illustrating the networked systems that interact in the access certification method for removing stale, obsolete or incorrect users, login accounts, user objects, group memberships and security entitlements. Arrows indicate communication between systems, and the direction of each arrow indicates the direction of the flow of the bulk of the data in that communication. 
    
    
      In  FIG. 1 , one or more systems are tasked to perform the described process. These systems are collectively labeled Identity Management Server.  
      In  FIG. 1 , the identity management server periodically collects a list of login IDs from any number of managed systems using one of four mechanisms: 
          1. Using a managed system&#39;s native application programming interface (API), which operates over a network.     2. By communicating with an agent installed on the managed system, and asking that agent to fetch the information using some facility, available locally on that managed system.     3. Using either of the two methods described above, but indirectly, by asking a proxy, server to ask the managed system for the data.     4. (not shown) By having a process execute on the managed system, and send the data through a file transfer mechanism to the identity management server.        

      The first three methods are also used to validate login ID/password pairs that a user types into to registration user interface on the identity management server.  
      The identity management server sends requests to review users and entitlements, and subsequent reminders to each manager through an electronic communication system. This is typically e-mail, but may involve other forms of communication (instant messaging, SMS messaging, Windows popup messages and others).  
      Managers review users and entitlements, by accessing a user interface exposed by the identity management server, and keying in both initial authentication and additional login ID/password pairs. This user interface may take one or more forms, including a web form, a Windows GUI program, e-mail interaction and others.  
       FIG. 2  is a flow chart diagram illustrating the sequence of steps in the access certification method for removing stale, obsolete or incorrect users, login accounts, user objects, group memberships and security entitlements. The diagram is organized chronologically, with earlier tasks shown above later tasks. Arrows illustrate a sample sequence of events matching those described in [1].  
      The first three methods are also used to validate login ID/password pairs that a user types into to registration user interface on the identity management server.  
      The identity management server sends requests to review users and entitlements, and subsequent reminders to each manager through an electronic communication system. This is typically e-mail, but may involve other forms of communication (instant messaging, SMS messaging, Windows popup messages and others).  
      Managers review users and entitlements, by accessing a user interface exposed by the identity management server, and keying in both initial authentication and additional login ID/password pairs. This user interface may take one or more forms, including a web form, a Windows GUI program, e-mail interaction and others.  
       FIG. 2  is a flow chart diagram illustrating the sequence of steps in the access certification method for removing stale, obsolete or incorrect users, login accounts, user objects, group memberships and security entitlements. The diagram is organized chronologically, with earlier tasks shown above later tasks. Arrows illustrate a sample sequence of events matching those described in [1].  
     DETAILED DESCRIPTION—FIG.  1  NETWORK COMPONENTS AND FIG.  2  ACCESS CERTIFICATION PROCESS FLOWCHART  
      Definition: Managed System  
      A managed system may be any computer operating system, database or application where users access some features or data, and where user access must be controlled.  
      Definition: Target System  
      Please see [31].  
      Definition: Platform  
      A type of managed system. There are many possible types of platforms, including but not limited to: 
          Network operating systems: Windows NT, Windows 2000, Windows 2003, Novell NetWare, etc.     Directories: Active Directory, NetWare NDS, NIS, NIS+, LDAP, x.500, etc.     Host operating systems: MVS/OS390/zOS, OS400, OpenVMS, Tandem, Unisys, etc.     Groupware and e-mail systems: MS Exchange, Lotus Notes, Novell GroupWise, etc.     Applications: SAP R/3, PeopleSoft, Oracle Applications, etc.     Database servers: Oracle, Sybase, MSSQL, Informix, DB2/UDB, etc.        

      Definition: User  
      Users are people in an organization whose access to systems and whose identity information must be managed.  
      Definition: Manager  
      A user is deemed to be a manager if one or more other users report to him.  
      Definition: Subordinate  
      A user is deemed to be the subordinate of his/her manager. Each manager, by definition, has at least one subordinate.  
      Definition: Organization chart  
      An organization chart is some representation, possibly graphical, that captures the manager/subordinate relationships of some or all of the users in an organization. In other words, by reading an organization chart it should be possible to find any given user&#39;s manager or managers, and to identify each of that user&#39;s subordinates if that user is himself/herself a manager.  
      Definition: Account  
      An account is the data used by a system to identify a single user, authenticate a user and control that user&#39;s access to resources.  
      Definition: Login ID  
      On most systems, accounts are uniquely identified by a short string of characters. This is called the Login ID, user ID or login name.  
      Definition: Standard Login ID  
      In some environments a user may have a standard login ID, which is expected to be the same on every system.  
      Definition: Global ID  
      A global login ID is an identifier, which uniquely identifies a user in an organization. It may or may not be used as the Login ID on any one system, but is guaranteed to be unique (i.e., no two users may share the same Global ID in the same organization).  
      Definition: Entitlement  
      An entitlement is some representation of data on a managed system, which enables a single user to perform some function or access some data on that system.  
      Definition: Group  
      A group is a set of data on a single managed system that identifies a collection of users on that system. On many systems, entitlements may be assigned to groups rather than users, as this reduces the ongoing cost of security administration.  
      Definition: Attribute  
      An attribute is some characteristic of a user, either associated with that user globally, or specific to that user&#39;s account with in a single managed system. For example, login ID, full name or phone number might all be user attributes.  
      Definition: User Profile  
      A user profile is the collection of all data available about a user. It contains, at a minimum, a user&#39;s global ID in the organization, every login ID of that user on managed systems, every attribute associated with the user either globally or on individual systems, and every group membership of that user. The user profile may also contain a list of the user&#39;s managers and subordinates.  
      Definition: Role  
      A role is a collection of accounts and entitlements, spanning one or more managed a system, which represents the systems access requirements of a group of users. Roles are defined in identity management systems, and are not, in general, understood by individual managed systems.  
      Definition: Policy  
      A policy is a set of rules, typically based on information in a user&#39;s profile, which define what one or more roles pertain to that user.  
      Definition: Group Membership  
      The inclusion of a particular user, on a particular managed system, in a particular group. This may infer the assignation of the some one or more entitlements, which have been associated with the group in question, to the user in question.  
      Definition: Authentication  
      Authentication is a process used by a system to uniquely identify, a user. Most systems authenticate users by asking them to type a secret password. Other forms of authentication include: 
          Using hardware tokens.     Using a PKI certificate.     Using a smart card.     Providing a biometric sample (finger print, voice print, etc.)     Answering personal questions.        

      Definition: Electronic Signature  
      A signature is a process by which a user attests to some statement. Traditional signatures involve writing one&#39;s name in some stylized, presumably difficult-to-reproduce fashion. Similarly, electronic signatures typically require the input of some data known only to the user, such as a secret password, and logging that act in a form that is difficult to simulate.  
      Definition: Access Certification  
      An access certification is the process by which a manager reviews the users, accounts, user objects, entitlements and group memberships of his/her subordinates, identifies those that do not appear to be reasonable, and signs a statement that indicates that the remaining list is appropriate.  
      Definition: Agent  
      An agent is a software component that allows an access management system to create, update or delete accounts on a managed system, or that allows an authentication management system to set or validate passwords or other authenticators on a managed system.  
      Agents may be installed on the access management or authentication management server itself, on the managed system, or on an intermediate (proxy) server.  
      Agents installed on the identity management server are sometimes called remote agents, because they use a remote administration software protocol understood by the managed system. Conversely, agents installed on the managed system are sometimes called local agents.  
      Definition: Connector  
      Connector is another term for agent—see [84].  
      Definition: Identity Management Server  
      Identity management systems normally run on their own hardware, on a dedicated server. This is the identity management server.  
      Examples are servers used to provide self-service password reset, password synchronization, consolidated user administration, to manage access change authorization workflow, etc.  
      The invention described here is a process to identify and remove stale, obsolete or incorrect users, login accounts, user objects, group memberships and security entitlements from computer systems. These result from business changes, principally because users change responsibilities or leave the organization.  
      The process is implemented by a computer program performing the following steps: 
          1. Periodically constructing an inventory of login IDs by extracting this data from the internal user profile databases of a number of networked computer systems.     2. Periodically constructing an inventory of entitlements by extracting group membership and security attribute data from the internal user profile databases of some or all of the above-mentioned networked computer systems.     3. Constructing a list of users by merging login IDs from one or more systems of record.     4. Identifying managers in the above mentioned list of users, by referring to an electronic representation of an organization chart, to identify users with one or more subordinates.     5. Checking the review status of each manager. At least three status codes are required: unprompted, prompted and completed.     6. Sending electronic notification to unprompted managers, and reminders to prompted managers, asking them to sign into an access certification application and to review the users, accounts and entitlements of their subordinates.     7. Authenticating managers when they sign in by accepting their login ID and password to some system of record, and asking that system to check those values.     8. Displaying to each manager a list of their subordinates, login accounts and other user objects associated with each of their subordinates, and entitlements associated with each login account or user object, and asking each manager to identify suspicious or erroneous users, accounts and entitlements in the list. Conversely, managers may be asked to identify, reasonable users, accounts and entitlements in the list, so that suspicious or erroneous ones can be inferred.     9. Displaying to each manager the review status of each of their subordinate managers, so that each manager will communicate with and cause their subordinate managers to complete the process as well.     10. Prompting each manager with no subordinate managers, upon completion of his/her review, to review the text of a legal agreement validating completion of the review process, and to electronically sign that legal agreement by re-authenticating (as in step 7).     11. Prompting each manager whose subordinate managers have no subordinate managers of their own, and who have completed step 10, upon completion of his/her review, to review the text of a legal agreement validating completion of the review process, and to electronically sign that legal agreement by re-authenticating (as in step 7).     12. Repeating step 11 by traversing the organization chart from bottom to top, until at last all managers except the very top one have completed step 11, and the top manager (e.g., in a private corporation typically the CFO or CEO) can certify the appropriateness of the users, accounts and entitlements of the people who report directly to him, and also can offer some assurance that every other manager in the organization has done likewise.        

      This process has several advantages over other strategies that have been used in the past in an attempt to achieve the same end result of limiting user access to and entitlements on computer systems to just those that are appropriate to business requirements: 
          1. This process is feasible to implement. It does not require massive new data such as role definitions or user-to-role classification.     2. This process is feasible to automate, and does not have to be implemented by manual interviews or with massive reports listing current users and entitlements.     3. This process can be executed in parallel, with hundreds or thousands of managers concurrently reviewing the access rights of their subordinates. As a result, this process can be completed in a fairly short period of time.     4. The process is direct, in that it asks managers to indicate what users, accounts and entitlements are incorrect or inappropriate. In contrast, some past processes have inferred inappropriate access through measured inactivity, which is strictly circumstantial evidence, and ma, lead to incorrect results.     5. This process does not require modeling of security privileges, which has proven to be challenging or impossible to implement in large organizations in the past.