According to Gartner, Identity and Access Management (IAM) is the security discipline that enables the right individuals to access the right resources at the right times for the right reasons.
IAM solutions provide a methodic framework for granting and requesting access to applications along with enforcing access controls and ensuring visibility into access events.
The focus of this blog is the integration ecosystem of Cloud Access Management and PKI credential management solutions.
There are clear benefits to managing IAM centrally for all applications, be they web portal, cloud-based services, VPNs or virtual environments. According to a recent Gemalto survey, organizations on average protect 3 to 4 applications of each type with two-factor authentication (2FA). Given the numerous management complexities that arise from a fragmented IT environment, it comes as no surprise then that 94% of IT decision makers would like to be able to manage two-factor authentication centrally for all the applications in their organization.
By ensuring your Identity and Access Management solutions’ integration ecosystem is as broad as possible, you are paving the path for a smooth, quick and cost-effective implementation of whatever IAM functionality you’re looking to gain, be it PKI credential management, cloud identity management or cloud SSO. A pre-integrated and validated solution spares your IT department the need for additional development and subsequent performance issues.
When checking the breadth of a prospective IAM solution’s integration ecosystem, it helps to evaluate it against specific use cases and resources you are looking to support, as exemplified below.
• Digital signature – Based on PKI credentials, these enable proving that a document, transaction or email were signed.
• FDE – Full-disk encryption (FDE) encrypts data on a hard drive so that it cannot be understood by anyone who doesn’t have the key to decrypt the data.
Solutions that support industry-wide standards enable you to meet current, upcoming and evolving business needs.
• OATH – An open reference architecture for implementing strong authentication, produced by an industry-wide collaboration of security vendors for the universal adoption of strong authentication. The standards includes widely used algorithms for generating one-time passcodes.
• SAML – An open source protocol, produced by the OASIS standards consortium, for integrating cloud apps using a central, trusted identity provider
• RADIUS – Commonly used by VPNs and security gateways, RADIUS (Remote Authentication Dial-In User Service) is a client/server protocol and software that enables remote access servers to communicate with a central server to authenticate users and authorize their access.
Major sporting events have become significant cyber crime targets, including cyber attacks on individual attendees. Organizers and attendees must remain cautious and aware of cyber threats. If you are organizing…
Fancy Bear has leaked what it asserts are documents stolen from the International Luge Federation (ILF) two weeks ahead of the 2018 Winter Olympics.
On 24 January, the digital espionage group posted a statement explaining its motivation for conducting what it calls “OpOlympics”:
Fancy Bears’ Hack Team has repeatedly reported anti-doping rules violations in summer sports. Today, prior to the Olympic Games in Pyeongchang we decided to call your attention to winter sports that have the same doping-related problems as track and field or football. The obtained documents of the International Luge Federation (FIL) show the violations of the principles of fair play: widespread TUE approvals, missed anti-doping tests and the double standards approach towards guilty athletes.
The threat actor goes on to note how the leaked documents allegedly demonstrate an “institutional conspiracy by… national sports federations” as well as “repeated problems with doping sample bottles.”
This isn’t the first time that Fancy Bear, to which security firm CrowdStrike has attributed the 2016 hack of the U.S. Democratic National Committee (DNC), has targeted athletic organizations in the name of revealing “anti-doping rules violations.” In September 2016, the group infiltrated the World Anti-Doping Agency (WADA) and published private documents concerning athletes whom the Agency has previously evaluated. The data dump followed on the heels of WADA’s recommendation that Russian athletes be banned from the 2016 Rio Olympics over state-sponsored doping practices.
Jason Hart, CTO of Data Protection at Gemalto, is familiar with the 2016 incident along with the fact that WADA found inconsistencies between the data illicitly published by Fancy Bear and the information stored in its Anti-Doping Administration and Management System (ADAMS). For that reason, he is skeptical about the veracity of the documents that Fancy Bear claims to have stolen from the ILF:
Much like Fancy Bears’ hack of the World Anti-Doping Agency’s (WADA) website last year, these documents need to be taken with a pinch of salt, as the hacking group has a history of changing the data they steal to suit their own purposes. This data manipulation poses an arguably greater threat to organizations than simple data theft, as it can allow hackers to alter anything from stock or sales numbers and in this case, potentially the reputations of innocent athletes.
It’s important to note that organizations also make business decisions based on data. As a result, if someone compromises or changes this information, a company could potentially act in a manner that contradicts its interests and/or threatens its continuing viability.
Acknowledging the risks posed by data manipulation, organizations need to conduct a data risk assessment to identify their key data by department and division and determine the risks of what would happen if someone compromised or altered that information. They should then use that assessment to take extra care in protecting the integrity of their most valued data. This process necessitates a two-pronged approach: the application of security controls such as encryption, key management and two-factor authentication (2FA), as well as training of their workforce.
At one time maybe these were just fancy buzzwords, but now they describe workplace reality in the 21st century. Sure, some organizations still operate with that top-down, Flintstonian mentality. You don’t question executive decisions and whether you’re content or find your job rewarding is irrelevant. You’re receiving a paycheck and are expected to do your job. Keep your trap shut and be miserable on your own time.
Only now there is irrefutable evidence of the relationship between happy employees and profitability. In his book, Culture Hacker, Shane Green references a study from the University of Warwick in England indicating that happy employees increase productivity by 12% while unhappy employees decrease productivity by 10%. Disgruntled employees mean dissatisfied customers, Green says, and eventually you’ll lose both. Bet on it.
Gallup’s 2017 “State of the American Workplace” reveals that engaged employees boost profits by 20%. Several years ago, Forbes reported that revenues increased by around 22% for the magazine’s annual “100 Best Companies to Work For.”
Among the Gallup study’s eye-opening conclusions that should petrify business owners and executives:
“If you want better profits and productivity,” Green writes, “then make the delivery of a great employee experience and better culture your main thing.”
Making a weak culture strong requires a significant overhaul. Green cites the case of CHG Healthcare Services, which places medical professionals in hospitals across the U.S. Fifteen years ago CHG experienced a 50% to 60% annual turnover rate – around the industry norm these days. Now the company regularly appears in the Fortune “100 Best Companies to Work For.” The turnaround started after executives interviewed every employee and manager about its corporate environment.
Your organization may have to use an outside consultant to evaluate your situation before you even begin taking remedial steps. The transformation process requires months. You have to willing to endure. But there’s a fundamental lesson that great leaders already know and aspiring leaders must embrace. You set the climate for your organization’s culture. Your employees take their cues from you. You are a mirror — your employees reflect your attitude, outlook and behavior. If you project pessimism, don’t expect those under you to be optimistic. If you are cranky and dull, then you’d be foolish to expect your people to run around blowing whistles and ringing bells.
It isn’t enough to have a great sales strategy or terrific products. Your bottom line ultimately hinges on how you treat your employees.
“Culture is no longer just a human resources priority or thing,” Green writes. “It is a fundamental business thing.”