The Case for Penetration Testing

Overview
Penetration Testing is the method of testing that focuses on finding areas of weakness in software systems in terms of security. These areas are put to the test to determine if they can be broken into or not.

A penetration test is a proactive and authorized attempt to evaluate the security of an IT infrastructure by safely attempting to exploit system vulnerabilities, including OS, service and application flaws, improper configurations, and even risky end-user behavior. Such assessments are also useful in validating end-users’ adherence to security policies.

The fundamental purpose of penetration testing is to measure the feasibility of systems or end-user compromise and evaluate any related consequences such incidents may have on the involved resources or operations.

Reason for Penetration Testing

• Security breaches and service interruptions are costly
• Security breaches and any related interruptions in the performance of services or applications can result in direct financial losses, threaten organizations’ reputations, hamper customer loyalties, and trigger significant fines and penalties.
• Identifies and prioritizes security risks 
• Penetration testing evaluates an organization’s ability to protect its networks, applications, endpoints and users from external or internal attempts to circumvent its security controls to gain unauthorized or privileged access to protected assets.

When Should Penetration Testing be Performed?

Penetration testing should be performed on a regular basis to ensure more consistent IT and network security management by revealing how newly discovered threats or emerging vulnerabilities may potentially be assailed by attackers. Tests should also be run whenever:

• New network infrastructure or applications are added
• Significant upgrades or modifications are applied to infrastructure or applications
• New office locations are established
• Security patches are applied
• End user policies are modified

Benefits of Penetration Testing

• Intelligently Manage vulnerabilities
• Avoid the cost of downtime
• Meet Regulatory requirements and avoid fines
• Preserve customer loyalty and corporate image

How to Conduct Penetration Testing

• It starts with a list of Vulnerabilities/potential problem areas that would cause a security breach for the systems.
• If possible, this list of items has to be ranked in the order of priority/criticality.
• Devise penetration tests that would work (attack your system) from both within the network and outside (externally) to determine if you can access data/network/server/website unauthorized.
• If the unauthorized access is possible, the system has to be corrected and the series of steps need to be re-run until the problem area is fixed.

Criteria for Selecting the Best Penetrating Tool

• It should be easy to deploy, configure and use.
• It should scan your system easily.
• It should categorize vulnerabilities based on severity that needs immediate fix.
• It should be able to automate verification of vulnerabilities.
• It should re-verify exploits found previously.
• It should generate detailed vulnerability reports and logs.

Some of Tools Used for Penetration Testing

• Metasploit
• This is the most advanced and popular Framework that can be used to for pen-testing. It is based on the concept of ‘exploit’ which is a code that can surpass the security measures and enter a certain system. If entered, it runs a ‘payload’, a code that performs operations on a target machine, thus creating the perfect framework for penetration testing.
• It can be used on web applications, networks, servers etc. It has a command-line and a GUI clickable interface, works on Linux, Apple Mac OS X and Microsoft Windows. 
• WireShark
• This is basically a network protocol analyzer –popular for providing the minutest details about your network protocols, packet information, decryption etc. It can be used on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many other systems. The information that is retrieved via this tool can be viewed through a GUI, or the TTY-mode TShark utility. 
• Core Impact
• CORE Impact Pro can be used to test mobile device penetration, network/network devise penetration, password identification and cracking, etc. It has a command-line and a GUI clickable interface, works Microsoft Windows. This is one of the expensive tools in this line and all the information can be found at below page.

Conclusion

Penetration testing must be performed to manage 

• Intelligently Manage vulnerabilities
• Avoid the cost of downtime
• Meet Regulatory requirements and avoid fines

To learn more about Prolifics' testing solutions, visit: http://www.prolifics.com/solutions/quality-assurance-testing

Ritesh Sujir is a Delivery Manager in the Testing Practice at Prolifics. He is an accomplished project management professional with 14+ years of experience working with Fortune 500 clients. Ritesh specializes in all aspects across project management and is accountable for the development and maintenance of project plans, risk assessments, and status reports. His recent experience includes clients in the Banking, Retail, and Healthcare verticals.

Prolifics Employee Showcase: Alan Shemelya, VP of Healthcare Business Development

Alan Shemelya is the Vice President of Healthcare Business Development and is responsible for growing Prolifics’ healthcare services and solutions for customers around the world. With more than 30 years of experience and thought leadership in the Healthcare industry, Alan has accomplished an impressive list of milestones over the course of his career and is passionate about not only helping businesses achieve success but also making significant strides in patient care.

Commitment to Healthcare
Alan’s passion for the healthcare industry began as a young child after a trip to the hospital. His interest grew in college when he wrote a thesis on healthcare finance. During this project, he realized that hospitals were manually driven in just about everything they did on a daily basis and were operating 10 years behind. From registration to billing, automated processes simply did not exist.

It was at this time that Alan recognized an opportunity in the industry. Throughout his career, his work has always been driven by a consistent mission: finding ways to improve the care of sick children.

The Road to Prolifics
Alan joined the Prolifics team in March 2014. Over his career, he has worked with a number of leading healthcare information technology (HIT) and consulting companies in Sales, Product Development, Marketing and Implementation of EMR, Revenue Cycle and ERP solutions. Prior to joining Prolifics, Alan provided his leadership and expertise at HCA/Parallon, Xerox/ACS, Allscripts and McKesson.

Alan is driven by his motivation to provide innovative IT solutions for the provider and payer markets, specializing in improving patient, provider and payer communications, business process enablement, and outcomes. With Alan’s expertise in the healthcare industry, experts will have the experience, skills and knowledge necessary to deliver in this highly complex industry, aligning innovative and proven solutions to solve clients’ business goals.

Innovation & Thought Leadership
Alan has written articles on the redesign of business processes and advancement in technologies that enable the automation of workflow decisions impacting both providers and payers. He has been a featured speaker with the Southern Healthcare Administrative Regional Process (SHARP) and has been on the National Speakers List for the Healthcare Financial Management Association (HFMA). Below is a list of articles that Alan has published throughout his career.

HFMA ANI, 2009
HFMA Georgia Meeting, 2010
HFMA Patient Friendly Billing – Accessibility of Data

The Future is Bright
When asked, Alan selected the following three words to describe Prolifics: agility, intelligence, responsibility. He finds these characteristics as key drivers for success in building innovative healthcare IT solutions.

A Recent Journey
Alan recently participated in the AIDS/LifeCycle 2014 bike ride. This is a fully supported, 7-day bike ride from San Francisco to Los Angeles designed to raise money and awareness in the fight against HIV/AIDS. This event delivers a life-changing experience for thousands of participants from all backgrounds and fitness levels united by a common desire to do something heroic. Prolifics proudly supports Alan and this worthwhile cause!

Alan Shemelya is the Vice President of Healthcare Business Development at Prolifics. He is responsible for growing Prolifics' healthcare services and solutions for customers around the world. Alan has 30 years of experience and thought leadership in the Healthcare industry, specializing in Sales, Product Development, Marketing and Implementation of EMR, Revenue Cycle and ERP solutions. As an industry expert in the healthcare financial arena, Alan has written articles on the redesign of business processes and advancement in technologies that enable the automation of workflow decisions impacting both providers and payers. He has been a featured speaker with the Southern Healthcare Administrative Regional Process (SHARP) and has been on the National Speakers List for the Healthcare Financial Management Association (HFMA).

Enterprise Entitlement Engine and Framework

Overview
A key goal of business technology systems is to ensure that the right people have access to the right information at the right time. Entitlements Engine is a fine grained authorization engine that externalizes, unifies, and simplifies the management of complex entitlement policies—strengthening security and compliance, improving IT efficiency, and enhancing business agility. These authorizations may be used to protect the most fine grained business or IT concept. Many organizations look into this as high prioritized need and to be managed by Centralized Application/Tools for proper Authentication and Authorizations.

Essentially, systems accomplish these requirements by enforcing a set of policies that regulate the behavior of system components and resources to match the “access” profile of the user accessing the system. At the most abstracted level, the system forces a user to specify and verify who they are (authentication) and then limits resources that can be accessed or manipulated by the user (authorization). Policies and rules govern each of the two facets. These two components of access management impose different types of challenges and requirements.

Authentication – establishing and validating identity. In most cases user ids and passwords presented at login screens/forms suffice.
Authorization – what information is a user permitted to access and manipulate – can impose very complex requirements.

The Entitlement Engine will be a critical enterprise component that addresses the requirements for fine-grained, context-sensitive authorization requirements. Authorization needs are not hard coded into applications, but rather specified as “configuration” in a UI provided by the Entitlement Framework. It is intended to be “application context aware”, thus providing a means to express very fine-grained authorization requirements to the system. It integrates as a service layer with the application, providing loose-coupling. In addition, it can be integrated within an application’s presentation and validation framework to eliminate screen-at-a-time integration effort – making the execution seamless to developers.

Concepts
Authentication: Before a user or another system can access any resource managed by the system, the requesting entity must establish and “authenticate” their identity.  At a high (simple) level, this process is implemented using one of several authenticating forms (certificates, logins, biometrics, etc.), depending on the context of the request and the requirements of the established policy. Most commonly, a user provides credentials (user-id, password) at “login”. If the provided credentials meet the security requirements, system can proceed with the identity of the validated user. The authentication process is supported by a multitude of rules and policies (e.g., password rules, expiration policies, failed attempts, etc.) that guard against users (and other systems) trying to gain unauthorized access.

In Current Entitlement Engine Authentication is not addressed as this is maintained by other Third party tool.

Authorization:  In an organization or business unit there are people in different roles who are required to perform specific tasks – but not authorized to perform other tasks. Enterprise applications and resources facilitate these individuals in performing their job functions efficiently and effectively. As these applications and resources will be accessed by people with different levels of authorization, applications require the capability to provide the necessary restrictions based on the role the user has.

Role Based Access Control (RBAC):   
The first part of the authorization approach relates to restricting system access to authorized users based on the role they have. Thus, authorization is expressed as permission sets based on roles.
RBAC is considered “Coarse-grained” authorization and is used to define broader-level functionality (features or resources) a role can access. Users are assigned one or more roles. When that user logs in to a particular application, the application can determine what resources (menu items, screens, etc) that user can access, based exclusively on their role.

Limitations:
At this level, we cannot define the “context” in which the feature is being accessed and, therefore, not specify a specific permission set for a “context”. For example, the authorization policy – that a Credit Reviewer cannot approve a Commitment – can be expressed and executed just based on a user’s role.
We also do not have a way of creating a profile based on the user skill set and assign permissions that are based on attributes other than role.

Attribute Based Access Control:  
The second part of the authorization approach augments RBAC capabilities to allow policies based on attributes of a user (e.g., skill, age, etc) and/or the environment (e.g., time, network, etc). While this notion can be extended to additional attributes (like application or business object), there is no structured (or simple) mechanism in off-the-shelf products to facilitate accessing these attributes or to define policies applicable to these attributes. Further, these tools do not support out-of-the-box facilities to help integrate with applications to execute policies in a runtime environment. Managing fine-grained control in a flexible manner while lowering the cost of delivery and maintenance requires the framework to be “context aware”. It must support exposing application and object attributes (e.g., screens, forms, button in an application or loan amount, LTV, etc.) at definition time so that policies for these (and other) attributes can be defined for profiles and roles. In addition, the framework needs to support convenient integration with the application framework.  Moreover, the architecture of the framework must allow efficient execution of privileges at runtime so that the system will scale with high volumes.

3. Objectives
The objectives of the proposed Entitlement Engine are:

1. Fine grained authorization which gives the flexibility in defining the permissions based on a context for a specific role or profile.
2. Policies can be defined with relevance to context. 
3. To provide centralized way of defining and evaluating policies based on the application, object, roles, profiles and resources. Changes are achieved through “configuration”.
4. To integrate with the application framework and perform efficiently, since policies are defined as values, ranges and lists for attributes and not in a computer language.

4. Solution Approach
The approach proposed here it to develop and deploy an Enterprise Entitlement Engine and Framework that specifically meets the sophisticated needs of the organization. Below is the level of access or security control that Entitlement Engine is proposed to have.

Traditional IAM tools like (Oracle Enterprise Manager, IBM TIM and TAM, WSO2 Identity server) are good in providing a centralized way of access management at the enterprise resource level (show a form or not show a form) but not for managing “sub-resource” level details and privileges. They lack a centralized way of access management at the Object, Record and Field level, particularly in the context of an application that manipulates these objects. 

The proposed Entitlement Engine provides some critical features to meet the necessary requirements.

1. A business user interface to define profiles and associate access to the lowest level (field or data in a field) per application. 
2. Entitlement engine provides the permissions for a specific role or profile based on the object hierarchy for the application once the user logs in. 
3. As the permissions need to be evaluated for all the users who login the engine would be performance sensitive and would need to bring all the permissions and access on the whole object hierarchy.  As we are not going to evaluate the permissions on each and every field, the approach is to cache the context specific retrieved entitlements so that there would be zero latency in the requests made by the application.
4. The Entitlement Engine also provides a way for certain role to delegate some of his permissions to the roles under him. This gives the flexibility for the manager to maintain business continuity even in his absence. All the activities done would be audited and tracked for future reference.
5. Entitlement engine provides services, which can be accessed by applications, which are built in any language and get the permissions. The engine provides RESTful web-services which could be integrated for better performance.
6. Entitlement engine provides various reports on the profiles created, usage of applications, delegations made by profiles, changes in object permissions etc. This helps the management as well as the compliance team to make sure the access to the applications and features within the applications is based on the standards defined.
7. Entitlement engine is built upon a framework which could be extended as needed as well can integrate with any existing systems as needed. 
8. Entitlement engine has inbuilt caching mechanism’s implemented which bring down the response times for requests from applications. The architecture is built-in to consider high availability and fail-over by proper load balancing at various layers.

5. Entitlement Engine Features

Entitlements System has the following features:

System Management

In our entitlements system we treat every enterprise resource as a system. We can define different kinds of systems like Web Application, Web Service, Database, FTP server, any network device etc., by using our pre-configured metadata about different system types.

Below are the high level features 

• Defining  System
• Associating attributes defined in the System type to System
• Associating Object Hierarchy to a system
• Defining  allowed access types to the objects in the object hierarchy

Object Hierarchy Management

This feature allows defining and associating an object hierarchy to a system. Every system has a specific object hierarchy. We have pre-configured object types which can be associated to these objects or we can extend the metadata as needed. At the object level we can define what different kind of access can be allowed on this object.

Configuration Management

Every feature (System, Profile, Access and Object) in the entitlement system is based on a type. The configuration management helps in defining the metadata for the features provided by the entitlement system. 

Below are some of the configurations

• System Type
• Object Type
• Access Type
• Identity Provider

Profile Management

Profile defines what level of access a user has with a particular system. Profiles are created for specific systems and then associated with user(s), role.

High level features 

• Profile Creation - A particular profile can be created for the System Object hierarchy. 
• Profile  Delegation - This feature allows a manager to delegate some or all of his objects from a profile to a sub-ordinate. The manager can also specify the duration and can change the level of access for that delegated profile.
• Profile Configuration - Profile can be configured against associated system object hierarchy. Extended data constraints can be configured for objects in object hierarchy.

Integration with Third -Party  Identity Providers

The entitlements system is powered to integrate with any third party Identity provider. The system has also the capability to define identities internally or map/sync the identities from different third party vendors. The internal structure mapped based on Users,

•  Users - We have regular sync job which update the users in our entitlements system with the third party provider.

User Profile Management

Entitlement Engine facilitates mapping profiles to users.

Entitlement  Services

These are the different services provider by our entitlements engine to the enterprise applications (for getting the entitlements for the logged in user). We have pre-defined services which can be accessed by REST Protocol.

Audit Control

Every action done on the entitlements system is tracked. We have a view and edit history on every feature (System, Profile, Object Hierarchy etc.) of the system. 

Reports

There are several reports provided by our entitlement system which gives a high level as well as detailed information to the business users.

Below are some of the canned reports

• Users based on selected  profiles
• Delegated profiles
• Profiles based on system
• Profiles mapped to users, organization units and cost center
• System level profile usages by user

Back-End jobs

There are back-end scheduled job to sync-up the identity info from the configured identity provider.

Note: The below are handled by a third party tools.

1. Identity Management: The third party tool will be taking care creation, updating and managing the User identities.
2. Authentication: The third party tool will be taking care of the authenticating the user based on the identity provider and provide a federated access or SSO implementation for the enterprise applications.

6. Technologies 

Operating System	Windows XP/Windows 7(Development), RedHat Enterprise Linux 5(Production)
IDE/Language	Eclipse / Java
Secondary Cache/Persistence Frameworks	Memcache
Frameworks	PrimeFaces 3.5, Spring 3.0
UI/Ajax Frameworks/HTML/CSS	JQuery
Database	PostgreSQL
Browser Compatibility Test	IE 6.0+, FireFox, Chrome, Safari
Web Server/Application Server	JBoss 7.1.1

7. Advantages on Building on Open Standards

Our solution is built on open standards so that it’s easy to integrate with any IAM tool and heterogeneous applications based on different environments. Below are some of the details.

1. We have built-in adapters which could be used by the enterprise applications which do understand the authentication tokens which are SAML based.
2. We have built-in connectors which help the applications to communicate over SOAP, REST or Thrift. This gives the applications the flexibility to choose the protocol they need.
3. We have built in service providers for giving out the defined application level permissions in the form of XML, JSON or Compact mode.
4. We have built-in adapters when configured can talk to any XACML based PDP. This adapter does understand the XACML response and can provide the response back to the application based on their needs (SOAP/JSON/Compact etc.).
5. Our solution is built on open source frameworks (Spring, Primefaces) and deployed over JBOSS as the application server. 

To learn more about Prolifics, visit www.prolifics.com.

An Inside Look: Prolifics Identity Management Health Check

Some identity management solutions produce interfaces and results that look decadent, others homemade.  Some are simple and pure, and others a blazing tangle of neon-lit panels. Whether an identity management solution appears simple or elaborate, the reality is those consumable interfaces sit atop a service bundle responsible for keeping access data to critical business systems flowing.

If you see something like this on the front:

The measurements may come from something like this:

(not an actual IM administrative panel)

Robust solutions can be configured to heel systems into measurable formation, and report anticipated conditions to responsible parties.  One picture can clearly call out an error, such as a connection choking on a query because an index became too fragmented and is now thrashing on I/O.   Most facets of a functioning identity management solution can be known and therefore measured.

That is, until they change.

• Certificates or passwords expire
• Software needs to be patched
• Organizations want to adapt to new opportunities
• Organizations anticipate growth
• New security mandates are introduced

Entropy rules all, even in software.

Two ways to prepare for the changes that affect an identity management system are to be reactive - trust existing monitors and processes, wait for something to happen, and respond - or be proactive and review system health.  The difference is fodder for FUD (Fear, Uncertainty, and Doubt).  Only the most masochistic of us appreciate learning a litany of imminent problems and shortcomings on the back of resolving a current one. And, as experts in identity management, Prolifics prefers getting in front of a situation instead of waiting until a customer encounters one problem only to bear the bad news that they have five more.

The Prolifics Identity Management Health Check is a proactive review of an existing identity management installation. Prolifics inspects the environment, current running software, logs, and activity.  The result of a health check is a forecast for upgrade potential and how current system monitors may respond if current conditions continue.  

The following topics are included in a Health Check:

• Hardware and Operating System
• Software Solution Infrastructure
• Documentation and Architecture
• Utilization
• Authorization
• Identity Management
• Services
• Policies
• Workflows
• Operations
• Lifecycles
• Permissions
• Schedules
• Directory Integrator
• Databases
• Directories
• Customizations

After inspecting the previous areas, several important artifacts will be created:

1. A detailed map of the current infrastructure, which can be used for audits, upgrades, customizations, and future problem resolution
2. Recommendations for configuration changes, patches and updates
3. Critical discoveries

When everything works the way it should, the little lights blink, texts and emails and robo-calls are made, and all is good, Then, one day, comes a furlong of stack trace or cryptic code to announce that something unexplainable happened.  It could be an innocuous event, or it could be symptomatic of a more serious problem. Someone will have to look past the friendly front ends, behind the reports, and go below the surface.  There they will confront the complexity of an identity management solution. 

(An actual IM infrastructure)

In cases like this, it's always good to be prepared.

To learn more about Prolifics' security solutions, visit: http://prolifics.com/enterprise-security

Stephen Cote is an Enterprise Solutions Architect at Prolifics. He brings extensive experience in orchestrating enterprise architectural initiatives while creating marketable products that drive revenue and protect assets. Stephen is a creative technology leader with more than 18 years of involvement in all aspects of software development from inception to release, as a manager, architect, and technical engineer.

Prolifics Accelerator Approach: Driving Security Implementation Success with Identity and Access Management Power Tools

A good Systems Integrator knows how to create powerful technical and business solutions for their customers. A great one can assemble solutions and collate the technical and business knowledge from their work at many customers for the benefit of the rest. Over the years of performing superb Security services for our customers, Prolifics has created numerous implementation accelerators that we bring, often at no cost, to our new customers.

Prolifics has proprietary tools built for IBM Identity and Access Management (IAM) that simplify upgrades and operational maintenance by up to 40%. The “IAM Power Tools” provide specialized capabilities in:

Automated Regression Testing
Our Power Tools leverage our unique knowledge of IBM Security Identity Manager (ISIM) Workflows, customization and APIs. They utilize the keyword-driven testing approach to support Test Driven Development and complete path for testing – from an ISIM request to a change on the end system. They provide regression, functional, unit testing and UI testing. They also uses a generic free and open source test automation framework (Robot Framework), GUI and test case creation and provide test result clear reports.

IAM Configuration Management and Migration
A set of automation tools written as SDI assembly lines to operate and manage any number of ISIM customizations. It simplifies backup, version control and en-masse changes to customizations in workflows, provisioning policies, forms, mail templates, ACIs and other forms of ISIM customizations.

Automatic Workflow Analysis and Documentation (AWD)
AWD creates automatic maps of all identity workflows, generic and customized in one unified view. It can make even the complex 'spaghetti' workflows manageable and maintainable by providing printable PDF's of all nodes, connections, flows and invocations. It is easier and more intuitive to understand than the internal ISIM workflow editor with more relevant information in plain English, rather than javascript. Color coded and carefully laid out automatic documentation makes it possible to keep up to date architecture documentation, easy to understand by business and technical users. Combined with the customization export PowerTools AWD takes operational support and issue tracking to the next level.

ISAM Script Automation
IBM Access Management appliances, both physical and virtual eschew the pdadmin scripting for integrity reasons. Yet, pdadmin scripting is one of the oft used low level automation mechanisms that many of our our customers use. We had created a translation interface that allows existing pdadmin scripts to run on the new IBM Access management appliances, allowing our customers to retain their existing administration and configuration techniques and procedures and thus ease migration to the appliances.

In addition to the PowerTools that our consultants use and train our customers on, Prolifics owns an IAM Adapter & Profile Library that extends the reach of IBM’s portfolio to a wide range of common and specialty applications. The library includes dozens of adapters to connect, provision to and reconcile from a multitude of enterprise ERP, CRM, Financial, HR, IT and line of business systems that we had encountered over the years.

Inviting a security integrator like Prolifics, that packages solutions and assembles accelerators for the customers, helps you reap the rewards of faster implementations, simpler maintenance projects and proven processes. Our clients benefit not just from direct expertise that we bring with our knowledge and experience, but also from the powerful assets that we created over the years in the industry.

To learn more about Prolifics' security solutions, visit www.prolifics.com.

Alex Ivkin is the Vice President of the Security practice at Prolifics. With a deep understanding of compliance, governance and risk management, Alex brings more than 15 years of experience in a broad array of computer security domains. Alex has worked with large and small organizations to help drive security initiatives and deploy various types of enterprise-class identity management and application security systems. In a Security Architect role, he has helped companies succeed in attaining regulatory compliance, improving business operations and securing enterprise infrastructures. As the head of the Security Practice, Alex leads a team of highly skilled consultants to deliver comprehensive security solutions to our clients. Alex is an established and recognized security expert, a speaker at various industry conferences, holds numerous security certifications, two bachelor’s degrees and a master’s degree in computer science with a minor in psychology.

IBM Pulse Session Recap: Prolifics Identity Intelligence: Threat-Aware Identity and Access Management

At IBM Pulse 2014, Russell Tait was selected to speak on a panel with other security experts to highlight Prolifics' Identity Intelligence solution.

During this session, Russell shared how integration with key areas of the IBM Security portfolio can increase solution value for customers. The panel discussion covered strong authentication, mobile, cloud, and security intelligence use cases.

View the session presentation below!

Identity intelligence: Threat-aware Identity and Access Management from Prolifics

Identity is the New Perimeter
Prolifics’ Identity Intelligence solution with IBM QRadar delivers a comprehensive solution with actionable insights and has been recognized by IBM with the Ready for Security mark. This solution is uniquely positioned to extend the integration of traditional Security Information and Event Management (SIEM) to identity systems to more intelligently manage security risks from user activity in real time and provide continuous control of insider threats through identity analytics.

To learn more about Prolifics' Identity Intelligence solution, view our solution brochure.

Want to connect with Russell?
Russell Tait on LinkedIn
Russell.Tait@prolifics.com

For more information about Prolifics, visit www.prolifics.com.

Extend ISIM’s Visibility to Unstructured Data with StealthBits

In this age of Access Governance, organizations need to know who owns the data, who has access to it and how they were granted that access. IBM Security Identity Manager (ISIM) effectively provides visibility into access, policy, role management and it also facilitates periodic entitlement reviews of access across numerous systems. However when it comes to provisioning and management of access, a critical link between the access management platform and the unstructured data on managed resources is missing. Traditionally, ISIM can reconcile Group data (i.e. structured data) from access management platforms like Active Directory and open the way for effective Role Discovery and Role Based Access Control (RBAC). However it is unable to extend the same capabilities into the unstructured data components primarily because it lacks the ability to explore what access has been granted to the Users and the Groups as the data is too difficult or distributed to understand.

Unstructured data refers to disorganized information that does not have a data structure (i.e. exist within a database). Examples of “unstructured data” may include documents, presentations, spreadsheets, scanned images, multimedia files stored in file repositories like regular file systems or an advanced collaborative tool like SharePoint. This type of data is critical to every business as users frequently collaborate on such files that often contain sensitive information. It is critical for the organizations to ensure that the users have access to correct data and any unnecessary accesses are revoked.

This visibility gap is effectively fulfilled by StealthBits' StealthAUDIT Management Platform (SMP). StealthBits has the capability to crawl across an organization’s environment discovering unstructured data and dump a single, consolidated entitlement catalogue containing key information such as:

• Who owns the unstructured data
• Who has access to this unstructured data items – Users and/or Groups.
• How access has been granted – Is it through a Group?

Not only does this StealthBits product discover unstructured data, it also pushes this discovered data to ISIM through its Data and Access Governance connector. With this direct integration of StealthBits with ISIM, organizations can now

• Control provisioning and revocation of access to unstructured data from ISIM and 
• Accelerate the effort to map all these unstructured data items to ISIM. 

This is how organizations can leverage their existing ISIM investment with StealthBits to manage access control on unstructured data:

1. StealthBits' StealthAUDIT Management Platform discovers unstructured data in an environment and creates a consolidated view of entitlements. SMP also determines the AD Groups that have access to these unstructured data items.
2. Items discovered by SMP can be selectively published to ISIM.
3. After the publish activity is complete, “Access” on the AD Groups that entitle access to these items is automatically enabled by the publish workflow.

4. SMP helps identify an owner for the access.

5. Once these accesses have been defined, organizations can implement the Request Based Access Control model for the unstructured data items leveraging the existing advanced workflow processes for user self-service requests of access to organizational resources.

At IBM Pulse this week, Prolifics is showcasing this security solution and other solutions that help organizations around the world manage risk and compliance. Our experts will also be sharing recent client success stories in the solution showcase and across several conference sessions.

Learn more about our presence at Pulse and download session replays by visiting our conference page.

Nikhil Firke is a Security Solution Architect with Prolifics. He has an extensive background in design and implementation of Identity and Access Management solution for organizations around the world. Nikhil is a Certified Information Systems Security Professional (CISSP) and a certified solution advisor for IBM security and compliance management solutions.

Are you Prepared for Gen Y?

The first question many of you will have in their mind is: "What does Gen Y mean?"

Wikipedia says “The Generation Y, also known as Millennial Generation, is the demographic cohort following Generation X. There are no precise dates when the generation starts and ends. Commentators use beginning birth years from the early 1980s to the early 2000s.”

Most importantly below are a few notable characteristics of Generation (Gen) Y in comparison to other generations in the workplace :

1. Gen Y demands flexible work hours – a story in Time magazine says “Gen Y Seeks Work-Life Balance Above All Else”
2. Gen Y is focused on extrinsic values such as image, money etc.
3. Gen Y is highly tech-dependent – “Millennials Tech-Dependent, But Not Necessarily Tech-Savvy”

The Gen Y itself is one of the biggest driver for many new initiatives in an organizations such as Bring Your Own Device (BYOD), social media (Facebook, Twitter, etc) and many more. Since Gen Y is the next greatest generation, most organizations are undergoing paradigm shift and that’s why perimeter based security is evolving and moving to virtual perimeters.

Identity is the new virtual perimeter, and traditional Identity and Access Management solutions are not sufficient to enhance visibility of environment, provide actionable insight and risk-based scoring in context to identity. The Prolifics’ Identity Intelligence solution with IBM QRadar delivers a comprehensive IAM.next solution with actionable insights and 360 degree view of IT environment. Our solution is uniquely positioned to extend the integration of traditional Security Information and Event Management (SIEM) to identity systems to more intelligently manage security risks from user activity in real time and provide continuous control of insider threats through identity analytics.

Want to learn more about our Identity Intelligence solution? Read more here.

Nilesh Patel is a Security Solution Architect with Prolifics and he is a preeminent identity and access management and security intelligence expert. Nilesh is a certified solution advisor for IBM security and compliance management solutions and he is an accredited IBM Redbooks® Master Author. Prior to Prolifics, Nilesh worked with IBM as Senior Identity and Access Management and Security Intelligence Professional.

Prolifics Identity Intelligence for Today's Security Challenges

The term security is really a wide term and it can mean different things to different people across an organization. One of the best frameworks used for enterprise security is the IBM Security framework, an architectural framework that deals with security and security issues of any organization. The IBM security framework simply break downs organizations security into different pillars such as People, Data, Application and Infrastructure.

In today’s business environment, security controls are implemented using different products in each of these pillars. Let’s take an example of the "People" pillar. The People pillar of the IBM security framework offers security in context of identities and accounts for an organization; and this is fulfilled using Identity and Access Management (IAM) solutions, which can be implemented using Identity Manager, Access Manager and Enterprise Single Sign-On products. The fact is - all these products are good at what they supposed to do individually, but these need to be constantly review to measure their effectiveness. To fulfill this gap, on security intelligence side, solutions like Security Information and Event Management (SIEM) can connect to each and every component of the environment and because of this, SIEM can better understand the security posture of the complete environment and the solutions are as good as a Big Boss of any IT environment.

Prolifics' Identity Intelligence solution is a tight integration of IAM and SIEM domain. When I say a tight integration, that does not simply mean collecting events from IAM environments. Identity Intelligence is about adding value to existing controls for intelligent security controls such as tracking and reporting misuse of access rights.

Prolifics has been a leader in leveraging IBM Security Software to deliver comprehensive Identity and Access Management solutions, and now Prolifics' new innovative Identity Intelligence solution using the IBM QRadar product family helps organizations more intelligently manage risks.

The Prolifics security team will be showcasing our Identity Intelligence solution at Gartner Identity & Access Management (IAM) Summit 2013. If you are attending the conference, be sure to visit us at booth # 411.

Interested in learning more about Prolifics' Identity Intelligence and other security solutions?
Visit Prolifics' website at: www.prolifics.com
Connect with Nilesh Patel: npatel@prolifics.com
Learn more about Prolifics at Gartner IAM Summit

Nilesh Patel is a Security Solution Architect with Prolifics and he is a preeminent identity and access management and security intelligence expert. Nilesh is a certified solution advisor for IBM security and compliance management solutions and he is an accredited IBM Redbooks® Master Author. Prior to Prolifics, Nilesh worked with IBM as Senior Identity and Access Management and Security Intelligence Professional.

Strategy for Security: A Pure Bargaining Model

The Stalemate
Strategy development can be thought of as a form of bargaining in my opinion, where security and audit, each with a stake in the successful implementation of the strategy, arrive at the table with specific agenda, putting forth and withdrawing arguments, driven by expectations of what the applications, infrastructure and support teams will accept or reject, and depart the table with an agreement that satisfies fewer goals than what they hoped to achieve to begin with.

Formulation of a roadmap for enterprise security is not concerned with the efficient application of forces like power and influence, as much as with the exploitation of potential synergies coming from the combined gain at stake for all involved. It is concerned with the possibility that particular architecture-driven operational outcomes are better (not worse) for all parties involved.

‘Pure’ Bargaining
Achieving consensus on a strategic roadmap for enterprise security can be modeled as a form of pure bargaining- a term used to describe bargaining in which each party is guided mainly by his expectations of what the other will accept. With each party guided by expectations and knowing very well that the others are guided by expectations too, these very expectations begin compounding achieving an effect that leaves only one exit path, someone making a final and sufficient concession to resolve the deadlock.

This result is quite contrary to the fact that actually, there is a range of possible architectures of which any single one is acceptable to all parties than no agreement at all. To insist on any one of the agreeable alternatives is a form of pure bargaining, since either party would take less than their dream solution than nothing at all because that would only cost money, and it leaves the firm no better off than what it started with. Either party would take 'less' also because it knows that 'receding' to reach agreement is also an option at any point in the process, since there is no reprimand for agreeing after disagreeing!

The underlying tactical approach is especially suited to Security because the essence of pure bargaining tactics employed is the voluntary and irreversible sacrifice of a position of strength in order to reach a point of advantage, even though the advantage is somewhat diluted. It is the paradox that the power to limit the adversarial parties stems from an ability to confine oneself to a smaller range of choices- to give up some freedom of choice to gain leverage in a pure bargaining situation.

Quick Case Study:
Authentication Strategy Case in point is creating a strategy for achieving seamless authentication across the enterprise. The applications architect might not want a reverse proxy solution for an authentication gateway because he already owns a farm of proxy servers that service web requests for his applications. He prefers an approach that augments the existing technology instead of stacking another farm of reverse proxies in front! The security architect advocates the use of a virtualized object space that a reverse proxy enables you to create because it helps manage authorization in the long run. The audit manager cares more about the security perimeter than the specific technology stack within the perimeter. The infrastructure architect wants homogeneity in hardware across the technology stack to ensure his team has a manageable learning curve in order to support the solution. The helpdesk manager is worried about how users might be impacted no matter which alternative is picked as the authentication architecture.

In the scenario depicted above, the application architect is negotiating from a position of strength because he owns the applications, the infrastructure architect is also negotiating from a strong position because his stake is already in the ground- a certain type and model of hardware is powering the business applications! However, they don’t just get their way because the security architect has a point too. Creating a single reverse-proxy based gateway eliminates any instrumentation at the proxies the applications architect owns, and also provides a long run alternative to finer grained authorization should the business need it. The audit manager might appear to be neutral to the discussion, but knows that adding a reverse proxy widens the security perimeter and requires thorough security compliance certification of the reverse proxy servers. This is more work and more risk for an otherwise smoothly running operating firm!

Strategic Moves shrink the ZOPA
I would be remiss if I did not talk about how the perceived bargaining set for each of the participants changed at each bargaining step, and also how the parties who were in a position of strength changed their expectations in observation of how well others accepted or rejected their ‘shifting’ bottom-line or ‘reservation price’ demands. The zone of possible agreement (ZOPA) initially is very large as all parties in positions of strength seem to have inflated perceptions of their non-cooperative alternatives and won’t give in without a fight. Pure bargaining tells us that someone has to concede for the stalemate to be resolved in the favor of achieving a ‘surplus’ outcome- one that results in all parties gaining something by participating in the process. At each bargaining step the zone of possible agreement shrinks as the weaker participant, the security architect evaluates the expectations of the stronger parties, navigates the terrain, uses his expertize to model impact to business, to user and to long run utility of choosing between the different alternatives to not only improve his alternative but also to worsen the other side’s alternatives at the same time.

The Concession
Experience reveals that the application and infrastructure architects have to let go, albeit selectively, of their biases towards pure proxy and homogenous hardware to accommodate the setting up of a reverse proxy as best response for a segment of applications duly benefiting from one, and an alternative solution like a plugin for proxy servers that is a best-response to another segment of applications. The audit manager has no choice but to add to his inventory of tasks the ‘seal-and-certify’ of all new components to avoid triggering an end-of-year audit. The helpdesk manager also will duly ask for process flow and user impact analysis from all parties concerned. Examples illustrating pure bargaining tactics abound in security strategy formulation.

To learn more about Prolifics, visit www.prolifics.com.

Javed Shah is a Practice Director for Security at Prolifics with more than 12 years experience in identity and access management architectures. He has broad exposure developing identity and access management solutions, and system software components that deliver reliable data security, web enablement and user lifecycle management services to customers. Before joining Prolifics, Javed founded and ran a professional services company in India for 6 years. Spanning over a decade, Javed has led identity management projects to successful exits at Nestle, University of California San Francisco, Kaiser Permanente, ABM Industries, BRE Properties, UPS, Tampa General Hospital and E*TRADE Bank. He was also the leader of the ITIM Level 3 defect resolution and analysis team in India where he was responsible for handling all customer defects for North America and Asia. Javed holds a Bachelor’s degree in Computer Science, a Certificate in Implementing and Managing an Enterprise Architecture using the Zachman Framework and the CISSP certification. He is also currently pursuing an MBA from the Haas School of Business, University of California Berkeley.

Project Showcase - Prolifics Delivers IBM WebSphere DataPower Solution to Office Supplies Company

At IBM Impact, Prolifics co-hosted a session with our customer that showcased a recent IBM WebSphere DataPower solution. Learn more about how our experts were able to help our customer improve security and achieve full Payment Card Industry (PCI) compliance.

Prolifics' customer has been serving business customers for over 20 years, offering everything from office supplies to technology products to furniture and more. Dedicated to improving customer experiences, the Company embarked on a growth strategy in 2012 aimed at uniting the Web and brick and mortar stores through a corporate revamp. In order to keep personal information secure, company leaders also looked to improve security and policy enforcement for their website as a critical component of supporting this new strategy. Further, the Company was driven to comply with the Payment Card Industry (PCI) Data Security Standard (DSS). With this in mind, the Company began to explore WebSphere DataPower to address their security concerns. Business and IT leaders were confident that DataPower would enable better, faster security and a higher level of compliance for their website. Seeking the expertise of a trusted partner, the Company engaged Prolifics to implement the solution, demonstrating DataPower's ability to help the meet compliance regulations far more quickly and efficiently than before. The appliance now offers front line defense for inbound and outbound internet traffic by acting as a Web facing application firewall and isolates information for further security.

To learn more about Prolifics' DataPower solutions, email solutions@prolifics.com or visit www.prolifics.com.

Focus on IBM Security: IBM Security Policy Manager and IBM Security Access Manager for e-Business

Many customers have asked me "Why do I need an additional Authorization product when I have IBM Security Access Manager for e-Business?"

I recently attended a discussion focused on IBM Security Policy Manager (SPM) and IBM Security Access Manager for e-Business (SAMeb). IBM Security Policy Manager can be used in the following ways:

1. Fine-Grained Authorization Control as opposed to coarse grained SAMeB group to J2EE Role Mapping (Sample: Policy to restrict a money transfer that exceeds $500 in a single transaction)
2. Authorize and Audit Communications between application modules. (When Modules are independent and belong to different organizations/Access External Interfaces)
3. Can have Multiple Policies on a service, each with multiple roles
4. Centralized Policy management for Web Services
5. Data Power could be used as a Web Service proxy and TSPM as the Policy Decision Point
6. By Default all web services are denied
7. Policies can be attached to Web Service/Port/Operation/Message

Here is a side by side comparison:

Next week, Prolifics will be at IBM Pulse in Las Vegas, a leading security intelligence conference. If you would like to learn more about Prolifics' Security solutions, visit booth #E525 and visit our IBM Pulse Page.

For more information about Prolifics, please visit www.prolifics.com or email solutions@prolifics.com.

Rama Yenumula is a Senior Consultant in the Security practice at Prolifics.

The Congruence Model for Security

From management literature (Tushman & O'Reilly), the congruence-based problem solving is a method to quickly and accurately identify the root cause of performance or opportunity gaps. In the context of security architecture, the congruence model can be applied to creating comprehensive security assessments for an organization. The model emphasizes analysis of the relationships among four core components of an organization (shown in the graphic below) also called the building blocks whose alignment relationships are the focus of congruent security architecture techniques. The goal is to leverage the relationships and interactions between those core components to reveal the underlying security posture of an organization.

Each congruence relation is important in forming organizational diagnoses that help us understand the current state of security in the enterprise, and the causes of the vulnerabilities. Analyzing these relations tends to define the political map and how the players tend to navigate it. It helps identify organizational behaviors that are helpful, neutral or detrimental to the security architecture initiative.

Analyzing the following three alignments using an appropriate "congruence questionnaire" is crucial to determining the security posture of the enterprise.

The Task and People Congruence Relation:

1. Do people have the required competencies to perform the critical tasks that ensure safety of data and process?
2. To what extent do the skills, abilities and motives of today’s human resources fit with security planning, architecture formulation and implementation requirements?

Identification goals: task-human resource inconsistencies that inhibit the ability to execute on security strategy.

The Task and Formal Organization Relation:

1. Do the formal linking mechanisms between units facilitate security task integration, security team building and agility from a product delivery perspective?
2. Is there a company wide vision for security and a strategy for addressing regulations, audit and security breaches?

Identification goals: task-structure inconsistencies that inhibit necessary integration among SBUs, needed to deliver a comprehensive security solution.

The Task and Culture Relation:

1. Does the existing culture energize the accomplishment of critical tasks?
2. Does the informal communication network and informal distribution of power help get the work done?
3. Is there a reluctance to take action? Is there reliance on being told what to do? Identification goals: culture-task inconsistencies that drag performance down and inhibit consensus on security goals.

This due-diligence analysis can help identify the need for managers and their teams to realign the formal structures, people processes and cultural aspects of their organization with the critical tasks necessary to achieve the overall security vision. Managers and their teams should learn from this process, and even re-initiate the process iteratively within their own SBUs if necessary.

Next month, I will be attending IBM Pulse 2013 in Las Vegas, the industry-leading conference on Security Intelligence. Prolifics will exhibit in the solution showcase and host a number of sessions throughout the conference. To learn more about Prolifics' presence at IBM Pulse, visit: www.prolifics.com/pulse-2013.htm. If you would like to connect with me before the conference, please click here.

Javed Shah is a Practice Director for Security at Prolifics with more than 12 years experience in identity and access management architectures. He has broad exposure developing identity and access management solutions, and system software components that deliver reliable data security, web enablement and user lifecycle management services to customers. Before joining Prolifics, Javed founded and ran a professional services company in India for 6 years. Spanning over a decade, Javed has led identity management projects to successful exits at Nestle, University of California San Francisco, Kaiser Permanente, ABM Industries, BRE Properties, UPS, Tampa General Hospital and E*TRADE Bank. He was also the leader of the ITIM Level 3 defect resolution and analysis team in India where he was responsible for handling all customer defects for North America and Asia. Javed holds a Bachelor’s degree in Computer Science, a Certificate in Implementing and Managing an Enterprise Architecture using the Zachman Framework and the CISSP certification. He is also currently pursuing an MBA from the Haas School of Business, University of California Berkeley.

IBM Security Portfolio

Ever wanted a quick, no nonsense explanation of what IBM security products are and where they came from? Well, here it is:

• ISS – network and host security (X-Force acquisition)
• TIM – identity management (access360 acquisition)
• TAMesso – desktop single sign on (Encentuate acquisition)
• TFIM – federation of access (homegrown)
• TDI – data transformation (Metamerge acquisition)
• TAMeb – web app access control (Dascom acquisition)
• TSIEM – security event management (Q1 Lab acquisition)
• TCIM – compliance dashboard (Consul Risk Management acquisition)
• DataPower – XML gateway
• i2 – crime prevention
• BigFix – patch management
• Guardium – database security
• Openpages – governance risk and compliance
• Algorithmics – financial risk management

Alex Ivkin is a senior IT Security Architect with a focus in Identity and Access Management at Prolifics. Mr. Ivkin has worked with executive stakeholders in large and small organizations to help drive security initiatives. He has helped companies succeed in attaining regulatory compliance, improving business operations and securing enterprise infrastructure. Mr. Ivkin has achieved the highest levels of certification with several major Identity Management vendors and holds the CISSP designation. He is also a speaker at various conferences and an active member of several user communities.

Cyber Security in High Demand

The old adage says: "keep your friends close, but your enemies closer". In this day and age, the IT department of your organization does not have to worry about the second part. The enemies are already at the gates. And keeping them out is an increasingly challenging task.

A recent study sponsored by Juniper Networks showed that not only there has been a dramatic rise in the number of security breaches in the past year, but the targets have also gotten bigger. The CIA, the FBI, the U.S. Senate, and various state police agencies had their systems under attack. In the first half of 2011 security and data breaches have cost U.S. enterprises almost $96 billion. At this rate the cost for the whole 2011 will be almost twice as much as it was in all of 2010. Consider the fact that 2010 saw 90% of businesses compromised with least one security breach. More than 50% of the compromised businesses had at least two breaches.

Another problem is that "the gates", where the enemies are trying to get through, are everywhere now. The entry points are in the software used by employees. They are in files, emails, web apps, web sites, databases, in everything that is on the information highway. The number of incidents related to malware went up from 4 million in the first quarter of 2010 to 6 million in the first quarter of 2011. It is expected that last year's record $63 billion that companies spent on security will be $75.6 billion in 2011.

As the study showed, the enemies get smarter and the attacks get more complicated in every year. Throw all your defenses up, get every firewall ready, the host and network intrusion protection and detection system, anti-virus, anti-malware, application firewalls and it will still be not enough, because the enemies are a step ahead. The solution? "Know yourself and know your enemy" (Sun Zhu, "Art of War"). Get the right security talent on board and use the right strategy.

The correct strategy, rooted in the governance, risk management and compliance methodology can go a long way. Consider the governance, a system by which an organization controls and directs security development, as a backbone of the approach to managing security and how it relates to the business (http://www.cert.org/governance/ges.html). Then, focus on the compliance and regulations, a key to proactive defenses and enforced regulations of a company's behavior as it pertains to security for a specific nature of the business. Governance is strategic, while compliance is tactical and specific. Addressing compliance and security regulations allows business to focus on particular challenges and vulnerabilities specific to the business type and the vertical it operates in. Finally, adjust risk management, a set of technologies that address day-to-day security work, and include mature components of security such as penetration testing, application security analysis, firewalls and intrusion prevention systems. The success of the security strategy depends on the attention to all three components.

The talent is a different thing. With the increase in the demand for the security experts, in response to the increased attacks, the security talent is becoming more expensive and harder to find. So far, the number of college students with who focus on cyber-security has not been keeping up with the demand. There are even less opportunities in finding experienced security consultants who are up to par with the criminal masterminds of the security underground. Security may be on the radar for around 1.9 million people, but there are only around 346,000 fully dedicated security professionals.

There are, however, security consulting firms, like Prolifics Security Practice (http://www.prolifics.com/business-solutions-security.htm) that can help you both with the talent and the strategy. They bring the best and the brightest security personnel on site to analyze, architect, develop and implement proper defenses and policies to address modern security threats. They help set up proper strategy, so you protect the flanks, tie up the loose ends and govern smartly.

With the increasing number and the caliber of the security breaches you cannot afford to sit around and wait. Find what others are doing, go to conferences, ask consultants, bring help, but do something, because enemies are at the gate.

If you want to read more on the recent rise of the cyber attacks look here: http://articles.latimes.com/2011/jul/05/business/la-fi-hacking-security-20110705

Prolifics will be discussing cyber security in greater depth as a sponsor and speaker at the upcoming Cyber Security for Energy Delivery Conference on September 27-28. The event takes place in San Jose, CA and brings together major utility and asset owners and key government agencies from across North America. I will be co-speaking with IBM at this conference. With experience providing security solutions for the energy and utilities industry, we will be sharing our security solutions and recent case studies around ID and password management, single sign-on, directory services, Web-based authorization, federation and other areas. For more information on the Cyber Security for Energy Delivery conference, please click here.

Alex Ivkin is a senior IT Security Architect with a focus in Identity and Access Management at Prolifics. Mr. Ivkin has worked with executive stakeholders in large and small organizations to help drive security initiatives. He has helped companies succeed in attaining regulatory compliance, improving business operations and securing enterprise infrastructure. Mr. Ivkin has achieved the highest levels of certification with several major Identity Management vendors and holds the CISSP designation. He is also a speaker at various conferences and an active member of several user communities.