IBM Pulse Session Recap: Prolifics Identity Intelligence: Threat-Aware Identity and Access Management

At IBM Pulse 2014, Russell Tait was selected to speak on a panel with other security experts to highlight Prolifics' Identity Intelligence solution.

During this session, Russell shared how integration with key areas of the IBM Security portfolio can increase solution value for customers. The panel discussion covered strong authentication, mobile, cloud, and security intelligence use cases.

View the session presentation below!

Identity intelligence: Threat-aware Identity and Access Management from Prolifics

Identity is the New Perimeter
Prolifics’ Identity Intelligence solution with IBM QRadar delivers a comprehensive solution with actionable insights and has been recognized by IBM with the Ready for Security mark. This solution is uniquely positioned to extend the integration of traditional Security Information and Event Management (SIEM) to identity systems to more intelligently manage security risks from user activity in real time and provide continuous control of insider threats through identity analytics.

To learn more about Prolifics' Identity Intelligence solution, view our solution brochure.

Want to connect with Russell?
Russell Tait on LinkedIn
Russell.Tait@prolifics.com

For more information about Prolifics, visit www.prolifics.com.

A Closer Look at Outsourcing Contracts: Common Challenges and Proposed Solutions

Software engagements can often be met with many challenges and problems. These challenges can arise during outsourcing, advanced technology and services, application deployment and maintenance, software development, business services, IT disputes, cloud computing and more. In this article I would like to share some of the typical challenges surrounding outsourcing contracts and make a case for learning from these challenges so that they can be avoided in the future.

Taking the Initiative on Provisions to Solve Outsourcing Contract Problems
Outsourcing suppliers frequently face issues that can cause significant damage but are not grave enough to virtue using contractual preparations, which are typically confined to termination of the contract or even in some cases customer claims the damage.

The traditional contractual preparations fail to take into account how reliant a business is on their contractors. Simply ending an association could be incapacitating – the businesses require an alternative way of addressing glitches.

Taking the initiative on provision also known as “Proactive Preparations” is one possible solution for this challenge in an organization. This solution drives a framework in habitation that establishes a comprehensive assortment of events or conditions that could cause problems, and provides a structure for managing the risks involved in business by using various tools other than contractual remedies such as termination or damages. It also identifies that problems can occur that are not the fault of both the parties, and that these problems still have to be resolved.

Not only are traditional remedy arrangements of small practical use in many situations, they also lean towards to be reactive rather than proactive – the client has to wait until it can establish that there has been a contractor default before it is able to trigger what groundwork are available within the agreement or the contract.

By difference, proactive preparations are designed to avoid key business and also prevent service risks from becoming realities. The preparations are designed to focus the parties' minds on good contract and risk management before things go horribly wrong.

Such issues can likely affect the client's business or the outsourcing relationship between supplier and client - a corruption scandal affecting a key sub-contractor; an important profit warning; a large scale severance program. Each party consequently gains benefit from an intensified level of attentiveness and preemptive or proactive management by both client and service provider.

Proactive Preparation is “Good Governance”
Contracts, however, sometimes pay lip service to governance and contain little more than a list of governance bodies, terms of reference and meeting schedules. Everybody agrees that robust and strong contract management, which is generally known as Service Level Agreement or governance, is censoriously vital to the successful delivery of the outsourced services and to the health of an outsourcing service association. It is all too common for the parties, over time, to if the essentials of good contract governance are disregarded, the unavoidable result is that poor performance goes unaddressed and real business risks, perhaps unrelated to outsourcing service provider performance, are not anticipated and managed.  With all good proactive preparations mechanism, the parties will have a pre-agreed process for keeping an eye on the issues that substance furthermost to the business.

How does the “Proactive Preparation” Work in an Organization?
We can define the proactive preparations in such a way so that the external risks can be controlled by both parties before they become problems for the organization. At the same time, we can also have a structure that addresses minor loopholes, predominantly where it is convenient to overlook a circumstance which can ultimately impact on the association or relationship in a significant way if it is not addressed.

How to Organize Proactive Remedies
To be useful, proactive preparations must be tailored to the customer's business - they should be industry and context specific. Proactive preparations are usually drafted collectively as a schedule to the contract or can be built into the contract governance or like the performance management system / regime.  To ensure the regime leftovers relevant to the client's business, at that point there should be a mechanism for review and updating on a regular basis.

The contract should set out the following:

Elicit Events
Thinking about which risk procedures to pay attention to, clients often ask: In addition to service breaches, what events would significantly impact on our business? For example, consider negative media that impacts reputation.

Risk Levels
We must set the proactive remedy in proportion to the level of risk the trigger event exposes the customer. The preparations to address particular risks when they are still at a relatively low level may be as simple as enhanced monitoring or an investigatory report, perhaps at the customer's cost. If those risks escalate, however, the risk level may increase to the next level. The contract should identify the circumstances that will constitute the different risk levels for the purposes of the regime.

Preparation Points
The preparations that apply in a proactive preparations regime should be tailored so that they are effective to address the risks that are identified by the parties. They may include:

• The supplier provides requirements as a detailed information and/or plans about the trigger event
• Allow client to choose an independent third party consultant to audit the supplier's business in relation to the event if they wish
• The initialization of an additional benefit scheme in lieu of named members of the supplier's workforce to incentivize swift resolution of the situation
• High level risks related to service delivery that have not been addressed and the necessary termination or step-in rights for the customer.

Proactive preparations can help the customers and the suppliers focus on risk management as part of the contract governance regime and allow them to address the general concern that contracts focus on mechanistic and legalistic preparations. They are tools which supplement traditional contractual preparations rather than replacing them and can be useful in highlighting issues that could impact on a customer's business beyond service breaches.

For more information about Prolifics, visit www.prolifics.com

Dhanraj Dadhich is Technical Architect at Prolifics. He has 14+ years of experience in design and development of applications and has designed various Banking, Security, Social Media, Mortgage and Payment Gateway applications. With Prolifics, he is promoting the use of technology, and of specific products, to help enterprise management and IT communities meet their business needs. He specializes in selecting, defining and enforcing a consistent, uniform set of products, vendors, methodologies and standards throughout the IT organization. His current role has given him the opportunity to develop creative ideas to realize significant cost and head count savings whilst still maintaining good service levels to build on this experience.

Extend ISIM’s Visibility to Unstructured Data with StealthBits

In this age of Access Governance, organizations need to know who owns the data, who has access to it and how they were granted that access. IBM Security Identity Manager (ISIM) effectively provides visibility into access, policy, role management and it also facilitates periodic entitlement reviews of access across numerous systems. However when it comes to provisioning and management of access, a critical link between the access management platform and the unstructured data on managed resources is missing. Traditionally, ISIM can reconcile Group data (i.e. structured data) from access management platforms like Active Directory and open the way for effective Role Discovery and Role Based Access Control (RBAC). However it is unable to extend the same capabilities into the unstructured data components primarily because it lacks the ability to explore what access has been granted to the Users and the Groups as the data is too difficult or distributed to understand.

Unstructured data refers to disorganized information that does not have a data structure (i.e. exist within a database). Examples of “unstructured data” may include documents, presentations, spreadsheets, scanned images, multimedia files stored in file repositories like regular file systems or an advanced collaborative tool like SharePoint. This type of data is critical to every business as users frequently collaborate on such files that often contain sensitive information. It is critical for the organizations to ensure that the users have access to correct data and any unnecessary accesses are revoked.

This visibility gap is effectively fulfilled by StealthBits' StealthAUDIT Management Platform (SMP). StealthBits has the capability to crawl across an organization’s environment discovering unstructured data and dump a single, consolidated entitlement catalogue containing key information such as:

• Who owns the unstructured data
• Who has access to this unstructured data items – Users and/or Groups.
• How access has been granted – Is it through a Group?

Not only does this StealthBits product discover unstructured data, it also pushes this discovered data to ISIM through its Data and Access Governance connector. With this direct integration of StealthBits with ISIM, organizations can now

• Control provisioning and revocation of access to unstructured data from ISIM and 
• Accelerate the effort to map all these unstructured data items to ISIM. 

This is how organizations can leverage their existing ISIM investment with StealthBits to manage access control on unstructured data:

1. StealthBits' StealthAUDIT Management Platform discovers unstructured data in an environment and creates a consolidated view of entitlements. SMP also determines the AD Groups that have access to these unstructured data items.
2. Items discovered by SMP can be selectively published to ISIM.
3. After the publish activity is complete, “Access” on the AD Groups that entitle access to these items is automatically enabled by the publish workflow.

4. SMP helps identify an owner for the access.

5. Once these accesses have been defined, organizations can implement the Request Based Access Control model for the unstructured data items leveraging the existing advanced workflow processes for user self-service requests of access to organizational resources.

At IBM Pulse this week, Prolifics is showcasing this security solution and other solutions that help organizations around the world manage risk and compliance. Our experts will also be sharing recent client success stories in the solution showcase and across several conference sessions.

Learn more about our presence at Pulse and download session replays by visiting our conference page.

Nikhil Firke is a Security Solution Architect with Prolifics. He has an extensive background in design and implementation of Identity and Access Management solution for organizations around the world. Nikhil is a Certified Information Systems Security Professional (CISSP) and a certified solution advisor for IBM security and compliance management solutions.

The Future of Healthcare: A Roadmap to Overcoming IT Challenges in a Changing Regulatory Landscape

Executive Summary:
Business organizations in a variety of industries face hardships and pain points when faced with a change. It’s especially hard when it’s a forced change through government regulations. The Affordable Care Act (ACA) presents one such challenge to organizations in the healthcare sector. This blog entry sheds light on some of the key challenges faced by healthcare payers while trying to conform to the ACA regulations and a few effective ways of dealing with them.

Affordable Care Act (ACA) - The ACA or the healthcare reform act introduces a few regulations that impact the healthcare providers (health insurers) such as:

• Ability to accept group and individual enrollment information from a state or a federal insurance exchange website (without the insurers having the authority to reject any of these groups or individuals)
• Cap on the percentage of premium amount that can be spent on advertising and administrative tasks
• Expanded Medicaid eligibility – more consumers (up to 133% of poverty level) eligible for Medicaid
• Reduced deductibility caps and new tax on healthcare payers depending on their market share

Challenges to Healthcare Payers - These regulations present quite a few challenges to the healthcare payers:

• Need to define health plans for the state or federal exchange that can reduce costs to an optimum level, since the payers can no longer pre-screen the enrollees
• Need to reduce turnaround time for setting up customer accounts
• Ability to deal with increased volume of individual and small business customers
• Keep their product networks flexible to deal with competition and sudden increase in costs
• Continuously update their business rules related to enrollment, benefits packing, provider contracts, provider networks, provider demographics, reimbursement

Pain Points in Facing These Challenges - Clients face significant pain points in facing these challenges:

• A combination of manual and system processes that present a lack of visibility & control
• Legacy systems that are not flexible to adopt to the new changes
• Many business rules that are currently enforced manually or distributed across multiple systems
• Lack of coordination among the different functions within an enterprise

Impact of Failure to Deal with Challenges - If the healthcare payers fail in their attempt to effectively deal with these challenges they could face a few consequences:

• Loss of market share due to long turnaround time for insurance and contract enrollment
• Loss of revenue due to cost ineffective networks
• Government fines imposed due to failure to meet the regulations

Effectively Dealing with Challenges – The healthcare payers can follow a few steps proactively to be better prepared to deal with current as well as future regulatory changes:

• Identify process owners, map their current end-to-end processes across the enterprise, clearly map functional hand offs within processes, collect Key Performance Metrics (KPI), defineroles and responsibilities
• Harvest existing business rules that are manually enforced and those that are embedded across systems
• Analyze current state processes to identify - redundant activities, scope for automation, patterns across process and consolidate them into a single process
• Create future state processes that are optimized by consolidating roles, eliminating bottlenecks
• Establish clear expectations on the process hand off between functional units across enterprise
• Identify and implement technology such as IBM BPM (Business Process Manager) to automate “non-value” adding manual activities, integrate source systems with process via web services, manage the workflows and gain visibility into the process (e.g.: Supervisor having the ability to view the status of workflow tasks assigned to their team)
• Consolidate and centralize business rules into a single system by utilizing a technology such as IBM ODM (Operational Decision Management) and automate the interaction between BPM enabled process and ODM business rules
• Empower the business users to directly maintain business rules in ODM and hence reducing the downtime due to IT maintenance
• Introduce data analytics software such as IBM Cognos to collect customer impacting data such as claims settlement time, customer issue resolution, time to market for new plans etc., and measure the ROI from process improvements in terms of data 
• Continuously monitor the process metrics and update the automated process. A BPM and ODM enabled business process provides the flexibility needed to continuously deal with changes

Conclusion:

By proactively adopting an automated process and rules driven approach, Healthcare payers can build flexibility into their business critical processes. Achieving visibility and control of their processes will provide them the ability to deal with the pain points resulting from change effectively.

N.R. Vijay is a Solution Architect in the Business Process Management division of Prolifics. He has over 10 years of consulting experience across domains such as Retail, Healthcare and Banking. Specializing in technology, management concepts and enterprise strategy, he is focused on change management and process improvement initiatives. He co-authored a whitepaper titled "Improving Customer Loyalty through Business Process Optimization and Advanced Business Analytics" - http://www.prolifics.com/customer-loyalty-bpm-analytics.htm.

Is SOA Working for your Company?

When SOA became popular in the early 2000s, companies had very high hopes that it would solve many of their integration problems and would deliver a huge ROI given its benefits, which include loose coupling, reusability, greater business agility, lower time to deployment, and more. But after so many years and spending millions of dollars, many companies are yet to fully realize the advertised benefits from the SOA initiatives. In this article, let us take a look at few of the key problems that affected the success of SOA.

1. Lack of Experience/Support in Implementing SOA
The single biggest challenge against the success of SOA, in most cases, is simply the fact that companies still do not have the skillset or experience to take the SOA from vision to a successful implementation. Numerous factors, such as depending on project-based funding for building enterprise services, time and budget constraints, poor planning, lack of focus on data architecture and poorly implemented services, all result in a sub-optimal implementation of SOA.

The right experience/skillset are required across Business, PMO, Architecture, Infrastructure and Development teams for a successful SOA implementation.  Everyone should realize that SOA is not about building a bunch of services. The discipline, support and investment required to build a successful SOA requires a consolidated effort across the various teams.

2. Lack of Service Governance
Many times, companies fail to invest in building a centralized service governance system for managing the services. Service governance is highly essential for enforcing runtime aspects of the services like verifying SLAs, policies, managing endpoints etc and management aspects like cataloging services, tracking services from vision to implementation to sunset, maintaining versions etc. Without an effective service governance system in place, the quality of the services takes a hit. There can also be other problems like lack of visibility of the currently available services, duplication of efforts, services not being flexible enough for client application needs, etc.

This shows that it is extremely important to invest in service governance tools and methodologies as much as in building the services itself.

3. Misunderstanding on Investment Needed for SOA to Make it Successful
There is a prevailing misconception among the senior management that investing in SOA equals investing in a good product for building services. Although investing in a good product is highly essential, expecting the product alone to deliver the benefits cannot be further from the truth. Building a successful SOA involves significant investments in effort and money. In fact, success of SOA has almost as much to do with executive support as much as to do with building the services itself. Sometimes, it takes years to start seeing the real benefits of investing in SOA. Therefore, it is imperative that management understand these realities and stand behind this initiative to make it a success.

A realistic understanding on the effort and cost for implementing SOA can help companies come up with an effective action plan for implementing a successful SOA initiative.

4. Adoption Across Business Units (BU)
It is very common to see business units within the same company acting in silos for its IT needs.  Even though many of the companies keep a dedicated SOA team across the BUs, the services that they end up building become focused on the BU needs and cannot be readily consumed across the enterprise. This hinders service reuse. Project timelines, differences in service contract expectations (too much data / less data / performance considerations, etc), challenges with extending a current service vs ease of building a new service, lack of understanding of the enterprise needs, etc. all contribute to this challenge.

Benefits of SOA can truly be recognized only when synergies across LOBs are fully realized. This has real world challenges and it is extremely important to overcome these challenges to make SOA successful.

5. Challenges with Service Versioning
On the other side of SOA adoption problems, we also have to deal with challenges in enabling services for reuse by multiple client applications.  When an existing service is considered for reuse, minor differences in expectations are to be expected from the new client application. The required enhancements can get tricky to implement at times without impacting the existing client applications. Schema changes, logic changes, security implementations, etc. are some of the more common changes required in the services to cater to a new client application.

Service interface definition and versioning strategy should be carefully approached for effective service reuse.

6. Architecture Complexity
Integrating a complex IT landscape is no easy task. Coupled with fragmented IT approaches (differences in standards, data models, systems, protocols, etc.) across the company, the challenge becomes very daunting to provide the seamless experience expected from SOA. SOA is far from a plug-and-play approach that many people tend to believe it is.

Creating an SOA Reference Architecture and religiously following it is extremely important to get the best out of SOA.

7. Product Complexity
Lastly, we will also need to take into account the complexity introduced by the products used in implementing SOA. These products tend to be pretty complex since they try to abstract complex integration scenarios from the developer. But still, there will be times where it seems like these products fail to deliver. These instances might make it look like the product is not working for the company while the root cause can be the difference in expectations and an inherently complex IT system.

An in-depth understanding of the product's configuration options, standards support, monitoring support, integration options with other systems, product roadmap, etc. can reduce many of the challenges in implementing SOA.

References:
http://apsblog.burtongroup.com/2009/01/soa-is-dead-long-live-services.html
http://www.cio.com/article/438413/Top_10_Reasons_Why_People_are_Making_SOA_Fail?page=1&taxonomyId=3016

For more information about Prolifics' SOA solutions and recent customer implementations, visit www.prolifics.com.

Emil Thomas is a Technology Manager at Prolifics with more than 12 years of experience in various top tier consulting companies.  He specializes in SOA and BPM related concepts and technologies. He is an expert in providing guidance and implementing end-to-end solutions for clients.  He has worked in a variety of verticals like Travel & Leisure, Health Care, Health and Life insurance, Retail, Energy and Power, Banking, Finance etc.  He has presented at various forums including IBM Impact.  He holds a Bachelor’s Degree in Mechanical Engineering from Calicut University, India.

The Human Element of Technology Implementation Management: An IBM Datacap Use Case

A successful demonstration of IBM® Datacap Taskmaster’s latest and greatest capture technology concludes with a roar bursting from a conference room.  Hands shake, business cards fly and “we’ll meet soon” are offered and accepted with euphoric optimism.  A solution is here and it’s time to get busy.

Six months later, the customer’s favorite topics now include inconsistencies to what was demonstrated versus actual testing results.  Where did this come from?  Sound familiar? While the laundry list of possible causes is beyond the capacity of one blog and most certainly one's patience. In dealing with technology, I’d like to offer a common source to our legitimate frustrations: being human.

Flashing back to the demo and the blockbusting slide of the presentation deck exclaiming, “IBM® Datacap Taskmaster full text OCR capability can eliminate manual data entry and streamline your data capture processing!”  Did everyone during the demo receive the same amazing revelation?

I doubt it.

A CEO would lean forward in excitement and imagine benefits this could have on the company’s strategic direction, small details are insignificant.  An IT team member would laser into just how this miracle of technology is possible and make a mental note to ask for proof later.  An operations manager or front-line associate may have concluded exactly how they will no longer be needed and begin to mentally rebuild their résumé.

We are human and will react emotionally to what excites or concerns us directly.  We will create gaps that don’t exist, ignore those that do, make erroneous assumptions, and create facts from fiction.  Our emotions will manifest themselves into poorly translated requirements, creativity or indifference, and paradigm shifts in which little if nothing seems right.

So what can we do?  Accept our nature and incorporate steps within our processes and customer interactions to acknowledge perceptions and attitude shifts.  Examples could include:
• Perform a detailed review of the demonstration to capture and clarify perceived benefits before defining requirements.
• Stop using “documentation block” as a shield and avoid the tone deaf, never ending banter of “you didn't ask for it” versus “you didn't tell us we needed it.”  Instead expect misunderstanding, talk about it and plan room for it.
• Focusing on small business group audiences to validate processes and measurements.
• Include enhancement phases into the project and set the expectation they will be needed.  First swings rarely yield homeruns.

“When dealing with people, remember you are not dealing with creatures of logic, but creatures of emotion”  - Dale Carnegie

Christopher Piskun is an award-winning senior consultant at Prolifics with progressive experience in directing complex operations, developing strategies, and leading high performance teams to advance key initiatives. Christopher’s 14 years’ experience, including ECM certification and BPM expertise, enables clients to increase efficiency, improve control of information, and reduce information management costs. He is adept at cultivating partnerships and building lasting relationships across global business sectors. He excels at driving results utilizing measurable, world-class planning, project management, and change control methodologies. Christopher possesses specialized knowledge in implementing business process improvements and quality, while leveraging his broad knowledge to consistently surpass business goals and improve operations.

Applying a Cumulative Fix: IBM WebSphere Portal 8

In this whitepaper, Omar Siliceo illustrates a generic method to apply IBM WebSphere Portal Cumulative Fixes. The installation of a cumulative fix is carried out in two major stages. During the first stage, the actual code for the Cumulative Fix is deployed on the Portal nodes and the master Portal Profile. Once the code is in place, the second stage can initiate. During the latter, each of the additional WebSphere Profiles is upgraded to the Cumulative Fix by using the ConfigEngine tool.

The whitepaper follows the following road map:
1. Access Reference Document
2. Cumulative Fix ID
3. Cumulative Fix System Requirements
4. Cumulative Fix Distribution Acquisition
5. Cumulative Fix Content Extraction
6. Cumulative Fix Pre-Installation Tasks
7. Cumulative Fix Installation

Applying a Cumulative Fix: IBM WebSphere Portal 8






For more information and to contact Prolifics, visit www.prolifics.com.

About the Author:

Omar Siliceo is a Senior Consultant in the User Experience practice at Prolifics. He is a professional Systems Engineer with a Master of Science degree in Electrical Engineering. Beginning his career over 20 years ago, he has focused on providing design, programming consultation, and problem solving to organizations around the world. He specializes in WebSphere Application Server, WebSphere Portal, and WebSphere Edge Components efforts and has worked with a notable list of clients, including Bank of America, Blue Cross Blue Shield of Florida, Macy’s and The World Bank Group. Omar is the author of the book “IBM WebSphere Application Server v7.0 Security”.