| | AUGUST - 2018ENTERPRISE SECURITY8The Problem with I&AM (Identity & Access Management)By Gehan Dabare, Director for Identity & Access, Bank of Tokyo-MitsubishiIt has ALWAYS been important to have a handle on who has access to what resources. If you don't know who has access and who is who - how can you prevent bad things from happening? Managing who has access to resources is the foundation of any cybersecurity program. In the post Enron world the need to provide assurance of the control became important. This need to evidence that your controls are in place that they are designed correctly and that they are executed well is the difference.Many companies realize they need to get a grip on I&AM when they get an audit finding or a significant deficiency in their SOX report. They actually begin to pay attention when there are a few repeat findings or when they see that I&AM is impacting the grades of quite a few audits. Maybe even a failed SSAE16 report (or two)--which can impact revenue. Or, in the worst case, god forbid when there is a security event where an external actor has gained access to company resources.Thousands of people are working on this problem and billions of dollars are spent every year on it. Everyone has the problem (even if they don't realize they do) and everyone thinks it's a tech problem to solve. Many companies start out thinking it's a problem that can be solved relatively easily using the same people that have solved technology problems before. Most companies realize this is not the case.Identity & Access is a business risk that technology has to help resolve. Think of a world where there were no computers, (yes Millennials that happened!) people still ran businesses everything from the corner store to multinational companies like the East India Company. People took precautions to safeguard the important resources of their business including the books and records of the firm. The business owned the risk and the business managed the risk. The introduction of computers has not changed anything, the business still owns the risk and needs to manage the risk ­ since most business people do not understand the complexities of the tools they use they need the help of technologists to help understand, resolve and manage the risk. That does not make I&AM a technology problem, it remains a business risk.The nature of the I&AM problem that makes people underestimate the scope and cost of getting to green are:IN MY OPINIONGehan Dabare
< Page 7 | Page 9 >