AUGUST - 2018ENTERPRISE SECURITY| | 9Managing who has access to resources is the foundation of any cybersecurity programwritten in any language, on any platform, using any database ­ if they are key to your business process ­ it's in scope. Yes including that cool hipster app on your iPhone and the not so cool one that runs on a VT100 terminal emulator with a green screen.3.Layers: The first time most people try to solve the I&AM problem they happily focus on the application. "Look all my application access is sorted! ­ all good, done and dusted". "Audit finding? What!? How!?" Oh yeah assurance is about access ­ not about the application layer access. In addition to who can access the App, we have to provide assurance on: Which support people can access the operating system on the server that the application runs on? Who has access to the database the app users to store its data?4. Dependency:In many cases Identity & Access depends on already established technologies, processes, inventories etc. ­ things like corporate directories, inventories of applications, people, servers etc. When you attempt to fix I&AM you uncover all that is broken (or nonexistent) in all the systems you depend on ­ this does not make you a very popular person. :)5.Complexity:once you figure out what resources you need to have assurance on, what downstream resources they rely on and what IT resources, information sources you need to be able to manage all this and you develop the best most elegant sci-fi like system ­ you still need to implement it! And most importantly keep it running day after day everyday and detect when any of this very complex system you designed fails to deliver. One day my dream will be real: "Alexa! who has access to the general ledger?"6.Cost: Money may not buy you happiness but it will buy you solutions and if you hire intelligent people (who are not cheap) then with time you will have assurance. Solving your I&AM problem will cost more money than you anticipate and more money even than your technology partners are brave enough to tell you it will cost. That in a very generic sense is the true nature of the I&AM problem. In this article, I have not dealt with the specifics and all the components that go into I&AM: AuthN, AuthZ, Cert, Privileged Access and all the other cool sexy stuff. I am very aware I have not suggested a solution ­ other than maybe spend lots of money and hire good people which is obvious. I will detail my approach to solving the problem in another article. I wanted to start with the problem statement ­ acceptance is the first step. Did I state the high level problem correctly? What did I miss? Do you disagree with the problem statement? Would love to hear from you. ES1.Legacy:If you have old applications that work just fine for your business needs and they were designed by your great grand uncle Esteban in 1962 in Fortran and he didn't worry about access management because it was just him and his cousin Eddie that ran the business. And you still use that app ­ and you deem it key to your business and it, say, touches your books and records ­ guess what? ­ you have to do access management on it. Think of all the mainframes and all the code running on those mainframes and all the datasets that the code has access to and how almost no one remembers why all the decisions along the way were made.2.Diversity: Business processes use applications
< Page 8 | Page 10 >