They also note that the need for (and recognition of the need for) identity and access management governance is growing – they estimate that IAG-led projects will double from one-third of all IAM projects, to two-thirds by 2013.

We’re happy to have been named a leader in this report, and are grateful to our customers — the reason for our success.

Unauthorized SharePoint access is a common security gap, in many organizations.  We’ve seen numerous customers struggling with this, unable to get their arms around who has access to which SharePoint site, and what types of data (classification, risk level, and content) are thus accessible.

While most organizations don’t need to worry about employee access to classified information, rogue access to confidential corporate information can nonetheless be damaging and expensive – as clearly demonstrated by the RSA and Sony incidents this year.

I’m sure there will be additional Information Security-related aspects of the ongoing Manning hearing, and we’ll continue to cover them here.

There’s been a tremendous amount of media coverage and protest around this, related to both Manning’s actions, as well as the government’s treatment of the accused.  Staying away from the political aspects of these,  we’ll be monitoring the Information Security aspects of the hearing.  Portions of the hearing will be open to journalists, while some will be closed to the public, due to security considerations.

The Guardian has a good overview, here , and their journalist @Edpilkington  is live tweeting the trial.

According to publicly released defense documents[1], the Army was not doing an at-all adequate job in securing the data resources on shared, secure systems  – one of the witnesses “will testify that the information assurance procedures were not being followed by the brigade” and that “the brigade did not have an Approval to Operate (ATO) or an Interim Approval to Operate (IATO) for their network. Additionally, the brigade did not receive a formal IA [Information Assurance] certification and accreditation inspection during its tour, contrary to the guidance in MNF-I Directives”[2].

Like many of the enterprises I speak with, this organization had both internal and external information security guidelines, and was not doing a good-enough job meeting them. Could an effective Access Governance solution have prevented these leaks from occurring?  This certainly appears to be the case, and we look forward to learning more next week, as the hearing begins.

[1] DEFENSE REQUEST FOR ARTICLE 32 WITNESSES http://www.wired.com/images_blogs/threatlevel/2011/12/Defense-Article-32-Witness-List.pdf
[2] ibid, page 9

But, in two scenarios, it does make sense to capture and use data just at an account level. The first situation is in a period of transition – where the organization may not yet have the infrastructure or capability to capture, normalize, process, and present detailed entitlements to reviewers (or to users requesting access).  This is a perfectly fine approach, and can be quite useful as a way to put in place business processes for review or access request, and to begin to familiarize end users with them – as long as there’s a concrete plan to ultimately move to reviewing and requesting at an entitlement level. These shouldn’t be left indefinitely at an account level – it simply doesn’t provide enough visibility or control, isn’t audit-proof, and will likely lead to a false sense of security.

The second scenario is when the information about an account’s existence is in fact sufficient for its designated purpose.  For example, one of our customers keeps track of which employees have accounts on their mainframe system. None of the applications on the mainframe are subject to entitlement reviews, so they don’t need to capture the entitlement details. Instead, they use the account information as part of their Leaver process – so that when a person departs the organization, IT has a clear view of whether or not a mainframe account needs to be deprovisioned, and can act accordingly. This is a simple, yet effective scenario, and a great example of the value of having an Access Management Database (XMDB) with complete information about identities and access, even beyond traditional focus of access governance systems

In general, of course, organizations need to capture and operationalize with a detailed view of user entitlements, in order to meet their access-related security and compliance goals.

Even though this turned out to be a simple mechanical failure, and not a cyber-attack, we must keep in mind that these SCADA systems have in fact been breached successfully (see my blog posting below), and must strengthen our security accordingly.

Fortunately these hackers did not cause any damage, but this certainly does raise the profile and the risk associated with such industrial control systems.  Please, take the time to make a baseline assessment of your infrastructure, and get clear visibility into whether you have these kinds of industrial control systems, and who has access to them.

Was this related to the alleged Illinois SCADA compromise? According to Information Age, the FBI speaker “would not clarify” whether it was related.  However, I believe that we need to take at face value yesterday’s assertion from the FBI and the US Department of Homeland Security that no intrusion  occurred in Illinois, at the Curran-Gardner Public Water District.

While this is a relief, it’s distressing to see, based on commentary and media coverage, how vulnerable these industrial control systems apparently are.  And, in a bitter irony, the coverage and attention raised by what turned out to be a media event (as opposed to an actual security event), will in fact raise the likelihood of future attacks on industrial control systems.

So, organizations with these kinds of control systems in place — please, do two things, immediately:

1. Read through the Department of Homeland Security document Recommended Practice: Improving Industrial Control Systems Cybersecurity with Defense-In-Depth Strategies
2. Evaluate and improve your access management systems, to ensure that you have an effective program enforcing the principle of least access.

[1] http://www.us-cert.gov/control_systems/pdf/ICSB-11-327-01.pdf

From an information security perspective, I’m particularly interested in seeing how much of a role access management plays in both the prosecution and defense arguments. According to a Wired Magazine article, expert testimony “might include assessments of forensic evidence from classified networks and databases that contained the sensitive documents Manning is charged with downloading and leaking.”

We’ll be using this blog to discuss the information security aspects of the trial, and explore any implications to the larger identity management industry.