Driving fast into the Tech Lane

As I was driving down to a restaurant with a friend of mine, we were chatting about another common friend and his new venture on mobile applications. The conversation soon gained technical flavor and it was a nice drive into the fast changing technology lane. Here are some excerpts from our conversation during the drive.

On why enterprises are in a hurry to port existing applications to mobile platform...

The technology is evolving so fast and enterprises will soon be embracing mobile devices which range from smart phones to tablets. Every tech worker owns a mobile smart device of his or her choice. Most such workers are holding senior positions in the enterprise and are very keen to use it to perform their work and for the purpose, try to influence the IT heads to allow such devices in work environment. This in fact is a challenge for the CIOs in terms of information security and confidentiality. But as this trend is growing, the IT heads have no option than to embrace this trend and start regulating this with a formal BYOD (Bring Your Own Device) policy, controls and governance framework around it.

On how BYOD is relevant in the context of mobile applications...

Yes, as the BYOD is gaining increased acceptance, the next big challenge is to get existing applications working on such devices, so that the employees don’t have to be provided with a desktop or even laptop. This in turn drives the need for porting the applications to mobile platform. Many tools and methodologies are emerging in this space so as to facilitate building mobile applications from ground up and also to port existing legacy applications to mobile platform. Write once deploy any where is the USP for today’s development tool vendors.

On how legacy applications can be ported...

This is where the Service Orientation is gaining importance. Business services are identified and exposed as reusable services and then build a portal application on top of it to appropriately present it for end user access on a variety of devices. The organizations would also consider embracing the cloud based SaaS applications to replace the legacy applications. And yes, migration to cloud could be a daunting task but CIOs are seeing a longer term benefit in doing so. An alternative shorter term solution could be to get a virtual desktop on the mobile device and then work on whatever legacy app that runs on the desktop.

About the concerns on cloud...

Yes, there still are certain concerns that keep organizations away from the cloud. However this trend is changing. Most organizations have already moved less critical applications to the public cloud. Like we have central / reserve banks regulating the banking industry, it is time for the industry consortium to come up with an independent regulatory body / framework, which can help establish the trust amongst the enterprises, which in turn will ease some of the security concerns. While industries like Banks and healthcare providers have reasons to be concerned to embrace cloud, other industries are showing serious signs of embracing the cloud.

On the amount of data that banks process and manage and whether that could be a deterrent for cloud adoption...

Be it cloud or not, data quality and data maintenance is going to emerge as a critical function. Dirty data and redundant data is being identified as having considerable impact on the profits of the organization. Tools have emerged in assuring data quality, data de-duplication and master data management. Computing hardware and related technologies like virtualization has made vertical and horizontal scaling very easy and thereby making the usage of these data intensive tools a possibility.

We both enjoyed this conversation and I am sure, you would also enjoy reading this. 

Governing Identity Management

Traditionally, each software application is developed to maintain and manage the identity and the related permission information within it. As more and more such applications gets deployed, user provisioning and managing access control could soon be a nightmare. A well managed Identity Management function within an enterprise can alleviate the hassles around this and will also enable the enterprise to better govern the identity and resource provisioning activities.

Identity Management solution as such comprises of the following key functions in addition to being technically capable of exposing necessary automation APIs:

Account Provisioning

This is a core function within Identity Management and this is where an identity gets created.  The following are the typical activities that need to be performed under this function.

• Adding an Identity - includes receiving a request with required data, performing necessary verification and obtaining approval from appropriate authority.
• Modifying an Identity - involves change of certain attributes of an identity.
• Deleting an Identity - when an identity no is no longer associated with the organization, deletion may be required. Deletion may not mean actual deletion and instead may mean de-activation.
• Suspending / Resuming an Identity - usually when employees go on long vacation, it would be appropriate to suspend the identity and resume again when the employee comes on board.

Resource Provisioning

An Identity once created need to be provisioned to access one or more services, which could be out of a computing resource or a non computing service. For instance, computing resources could mean access to payroll application and similarly a non computing resource could mean physical access to the Data Center.

De-Provisioning

De-provisioning is an equally important function which, if not done on a timely manner could put the organization into a big risk. For instance, if an employee who has been granted access to critical systems, is not de-provisioned when he leaves the organization, he could cause potential loss to the company.

Managing Permissions and Authorization

Provisioning a resource would only mean that the resource has a need to use the target resource, but it has to be further managed by defining specific privileges like, Read, Write, Delete. Similarly, the identity may have to be granted different permissions for different sub functions that the resource may expose. While a standards based IAM solution would be extensible, the consuming application may require changes to interact with the IAM solution and make use of the authorization information that is exposed.

Governance

With a central identity management solution, it is important that the related functions are better managed, monitored and audited. This requires defining, implementing and monitoring controls around people, process and tools & technology.

• People – The person performing the one or more of the above functions should be highly trust worthy and appropriate separation of duties and responsibilities should be put in place. For instance, the person approving the identity creation should not be the same person who creates it. The identity performing these functions should be at appropriate level which ensures accountability. 
• Process – Policies and processes need to be defined for each of the above functions. For instance, Identity creation shall specify the source of data, the required attributes for which data need to be captured, a process or methodology to have the identity information verified and on top an approval process. It is typical that the approving authority may be different for different resource, which has to be unambiguously defined. There should also be a process specifying the monitoring and audit requirements for the above functions.
• Tools  & Technology – Carrying out the above functions will certainly need an appropriate tool and related technology. A comprehensive enterprise tool may facilitate carrying out all the required functions in addition to offering necessary APIs for the resources that consumes the authentication services. It is important to specify how access to these tools and related infrastructure is protected and governed.

The following are the key control objectives that need to be defined with respect to each activity performed under Identity Management:

• Identification – the security control process that creates an entity and verifies the credentials of the individual, which together form a unique identity for authentication and authorization purposes
• Authentication – a security control process that verifies credentials to support an interaction, transaction, message, or transmission
• Authorization – a security control process that grants permissions by verifying the authenticity of an individual’s identity and permissions to access specific categories of information or functions exposed by a resource.
• Accountability – a security control process that records the linkage between an action and the identity of the individual or role who has invoked the action, thus providing an evidence trail for audit or non-repudiation purposes
• Audit – a security control process that examines data records, actions taken, changes made, and identities/roles invoking actions which together provide a reconstruction of events for evidence purposes

All the control objectives above serve the requirement to provide an auditable chain of evidence.

Identity management control processes should have an input, one or more control activities, an output, feedback, management monitoring, and an overall audit appraisal activity to ensure that they are fit-for-purpose. The starting point is an individual who is enrolled into an organization and subsequently acts in a function or role in the organization. The individual may be an employee, partner, or contractor, or third party. The output is the appropriate degree of policy enforcement and individual accountability for the business activity. Within the controls, the threats and vulnerabilities constituting the business risk must be addressed and assessed. These include business, legal, and technical aspects.

Like with any systems, the following are the key non-functional requirements an Identity Management infrastructure should aim to offer.

• Being more responsive and secure
• Interoperability with a multitude of systems requiring identity information.
• Support for multiple authentication mechanisms, like two factor, bio-metric, etc.
• Interfaces and APIs for automation which could result in reduction in operational costs.

A governance framework would not be complete if it does not define the measurements that indicate the efficiency and effectiveness. The following are some of the metrics that could be considered:

• Password Reset volume – A well managed Identity Management System is expected to considerably reduce the help desk calls on forgotten passwords. As such a measure of this activity could be a key metric to establish that there is a considerable saving in such help desk activities.
• Number of distinct credentials per user – With Single Sign On implemented, there should be only one distinct credential per user.
• Average time taken for each of the identity management functions could be another useful metric to establish that the investment is worth.

References:

White paper on Identity and Access Management published byThe Open Group

More related reading:

Liberty Alliance Project 

BYOD – Yet another challenge for IT heads

For those, who are not familiar with the term BYOD, it stands for “Bring Your Own Device” and use it to achieve your work goals, be it within the company or anywhere else. A simple example for this is when an employee uses his own iPad to access his corporate emails, or use any other wi-fi enabled device to connect to corporate wi-fi network and use it to perform certain work related tasks. This has been in practice with the education and training companies, where the students / participants are expected to use their own devices, subject to meeting of the required minimal hardware and software specifications. Thanks to the last recession the recent explosion of the smart personal gadgets, companies are increasingly considering allowing this. 

The factors that drive the BYOD amongst corporate are:

1.  Increased Productivity - Employees are expected to be happy working on their favourite stuff and in turn that is likely to bring in increased productivity.
2. Better Mobility – Organizations with mobile workforce, who typically work on the move, feel that BYOD could offer better mobility and flexibility.
3. Cost Savings – Though this may not be a real benefit, as organizations may end up spending considerably on mitigating the risks that BYOD brings on board, this is considered as a factor driving the increased adoption.
4. Influence from senior executives – Typically if a senior executive buys a latest gadget and then using it in the workplace to do their work.
5. Decreasing client installs – With increased adoption of Cloud based applications, all that a user need to access the enterprise application is a compatible web browser and this favours BYOD.

Certainly BYOD brings on board a lot of challenges to the IT department and here are some of the key challenges:

1. Support – The IT department have to start supporting varying make and models of smart gadgets running different operating systems and web browsers. Unless the IT department comes up with the list of gadgets that they can support, it could soon be a nightmare.
2. Licensing – If there are certain third party components to be installed on the smart devices, then it is better to have the licensing terms of the component vendor verified, as some vendors may impose restrictions in installing such components on devices other than those owned by the organization.
3. Network and Application Security – When employees use the organization provided devices, they are appropriately hardened in line with the security policies of the organization. But in case of BYOD, the employees for sure would not like to have their devices hardened for work use, instead they would like to be the administrators of their own device and play with it in whatever way they want. On the other hand, employees may even go ahead and install more and more mobile apps of their choice, some of which could even be malware.
4. Data Security – Whatever data that is cached or stored on the gadgets, as the devices are used for work are subject to be easily compromised.

For sure, this is yet another challenge that the IT managers should be ready to face soon, if not now.