Identity Management

Symplified's CEO will argue at an upcoming conference one way to deal with the problem: Push access management and control into the cloud

Red Cross CISO Suzanne Hall on the organization's monster effort to overhaul security and identity management.

Cloud management tools are as varied as cloud uses. For this test, we chose five tools that each attack cloud management from a different perspective.

Privileged identity management (PIM) products automate control over administrative accounts, which typically put too much power in too many people's hands with too little accountability. They address the security, operational and compliance issues posed by the widely shared administrative accounts and passwords, excessive administrative rights, poor separation of duties, embedded passwords in legacy applications and scripts, and poor or nonexistent privileged-password rotation. They also provide individual accountability and an audit trail to prove that policies and controls are actually being enforced.

NEW YORK -- A CISO who spent two years organizing identity and access management for the 15,000 users on his network boiled the whole experience down into a 10-step process he presented at the Security Standard Conference this week.

Microsoft announced at the RSA Conference Tuesday that it has begun shipping Forefront Identity Manager 2010, server software for provisioning and de-provisioning user access and privileges for network and database resources.

The identity management landscape is changing. The need for stronger auditing controls is giving rise to identity governance tools that are supplanting ID provisioning solutions as the centralized management layer for identity.

Microsoft executives say the company's ambitious plan to integrate security and identity software is progressing slower than hoped but that the foundation for the work will be set early next year.

By Cal Slemp, Protiviti

Leslie Lambert, vice president and chief information security officer at Sun Microsystems Inc., returned from a three-week business trip to India with a few souvenirs and a whole new set of IT security priorities. In 2009, projects like server security, metrics, application security and Web security will likely take a back seat to new data-protection measures and deeper enhancement of user-access and identity management systems. "Those are the big hitters now," she says.