Cloud Compliance Blog

Identity and Access Assessment (IdAA)

Ronald Reagan famously said "Trust, but verify". He could very well have been talking about entitlement management systems, which manage authorization to critical applications and other IT resources. Such systems are trusted to maintain control over entitlements (also called privileges or access rights). However, the systems themselves rarely have verification or assessment capabilities. This may be adequate for smaller organizations or enterprises where roles change infrequently. But the dynamic nature of most enterprises -- with layoffs, restructurings, aggressive use of contractors and other service providers -- makes assessment not only prudent, but necessary to ensure effective access controls and audit compliance.

Entitlements

Deloitte, in The 6th Annual Global Security Survey, reports that excessive entitlements, also known as excessive access rights, was the top audit finding over the past year -- for the second year in a row! In other words, a fundamental access control that represents a compliance exposure and security vulnerability was the top audit finding in 2007 and, despite all the attention that garnered, was also the top audit finding in 2008 (the latest year for which survey data exist).

Since all major regulatory frameworks, including SOX, PCI DSS, GLBA, NERC and HIPAA, require access controls, many thousands of companies are obligated to prevent excessive access rights and yet, according to the Deloitte survey, have failed to effectively do so.

Not only is excessive access rights the top audit finding, but IDC states that such vulnerabilities result in major financial exposure -- and that up to 60% of rights on most systems are expired and therefore dormant. The problem is that IT and security staff at most companies don't know that dormant accounts exist -- or more precisely, they suspect they exist but don't know how to find or remediate them.

Why is this a hard problem to solve?

Access Controls in the Real World

A paper written by a team at Dartmouth describes observations from field study research of both retail and investment banks. The study was more in-depth than most surveys we hear about; for example, the study team was embedded for three weeks in the security group of an investment bank. The report focuses primarily on internal access controls and the risks of over-entitlement, and they directly address the challenge of effectively managing access controls.

What they found was that the frequent shifting of staff may from one department or role to another often results in users accumulating entitlements over time. Part of the problem is this: Entitlement management systems assume that an employee's direct supervisor can make informed decisions about what entitlements are required to do their job. But as the Dartmouth team points out:

"As more organizations take on a matrix structure, it becomes less evident who reports to whom and who is responsible for permitting and terminating data access."

This leads to ambiguous and unwieldy structures for assigning entitlements, or privileges, as shown in Figure 1:

Figure 1: Privileging in traditional hierarchical corporate structures (left) vs. in dynamically, "matrixed" organizations (right). An arrow represents a supervising relationship (directed graph). Note that on the left, each person has exactly one direct supervisor, whereas on the right, each may have two or more.

 

And even if the corporate structure and reporting relationship is clear in all cases, the degree of scale and complexity makes entitlement management a big problem as shown in Figure 2: 

Figure 2: Complexity and dynamicism in entitlement systems. The number of applications, entitlements and users make it a large-scale problem, and the number of daily modifications makes it a fast-moving target.

 

The biggest challenge isn't the massive number of entitlements and users, however, but the highly dynamic nature of employees and organizational structure within the firm.

Conventional wisdom holds that role-based access control (RBAC) systems are the answer. By allowing organizations to segregate the massive numbers of employees and entitlements into work groups, RBAC systems make the entitlement management process more effective. But the size, complexity and dynamic nature of many large enterprises make role-based access control challenging, to say the least. Quoting from the Dartmouth study:

"At one very large retail bank that we interviewed, the CISO had recently completed an RBAC project creating 11,000 roles across the firm to control access to nearly 22,000 applications. Developing the roles took a team two years and the ongoing review process was expected to be significant."

In the real world, access rights are constantly changing, for legitimate reasons: employees are hired and terminated; contractors come and go; service providers and outsource firms require access on a project basis with often unclear timelines; federated identity management systems expand the concept of trusted user beyond the enterprise boundary; departments and whole companies undergo reorganizations; mergers and acquisitions result in major restructurings; layoffs lead to rapid and sometime undocumented role changes; and employees transferring within a company inevitably have to overlap responsibilities (and access) between their old and new jobs. Unclear and imperfect communications between HR, line-of-business (LOB) staff, and IT exacerbate the problem.

Managing Entitlements

Andrew Jaquith, an analyst at Forrester, in his book Security Metrics states:

"Today's information security battleground is all about entitlements-who's got them, whether they were granted properly, and how to enforce them."

Companies large and small employ different approaches to entitlement management, with equal lack of success. Mostly, they do manual reviews of entitlements prior to audits by going through HR records, reviewing application logs, and interviewing LOB managers-a process inevitably referred to as a fire drill. Other approaches to entitlement management include development of custom reports for SEIM and log management systems, network-based user activity monitoring, and RBAC systems.

The management challenge is to determine what's a reasonable target level of excessive access rights in terms of percentage of overall rights granted, and then ensure that solutions are in place to consistently keep actual excessive access rights on or below the target. It's more expensive to establish an excessive access rights target of 2% than of 4%, for example. Therefore, management must determine what level constitutes "enough" security, doesn't break the budget or put an undue burden on IT or line-of-business staff, and yet meets the compliance requirements as measured by auditors. What auditors are looking for is a sustainable, measureable process that demonstrates visibility (can the company detect when and where it has excessive access rights?) and the ability to remediate problems when they occur (can the company eliminate excessive access rights within a reasonable amount of time from their detection?).

Top Audit Findings

As the Deloitte survey reports, current approaches have failed to achieve the desired and necessary level of compliance -- not just for excessive access rights, but for access controls in general.

Figure 3: Top internal and external findings for 2007 and 2008, ranked by percentage of respondents citing findings in each category, taken from the Deloitte survey.

 

Here's an explanation of each of the findings:

Excessive access rights. Note that despite the improvement from 2007, excessive access rights remained the top audit finding in 2008 as noted above. Part of the reason that excessive access rights has been the top finding for the past two years is that auditors have raised the standard, from evidence of the existence of a process to evidence that the process is effective.

Segregation of duties. Segregation of duties, also referred to as separation of duties and abbreviated SoD, is one of the most fundamental concepts of security and control, and also one of the most difficult to achieve.

Access control compliance with procedures. This audit issue is closely related to excessive access rights; access control is required to prevent users without appropriate rights from accessing audited resources.

Lack of audit trails/logging, lack of documentation of controls, and lack of review of audit trails. These three top findings are grouped together because they represent the facet of access audit where technology and process come together. Application logs, which represent the most effective way to determine user access activity, are an essential tool for ensuring that access controls are compliant. And reports that list who has access to what, along with who should have access to what, become critical components of how access controls are documented.

Excessive developers' access to production systems and data. This audit finding is challenging to address, because it's unrealistic in most operating environments to completely block developers from accessing production systems for troubleshooting and critical maintenance operations. The objective, then, is not to prevent such access but to note when it's risen to an "excessive" level.

Lack of clean-up of access rules following a transfer or termination. Few if any organizations effectively manage rights and access rules in a real-world environment with re-org, restructurings, layoffs, role re-definitions and transfers-especially transfers. Because transfers are not a discrete event so much as a process where an employee has overlapping responsibilities between new job and old job-and therefore must maintain access rights for both jobs.

It's clear from the Deloitte survey that access controls are problematic. While organizations are reasonably effective in ensuring that only authorized users may log in to critical resources, they fail to consistently determine which users should be authorized to access those resources. Meanwhile, auditors have learned where to look in order to find users with excessive access rights and other access control violations; hence, an increasingly high rate of audit findings.

Is Perfect Access Control Possible?

The well-known security guru, Bruce Schneier, in a recent article entitled Is Perfect Access Control Possible?, discusses many of these same points and concludes:

"In the end, a perfect access control system just isn't possible; organizations are simply too chaotic for it to work."

Schneier refers to the Dartmouth study's finding that 50-90% of users are over-entitled in large organizations. Over-entitlement leads to risk, and therefore attracts the attention of auditors as explained in the Dartmouth study:

"It may not seem problematic for employees to have access to systems they never use or are unaware of. However, such access introduces risk. The root of the problem is that unnecessary or uncontrolled access can lead to unintended data editing, accidental disclosure, or internal misuse. That is why Sarbanes-Oxley auditors will flag unnecessary access as a weakness."

Auditors have learned in recent years how to find and flag excessive access rights, which is the top cause of audit findings. And not only is audit compliance an issue, but as noted above in the IDC report excess entitlements represent a huge financial liability. Thus, imperfect access controls represent a security vulnerability, a financial liability, and a compliance exposure. Despite these compelling motivations, we find from research by Deloitte, IDC, Forrester, Dartmouth and Bruce Schneier that present-day access controls are largely ineffective, especially in highly dynamic organizations.

What does the future hold for access control? New technologies are on the horizon that, by taking an approach referred to as Identity and Access Assessment (IdAA), enable visibility into the effectiveness of access controls. Such solutions perform data mining to analyze access activity over time and thus identify access control issues for remediation.

Cloud Compliance

Cloud Compliance is developing an IdAA solution to improve the efficacy of compliance solutions and reduce the cost of achieving compliance. We combine the economies of cloud computing with fundamental performance management principles to provide easy, low cost analysis of access rights to prevent audit findings and ensure access control compliance with regulations such as SOX, GLBA, PCI DSS, HIPAA and NERC. Our solution enables customers to identify access audit deficiencies before auditors arrive, and without manual process costs that otherwise dominate. 

Here's how it works: Cloud Compliance employs SaaS-based data mining analytics that examines users' access activity to identify and report on excessive access rights and other access controls. The Cloud Compliance solution can assess your organization's identity and access controls in five simple steps:

1.      Point your browser to the Cloud Compliance SaaS site

2.      Using Cloud Compliance's automatic wizard, select which resources and applications you wish to assess. This is a matter of identifying the SSO system, SIEM, MSSP (if you have a log retention service), or the targeted application servers' log files and entitlements data.

3.      Upload entitlements info and log data to the Cloud Compliance SaaS site.

4.      Review the graphical analytics to determine performance versus benchmarks, and to remediate any policy violations

5.      Repeat steps 3 and 4 periodically. The amount of time between assessments represents the maximum lag time between when a violation occurs and when it's identified.

It's that easy!

Our innovative ability to measure, report and ultimately remediate potential audit findings enables our customers to resolve compliance problems prior to an audit. In addition, Cloud Compliance's graphical analytics highlight trends and identify root causes to compliance issues, by audited application, or by business unit, providing valuable insight into potential security vulnerabilities. Furthermore, due to our global visibility as a cloud-based SaaS solution, we capture statistics industry-wide that our customers can access for setting their own policy benchmarks. Finally, the Cloud Compliance SaaS solution requires no software to install, maintain and operate, no appliances to deploy, no consultants, advisors or professional services to deploy, and no huge upfront capital expense to incur.

For further information, see the Cloud Compliance use case demo at http://www.cloud-compliance.com/product/demo/.

Cloud Compliance Security

As with all cloud-based services, security can be a concern. That's especially true for services that address compliance issues and access vulnerabilities. Cloud Compliance employs the Amazon EC2 (Elastic Compute Cloud) service which has extensive and comprehensive physical and logical controls, including:

§         State of the art intrusion detection systems

§         Authorized staff must pass two-factor authentication at least twice

§         Immediate deprovisioning of admin when no longer has business need

§         Extensive background check of staff with potential access to customer data

§         All admin access logged and audited

§         Network security: DDoS, MITM, and firewall

§         Firewall requires customer's X.509 certificate and key to authorize changes

§         API calls to launch and terminate instances and perform other functions require X.509 certificate

§         S3 (storage) read permissions controlled by ACL

§         S3 authentication using HMAC-SHA1 signatures

§         Storage device decommission based on NIST 800-88 (media sanitation)

§         AWS recurring SAS-70 Type II certification

Cloud Compliance encrypts data in transit as well as data at rest (there's also an option that precludes the need to store any log or entitlement data at all). And it's worthwhile pointing out that the Cloud Compliance solution does not require access to personal identifying information (PII); only a non-sensitive subset of entitlement data and log records are required.

Compliance Made Easy

Cloud Compliance's Identity and Access Assessment service is easy to adopt and provides immediate results. We solve access control issues that go by many names: excessive access rights; least privilege policy violations; excessive privileges; dormant accounts; and excessive entitlements. These access control issues have been identified, studied and reported on by major audit firms such as Deloitte, analysts such as Forrester and IDC, academic research teams such as from Dartmouth, and enterprises around the world. Yet, until Cloud Compliance, there was no effective solution available. Now, with our SaaS-based IdAA, achieving access audit compliance is not only possible -- it's easy.

 

Note: A PDF of this post can be found here.

Clouds for Compliance: Do the Benefits Outweigh the Risks?

A new white paper, Cloud Computing: Business Benefits with Security, Governance and Assurance Perspectives, has just been published by ISACA. The paper provides a short overview of cloud service models and deployment models, and lists the well-known business benefits of cloud computing -- with cost savings at the head of the list. Ease of deployment, high availability, scalability, efficiency and resiliency round out the list of cloud computing benefits.

But what's interesting to IT and security professionals are the risks and security concerns associated with cloud computing. To those following the literature and debates on cloud security the concerns listed in the white paper are familiar: what is the reputation, history and sustainability of the cloud service provider (CSP); where does data reside, and does it matter if that question can't be answered precisely; how well is information protected; who can have access to sensitive or confidential information; and can sensitive information be located in the event of a disaster. Many of these issues at a minimum can be addressed in contractual service level agreements (SLAs), but writing tight SLAs is not the same as mitigating risk.

The ISACA white paper is relatively brief and high-level. Many other information resources exist that delve into great detail on CSP exposures and vulnerabilities, both real and imagined. But additional detail and technical depth isn't necessarily what organizations need to determine whether cloud benefits outweigh the risks for their situation. Specifically, they need to assess the risk related to their sensitive data that would be operated on or stored in the cloud.

Every organization should -- and many organizations do -- have a data classification strategy in place. COBIT 4.1, for example, mandates that organizations should "Establish a classification scheme that applies throughout the enterprise, based on the criticality and sensitivity (e.g., public, confidential, top secret) of enterprise data... It is used as the basis for applying controls such as access controls, archiving or encryption" (section PO2.3). The following classification guide, from the State of New York's CSCIC, is a good example of an approach for classifying data based on risk levels with regard to data confidentiality, integrity and availability:

 

Here is another approach, then, to dealing with cloud security risks: Limit cloud-based applications to only those that operate on low- or moderate-risk data. Put another way, your organization may decide to reap the economic benefits of cloud-based services -- but only for applications that fall within acceptably low risk profiles.

This evaluation process is already being employed, if only implicitly. Tens of thousands of companies have opted for SaaS-based CRM solutions, the most well-known being from Salesforce.com. Customer information, while valuable to the organization, is not so critical that having it stored in the cloud is viewed as an unacceptably high risk.

On the other hand, many companies I've spoken to believe that the risk of storing personal identifying information (PII) or other highly-confidential information in the cloud is unacceptably high-at least at the current level of cloud security maturity.

My company, Cloud Compliance, has a keen interest in this question. We believe that internal user names and logon activity are no more sensitive than CRM data currently being stored in the cloud by so many companies. While we've found many organizations that agree with our risk assessment, there are others who aren't so sure.

Identity and Access Assessment (IdAA) solutions such as that being developed by Cloud Compliance need to upload two data sets to the cloud in order to perform their analytics:

1. log records from SSO systems, log management systems or from application servers which show all access activity (log on and log off) and includes user IDs and time/date of access; and
2. rights or entitlement information from AD, the applications or from an identity management system which lists which users have entitlements to which applications. (Note that if the entitlement/identity management system includes personal identifying information such as SSN or home address it is not included in data sent to the cloud. Also note that data in transit as well as data at rest is encrypted.)

(Please visit our product page for more information on how our solution works as well as a use case demo.)

This is the relevant risk management question: If you assume that IdAA solutions reduce if not prevent audit findings related to access controls, is it worth the risk to have your user names, login activity and entitlement information stored in the cloud?

Here's another way to look at it: Is your internal entitlement and activity data more or less sensitive than your customer data that's being stored in the cloud by Salesforce.com and other CRM SaaS solutions?

I am very interested in your views. Please leave a comment on the blog, or send me your opinion at rforkish@cloud-compliance.com. I'll report back in a future post on the collective wisdom of the blog readers.

Security from the Cloud

It's slightly ironic that while there are concerns about security in the cloud, there are a number of managed security services that provide security from the cloud. As outlined below, cloud-based Software-as-a-Service (SaaS) security solutions are being ever more widely adopted to save money and improve security.

Gartner reports that the current tough economic conditions drive many companies to look at cloud computing and SaaS offerings in order to cut expenses. There must be something to that, as Nemertes Research's 2009 Spring Benchmark finds that 60% of participants are planning to increase their use of managed services in 2009. And Infonetics Research reports that revenue derived from managed security SaaS will grow at a compound annual growth rate of 46% from 2008 to 2013. That's a phenomenal growth rate. "SaaS is definitely the future of managed network security," said Jeff Wilson, Infonetics Research's Principal Analyst for Network Security.

Companies are not willing to adopt SaaS for security at the expense of strong security capabilities. In fact, as shown in the following chart, the top driver behind SaaS for security is strength for security; cost is second. In other words, the drive to cut costs has also led to stronger security capabilities:

 

As more services are delivered from the cloud, scale economies will improve and the level of acceptance will result in SaaS security as a mainstream offering for SMBs as well as large enterprises. But there's another factor that comes into play that makes SaaS even more valuable, which I refer to as technical leverage. Take Salesforce.com, for example. Salesforce is the world's leading SaaS vendor. They now also offer a Platform-as-a-Service (PaaS) solution called Force.com. And with Force.com one can leverage their AppExchange, an online directory that provides customers a way to browse, test-drive, share and install applications developed on Force.com. One analyst refers to AppExchange as "the iTunes of business software". That's a powerful concept, and potentially significant leverage for Salesforce.com customers.

SaaS has fueled remarkable innovation, as vendors roll out cloud-based solutions for different aspects of security and compliance. Forrester's white paper on Authentication-as-a-Service, commissioned by VeriSign, describes challenges companies face with regard to authentication and how a cloud-based authentication service would be perceived. Expected benefits from such a service include improved reliability, reduced fraud, reduced identity theft, and improved scalability.

Symplified, which refers to itself as "The Cloud Security Company", provides identity management from the cloud. They claim an 80% savings compared to software. TriCypher offers a cloud-based single sign-on (SSO) service called myOneLogin that they claim can be deployed in minutes. Cloud Compliance offers a cloud-based identity and access assessment service for SOX, PCI DSS, GLBA and HIPAA that addresses the top causes of IT audit findings.

If we step back and look at the big picture, we observe that cloud-based authentication, identity management and compliance services represent additional forms of technical leverage. An enterprise can pick and choose from among SaaS offerings to build a complete security and compliance solution from best of breed components. And unlike software, SaaS solutions require no installation, no upgrades or patches, no maintenance, and typically cost significantly less than the software they replace. But most importantly, these innovative SaaS offerings enable companies to strengthen their overall security and compliance profile.

Security in the Cloud

It's 2009, so it must be time to cut expenses. Again. Which means many companies are taking a look at leveraging cloud services in order to save money. Will they have to sacrifice security in order to realize significant cost savings?

There are several valuable resources available for evaluating cloud security. In this post I discuss two, one from Gartner and the other from the Cloud Security Alliance.

In their June, 2008 report entitled "Assessing the Security Risks of Cloud Computing", Gartner lists seven specific security issues to investigate:

1. Privileged user access. I would concur with this as the top issue. In theory, once it's sent into the cloud your data could be accessible by admins--privileged users -- that you have never seen or vetted. What kind of protections can you apply to your data (such as encryption, access control lists)? What kind of screening and background checks are performed for admins? How comprehensive are the site's physical controls? Do they have (and use) video surveillance? Do they employ two-factor authorization, and how many times must an admin be authenticated before he or she has physical access to sensitive areas? Is all access logged? Are admins immediately de-provisioned when they are terminated or simply no longer have a business need for access? And so forth.

2. Regulatory compliance. What kind of compliance, such as SAS-70 Type II certification, has your cloud provider achieved? What kind of support do they provide for your certification requirements, such as PCI DSS and HIPAA?

3. Data location. Some compliance standards require that certain data not leave the current regional/national jurisdiction. Will your cloud provider commit to storing and processing your data within a specified jurisdiction?

4. Data segregation. What, if anything, is done to segregate data at rest? Have encryption schemes been tested by qualified specialists?

5. Recovery. Understand and evaluate your cloud provider's disaster recovery and business continuity strategies. An earthquake or flood that completely devastates your cloud-based applications and data constitutes an unacceptable risk for most enterprises.

6. Investigative support. Access to archived data may be required for litigation support, discovery requests or illegal activity investigation. Make sure your cloud provider can support these requirements.

7. Long-term viability. If your cloud provider goes out of business, you may not have access to critical resources stored in that provider's now-defunct data centers. You should have some assurance that your provider is viable for the long term, or protections in place against an unexpected shut down.

A more comprehensive resource has been developed by the Cloud Security Alliance, called "Security Guidance for Critical Areas of Focus in Cloud Computing"; you can find it here. The white paper covers many of the same points as Gartner, but with more depth on foundation and architectural issues, as well as additional items to consider including Information Lifecycle Management, Portability and Interoperability, Encryption and Key Management, and Identity and Access Management.

With regard to Identity and Access Management, the Cloud Security Alliance emphasizes the need for a robust federated identity management system that includes user and access lifecycle management as well as audit and compliance capabilities. At Cloud Compliance we couldn't agree more, and note that most IdM systems are rather weak on the audit and compliance front because they lack the ability to perform identity and access assessment. That's the service that Cloud Compliance provides.

Security and The Cloud Hype Cycle

Emerging technologies are inevitably subject to hype cycles. Cloud computing, for example, had reached what Gartner calls "the peak of inflated expectations" when experts were proclaiming in 2008 that cloud computing would effectively put all servers ever manufactured at our disposal, with virtual everything, infinite scalability, and at price points approaching zero. Every enterprise application was a candidate for cloud computing. It was all good.

I saw evidence in late June that we had arrived at the next stage of the hype cycle, the "trough of disillusionment", in a posting on Dark Reading entitled "Could The Cloud Lead To An Even Bigger 9/11?" Here's an excerpt:

"...a coordinated attack...could stop a country cold, with recovery taking years and massive infrastructure failures causing loss of life and resources never seen outside of an outright world war."

Wow. I have to admit that this is the first new technology I've encountered whose downside was on par with a world war. How worried should I be? To answer that, let's look again at where we are in the cloud computing hype cycle:

First, the amplitude of the hype curve has created a state known as "blogger heaven". And we're probably just past the nadir of the "trough of disillusionment". Which means there's a collective realization that cloud computing--like every new technology before it--has failed to live up to the inflated expectations of last year. Does that make it bad? Of course not. Are all articles, blogs, white papers and other resources now biased to the downside of cloud computing? No, that's too much of a generalization. But it's fair to say that among the thoughtful cautions being published these days one is bound to find more than a fair share of hand-wringing and forecasts of doom.

The driver for cloud services is economics. Cloud services, especially SaaS-based delivery models, promise huge cost savings compared to traditional enterprise software. The model is attractive, with the prospect of no upfront investment required, pay for only what you use, and no software to deploy or manage. And with most companies these days looking for any way to cut expenses, it's likely that question will come from senior management: How can we leverage the cloud to save money?

Well, one option is to tell the CFO, CEO and board members that cloud services are a bad idea because of the world war downside.

Another option for any company is to analyze specific requirements, and develop a cloud security strategy consistent with the sensitivity of data and company mission. A key area of focus -- for applications in the cloud or behind the enterprise firewall -- is controlling access to critical resources and data. Of course, not all clouds are created equal -- some have better controls than others. But when the silver lining is huge cost savings, it's worth the effort to investigate cloud offerings to find those that meet a company's unique security requirements.