Cloud Compliance Blog

Cloud Compliance, RIP

Sad news. I have been unable to raise funding to scale the company, and, as a result, I am forced to shut down Cloud Compliance. The web site will be taken down soon.

At the end of the day, compliance opportunities aren't sexy enough for investors -- at least not in the current climate. Compliance is too hard to understand if it's not a space you're already tracking, and the problems Cloud Compliance addressed were assumed by outsiders to have been already solved.

Of course, that's the investor perspective. At Cloud Compliance we spoke to many organizations that had -- and continue to have -- problems with access audits related to dormant accounts and excessive access rights.

For regular readers of this blog, I appreciate the interest you have shown. If you'd like to continue to follow my rants and perspectives on key topics -- including web services and online billing -- please follow my Bleeding Edge blog over at http://net-founder.blogspot.com/.

Many thanks!

Identity and Access Assessment (IdAA)

Ronald Reagan famously said "Trust, but verify". He could very well have been talking about entitlement management systems, which manage authorization to critical applications and other IT resources. Such systems are trusted to maintain control over entitlements (also called privileges or access rights). However, the systems themselves rarely have verification or assessment capabilities. This may be adequate for smaller organizations or enterprises where roles change infrequently. But the dynamic nature of most enterprises -- with layoffs, restructurings, aggressive use of contractors and other service providers -- makes assessment not only prudent, but necessary to ensure effective access controls and audit compliance.

Entitlements

Deloitte, in The 6th Annual Global Security Survey, reports that excessive entitlements, also known as excessive access rights, was the top audit finding over the past year -- for the second year in a row! In other words, a fundamental access control that represents a compliance exposure and security vulnerability was the top audit finding in 2007 and, despite all the attention that garnered, was also the top audit finding in 2008 (the latest year for which survey data exist).

Since all major regulatory frameworks, including SOX, PCI DSS, GLBA, NERC and HIPAA, require access controls, many thousands of companies are obligated to prevent excessive access rights and yet, according to the Deloitte survey, have failed to effectively do so.

Not only is excessive access rights the top audit finding, but IDC states that such vulnerabilities result in major financial exposure -- and that up to 60% of rights on most systems are expired and therefore dormant. The problem is that IT and security staff at most companies don't know that dormant accounts exist -- or more precisely, they suspect they exist but don't know how to find or remediate them.

Why is this a hard problem to solve?

Access Controls in the Real World

A paper written by a team at Dartmouth describes observations from field study research of both retail and investment banks. The study was more in-depth than most surveys we hear about; for example, the study team was embedded for three weeks in the security group of an investment bank. The report focuses primarily on internal access controls and the risks of over-entitlement, and they directly address the challenge of effectively managing access controls.

What they found was that the frequent shifting of staff may from one department or role to another often results in users accumulating entitlements over time. Part of the problem is this: Entitlement management systems assume that an employee's direct supervisor can make informed decisions about what entitlements are required to do their job. But as the Dartmouth team points out:

"As more organizations take on a matrix structure, it becomes less evident who reports to whom and who is responsible for permitting and terminating data access."

This leads to ambiguous and unwieldy structures for assigning entitlements, or privileges, as shown in Figure 1:

Figure 1: Privileging in traditional hierarchical corporate structures (left) vs. in dynamically, "matrixed" organizations (right). An arrow represents a supervising relationship (directed graph). Note that on the left, each person has exactly one direct supervisor, whereas on the right, each may have two or more.

 

And even if the corporate structure and reporting relationship is clear in all cases, the degree of scale and complexity makes entitlement management a big problem as shown in Figure 2: 

Figure 2: Complexity and dynamicism in entitlement systems. The number of applications, entitlements and users make it a large-scale problem, and the number of daily modifications makes it a fast-moving target.

 

The biggest challenge isn't the massive number of entitlements and users, however, but the highly dynamic nature of employees and organizational structure within the firm.

Conventional wisdom holds that role-based access control (RBAC) systems are the answer. By allowing organizations to segregate the massive numbers of employees and entitlements into work groups, RBAC systems make the entitlement management process more effective. But the size, complexity and dynamic nature of many large enterprises make role-based access control challenging, to say the least. Quoting from the Dartmouth study:

"At one very large retail bank that we interviewed, the CISO had recently completed an RBAC project creating 11,000 roles across the firm to control access to nearly 22,000 applications. Developing the roles took a team two years and the ongoing review process was expected to be significant."

In the real world, access rights are constantly changing, for legitimate reasons: employees are hired and terminated; contractors come and go; service providers and outsource firms require access on a project basis with often unclear timelines; federated identity management systems expand the concept of trusted user beyond the enterprise boundary; departments and whole companies undergo reorganizations; mergers and acquisitions result in major restructurings; layoffs lead to rapid and sometime undocumented role changes; and employees transferring within a company inevitably have to overlap responsibilities (and access) between their old and new jobs. Unclear and imperfect communications between HR, line-of-business (LOB) staff, and IT exacerbate the problem.

Managing Entitlements

Andrew Jaquith, an analyst at Forrester, in his book Security Metrics states:

"Today's information security battleground is all about entitlements-who's got them, whether they were granted properly, and how to enforce them."

Companies large and small employ different approaches to entitlement management, with equal lack of success. Mostly, they do manual reviews of entitlements prior to audits by going through HR records, reviewing application logs, and interviewing LOB managers-a process inevitably referred to as a fire drill. Other approaches to entitlement management include development of custom reports for SEIM and log management systems, network-based user activity monitoring, and RBAC systems.

The management challenge is to determine what's a reasonable target level of excessive access rights in terms of percentage of overall rights granted, and then ensure that solutions are in place to consistently keep actual excessive access rights on or below the target. It's more expensive to establish an excessive access rights target of 2% than of 4%, for example. Therefore, management must determine what level constitutes "enough" security, doesn't break the budget or put an undue burden on IT or line-of-business staff, and yet meets the compliance requirements as measured by auditors. What auditors are looking for is a sustainable, measureable process that demonstrates visibility (can the company detect when and where it has excessive access rights?) and the ability to remediate problems when they occur (can the company eliminate excessive access rights within a reasonable amount of time from their detection?).

Top Audit Findings

As the Deloitte survey reports, current approaches have failed to achieve the desired and necessary level of compliance -- not just for excessive access rights, but for access controls in general.

Figure 3: Top internal and external findings for 2007 and 2008, ranked by percentage of respondents citing findings in each category, taken from the Deloitte survey.

 

Here's an explanation of each of the findings:

Excessive access rights. Note that despite the improvement from 2007, excessive access rights remained the top audit finding in 2008 as noted above. Part of the reason that excessive access rights has been the top finding for the past two years is that auditors have raised the standard, from evidence of the existence of a process to evidence that the process is effective.

Segregation of duties. Segregation of duties, also referred to as separation of duties and abbreviated SoD, is one of the most fundamental concepts of security and control, and also one of the most difficult to achieve.

Access control compliance with procedures. This audit issue is closely related to excessive access rights; access control is required to prevent users without appropriate rights from accessing audited resources.

Lack of audit trails/logging, lack of documentation of controls, and lack of review of audit trails. These three top findings are grouped together because they represent the facet of access audit where technology and process come together. Application logs, which represent the most effective way to determine user access activity, are an essential tool for ensuring that access controls are compliant. And reports that list who has access to what, along with who should have access to what, become critical components of how access controls are documented.

Excessive developers' access to production systems and data. This audit finding is challenging to address, because it's unrealistic in most operating environments to completely block developers from accessing production systems for troubleshooting and critical maintenance operations. The objective, then, is not to prevent such access but to note when it's risen to an "excessive" level.

Lack of clean-up of access rules following a transfer or termination. Few if any organizations effectively manage rights and access rules in a real-world environment with re-org, restructurings, layoffs, role re-definitions and transfers-especially transfers. Because transfers are not a discrete event so much as a process where an employee has overlapping responsibilities between new job and old job-and therefore must maintain access rights for both jobs.

It's clear from the Deloitte survey that access controls are problematic. While organizations are reasonably effective in ensuring that only authorized users may log in to critical resources, they fail to consistently determine which users should be authorized to access those resources. Meanwhile, auditors have learned where to look in order to find users with excessive access rights and other access control violations; hence, an increasingly high rate of audit findings.

Is Perfect Access Control Possible?

The well-known security guru, Bruce Schneier, in a recent article entitled Is Perfect Access Control Possible?, discusses many of these same points and concludes:

"In the end, a perfect access control system just isn't possible; organizations are simply too chaotic for it to work."

Schneier refers to the Dartmouth study's finding that 50-90% of users are over-entitled in large organizations. Over-entitlement leads to risk, and therefore attracts the attention of auditors as explained in the Dartmouth study:

"It may not seem problematic for employees to have access to systems they never use or are unaware of. However, such access introduces risk. The root of the problem is that unnecessary or uncontrolled access can lead to unintended data editing, accidental disclosure, or internal misuse. That is why Sarbanes-Oxley auditors will flag unnecessary access as a weakness."

Auditors have learned in recent years how to find and flag excessive access rights, which is the top cause of audit findings. And not only is audit compliance an issue, but as noted above in the IDC report excess entitlements represent a huge financial liability. Thus, imperfect access controls represent a security vulnerability, a financial liability, and a compliance exposure. Despite these compelling motivations, we find from research by Deloitte, IDC, Forrester, Dartmouth and Bruce Schneier that present-day access controls are largely ineffective, especially in highly dynamic organizations.

What does the future hold for access control? New technologies are on the horizon that, by taking an approach referred to as Identity and Access Assessment (IdAA), enable visibility into the effectiveness of access controls. Such solutions perform data mining to analyze access activity over time and thus identify access control issues for remediation.

Cloud Compliance

Cloud Compliance is developing an IdAA solution to improve the efficacy of compliance solutions and reduce the cost of achieving compliance. We combine the economies of cloud computing with fundamental performance management principles to provide easy, low cost analysis of access rights to prevent audit findings and ensure access control compliance with regulations such as SOX, GLBA, PCI DSS, HIPAA and NERC. Our solution enables customers to identify access audit deficiencies before auditors arrive, and without manual process costs that otherwise dominate. 

Here's how it works: Cloud Compliance employs SaaS-based data mining analytics that examines users' access activity to identify and report on excessive access rights and other access controls. The Cloud Compliance solution can assess your organization's identity and access controls in five simple steps:

1.      Point your browser to the Cloud Compliance SaaS site

2.      Using Cloud Compliance's automatic wizard, select which resources and applications you wish to assess. This is a matter of identifying the SSO system, SIEM, MSSP (if you have a log retention service), or the targeted application servers' log files and entitlements data.

3.      Upload entitlements info and log data to the Cloud Compliance SaaS site.

4.      Review the graphical analytics to determine performance versus benchmarks, and to remediate any policy violations

5.      Repeat steps 3 and 4 periodically. The amount of time between assessments represents the maximum lag time between when a violation occurs and when it's identified.

It's that easy!

Our innovative ability to measure, report and ultimately remediate potential audit findings enables our customers to resolve compliance problems prior to an audit. In addition, Cloud Compliance's graphical analytics highlight trends and identify root causes to compliance issues, by audited application, or by business unit, providing valuable insight into potential security vulnerabilities. Furthermore, due to our global visibility as a cloud-based SaaS solution, we capture statistics industry-wide that our customers can access for setting their own policy benchmarks. Finally, the Cloud Compliance SaaS solution requires no software to install, maintain and operate, no appliances to deploy, no consultants, advisors or professional services to deploy, and no huge upfront capital expense to incur.

For further information, see the Cloud Compliance use case demo at http://www.cloud-compliance.com/product/demo/.

Cloud Compliance Security

As with all cloud-based services, security can be a concern. That's especially true for services that address compliance issues and access vulnerabilities. Cloud Compliance employs the Amazon EC2 (Elastic Compute Cloud) service which has extensive and comprehensive physical and logical controls, including:

§         State of the art intrusion detection systems

§         Authorized staff must pass two-factor authentication at least twice

§         Immediate deprovisioning of admin when no longer has business need

§         Extensive background check of staff with potential access to customer data

§         All admin access logged and audited

§         Network security: DDoS, MITM, and firewall

§         Firewall requires customer's X.509 certificate and key to authorize changes

§         API calls to launch and terminate instances and perform other functions require X.509 certificate

§         S3 (storage) read permissions controlled by ACL

§         S3 authentication using HMAC-SHA1 signatures

§         Storage device decommission based on NIST 800-88 (media sanitation)

§         AWS recurring SAS-70 Type II certification

Cloud Compliance encrypts data in transit as well as data at rest (there's also an option that precludes the need to store any log or entitlement data at all). And it's worthwhile pointing out that the Cloud Compliance solution does not require access to personal identifying information (PII); only a non-sensitive subset of entitlement data and log records are required.

Compliance Made Easy

Cloud Compliance's Identity and Access Assessment service is easy to adopt and provides immediate results. We solve access control issues that go by many names: excessive access rights; least privilege policy violations; excessive privileges; dormant accounts; and excessive entitlements. These access control issues have been identified, studied and reported on by major audit firms such as Deloitte, analysts such as Forrester and IDC, academic research teams such as from Dartmouth, and enterprises around the world. Yet, until Cloud Compliance, there was no effective solution available. Now, with our SaaS-based IdAA, achieving access audit compliance is not only possible -- it's easy.

 

Note: A PDF of this post can be found here.

User Activity Monitoring

In my previous post I wrote about a Gartner recommendation that organizations implement user activity monitoring as part of a strategy to manage external and internal threats, and for regulatory compliance. Gartner suggests integrating Identity and Access Management (IAM) capabilities with a SIEM system to achieve user activity monitoring, but other approaches work as well if not better.

Why is user activity monitoring needed? Since all major regulatory frameworks -- including SOX, PCI DSS, GLBA, and HIPAA -- require least privilege access controls, thousands of companies are obligated to prevent excessive access rights and yet, according to Deloitte, have failed to adequately do so. The reason this is a hard problem has to do with the dynamic nature of the enterprise-especially in an economic downturn -- with layoffs, restructurings, aggressive use of contractors and other service providers, along with the need for federated identity and access management as enterprises collaborate.

Conventional wisdom holds that the best practice for resolving this issue is to adopt an IAM system with role-based access control (RBAC) capabilities. Unfortunately, such systems provide no user activity monitoring or other assessment mechanisms and as a result are notoriously ineffective. While these systems ensure that only authorized users may log in to critical resources, they fail to consistently determine which users should be authorized to access those resources. As a result, as reported by a Dartmouth field study and by IDC, over-entitlement is the norm. In many organizations over 50% of access rights are dormant, representing a huge security vulnerability as well as a significant compliance exposure.

This is where user activity monitoring comes in. Organizations can assess user privileges, or entitlements, through user activity monitoring in order to identify excess entitlements. That few organizations do so is indicated by the high rate of audit findings for such access controls. Two additional methods of implementing user activity monitoring, besides the SIEM+IAM integration suggested by Gartner, are network-based activity monitoring and log-based activity monitoring.

Many organizations collect NetFlow data for IP traffic analysis reasons, and analyze this data for user activity monitoring. While NetFlow shows source and destination IP address and port number, it doesn't show authenticated user names nor application names (applications can in many cases be deduced with destination IP address and port number, but it's practically impossible to link source IP address to user names). NetFlow is therefore inadequate in most cases for tracking user access to audited applications.

Some organizations have adopted a network-based user activity monitoring system which goes beyond NetFlow to record, not just source and destination IP addresses, but authenticated user names and which application was accessed. While far superior to a NetFlow-only approach, network based activity monitoring has several challenges:

• Span port scarcity - span ports are used for a variety of applications, and without a network monitoring system such as one from Gigamon span port availability could be a constraint;
• Span port data loss - most switches are vulnerable to packet loss on their span ports during peak traffic bursts. Even a data loss rate of under 1% can render such a solution inadequate for forensic purposes;
• Application-side scalability - network activity monitoring requires a probe on every ingress span into the application infrastructure;
• User-side scalability - a probe must be placed in every subnet with its own AD or other authorization system, which can make for a very expensive deployment in a distributed environment or one with many remote offices;
• Encryption - as the percentage of encrypted sessions inside the data center increases, it leaves a larger blind spot for network-based approaches;
• Technical challenges with today's DPI silicon in monitoring 10G links - the latest generation network processor with DPI capabilities can monitor 4-5 Gbps, far short of the 20 Gbps required for full-duplex traffic monitoring of a 10G link; and
• No visibility to access from behind the monitored span port - network activity monitoring is blind to local access, e.g. from the application server's console port. It also can't see application-to-application access.

Despite these challenges, enterprises are deploying network-based access activity monitoring system because they otherwise do not have effective solutions for preventing excessive access rights.

An alternate approach to network-based access activity monitoring is log-based user activity monitoring, which does not suffer from the limitations and constraints listed above. Cloud Compliance, for example, reads log files for audited applications in order to prevent excessive access rights and other access audit violations. The log-based approach precludes the need for hardware to be deployed, is scalable, detects 100% of access activity (regardless of encryption, 10G links, and source of access) and, when deployed as a SaaS solution, eliminates the need for installation, software maintenance, and a large upfront capital outlay.

SIEM + IAM = User Activity Monitoring

Gartner, in a report entitled SIEM and IAM Technology Integration, points out that integration of identity and access management (IAM) and security information and event management (SIEM) technologies can provide audit capabilities that are much stronger than what IAM alone can deliver. In short they’re saying that SIEM + IAM = user activity monitoring, and that user activity monitoring is important for both threat management and compliance management.

The top Gartner recommendation in the report is to:

Implement user activity monitoring as part of a strategy to manage external and internal threats and for regulatory compliance.

The report concludes by discussing SIEM customization requirements for integrating with any IAM system.

To summarize the thrust of the report: After collectively spending billions of dollars on SIEM and IAM systems, enterprises are now encouraged to invest further in the integration of these two expensive and complex technologies in order to achieve user activity monitoring. A fancy graphic is included in the report that shows the intersection of change management, activity management, and identity management; the title of the figure is “Moving From Activity Monitoring to Exception Monitoring.”

Of course we want all of our systems to highlight exceptions rather than simply report on activity, and of course we need to understand exceptions in terms of user activity monitoring if we are to eliminate serious vulnerabilities while reducing the top source of audit findings. But do we need to break the bank in order to detect excessive access rights, dormant accounts and other insider risks? Not if we employ an Identity and Access Assessment solution.

Think about it. An enterprise could pay 6 or 7 figures for a SIEM, another 6 or 7 figures for a complete set of IAM technologies, and, if they dare, another 5 or 6 figures for the customization required to integrate the two as Gartner (and their report sponsor) suggest. Of course an enterprise may already have SIEM and IAM systems in place, but customizing SIEMs for purposes of a serious integration project is not for the faint of heart. A better approach for most enterprises would be to pay 4 or 5 figures per year for a SaaS-based Identity and Access Assessment solution to address user activity monitoring exceptions that we all agree are critical to resolve.

Reducing access control vulnerabilities and excess entitlements are critical aspects of an overall security and compliance strategy. Cloud Compliance is developing an Identity and Access Control (IdAA) solution to address key challenges with IAM processes, especially in the area of user activity monitoring. We identify users who have rights they no longer need, and provide tools for isolating high levels of over-entitlement by group, business unit or by application. Such tools enable root cause identification, and provide the necessary insight for remediation and process improvement. Furthermore, due to our global visibility as a cloud-based SaaS solution, we capture statistics industry-wide that our customers can access for setting their own policy benchmarks. Finally, in contrast to role-based access control systems, the Cloud Compliance SaaS solution requires no software to install, maintain and operate, no appliances to deploy, no consultants, advisors or professional services to deploy, and no huge upfront capital expense to incur.

The Four Key Challenges of IAM

I recently ran across an article by Paul Smocer of BITS entitled "The Future of Banking Enterprise Access Management & Authentication" in Security Strategies in which he discusses the four component areas of IAM, and the challenges facing each. Smocer defines the four aspects of IAM as follows:

• Enrollment/Identification -- Assigning a "persona" to employees
• Authentication -- Validating the employee is legitimate
• Provisioning -- Assigning and rescinding "rights" to an employee
• Review/Monitoring -- Ongoing and periodic validation of users and their rights.  

Enrollment/Identification. The largest challenge here is establishing and maintaining a common set of user ID's from disparate systems. In general, the more legacy systems, the larger the challenge. And the challenge grows to the extent the organization has a higher rate of "joiners" and "leavers".

Authentication.The challenges in authentication simply have to do with the diversity of authentication methodologies and structures, which imposes additional resource requirements to manage.

Provisioning. The act of provisioning rights to users to allow access to specific systems' functions seems straightforward enough. The focus in most organizations is on the speed with which rights (also called privileges, or entitlements) can be assigned. Delays impact productivity! But as Smocer points out, deprovisioning rights also presents a challenge:

"An employee who has rights he or she no longer needs presents a threat in terms of data exposure, data loss or fraud."

Some organizations have begun to move to role-based access control (RBAC) processes, but they only work well where the environment is static or large groups have common access requirements. And for dynamic organizations?

"Where there is a diversity of roles and/or a diversity of access requirements, [RBAC] processes often fall short."

So, failure to deprovision rights can present a threat, but the recommended RBAC processes to manage this risk aren't effective where there is a diversity of roles and/or of access requirements. How, then, should such an organization deal with the provisioning challenge? The article doesn't say. But we do know one thing: this must be happening at a large number of organizations, because excessive access rights has been the top audit finding for each of the past two years.

Review/Monitoring. A key challenge in this area is that many provisioning systems require the line of business manager to validate the accuracy of entitlements. This is often a low priority for a busy business manager, who often makes the issue go away by rubber-stamping the current entitlement assignments. Another problem with relying on the user's manager to provision and deprovision rights is that many enterprises have adopted matrix organizational structure where there's no single manager to assess entitlement requirements and integrity as reported by Dartmouth researchers. Better review and monitoring of entitlements is clearly required, due to the known deficiencies of the provisioning processes and underscored by the high rate of audit findings.

What can be done? Cloud Compliance is developing an Identity and Access Control (IdAA) solution to address key challenges with IAM processes, especially in the areas of provisioning and review/monitoring. We identify users who have rights they no longer need, and provide tools for isolating high levels of over-entitlement by group, business unit or by application. Such tools enable root cause identification, and provide the necessary insight for remediation and process improvement. Furthermore, due to our global visibility as a cloud-based SaaS solution, we capture statistics industry-wide that our customers can access for setting their own policy benchmarks. Finally, in contrast to role-based access control systems, the Cloud Compliance SaaS solution requires no software to install, maintain and operate, no appliances to deploy, no consultants, advisors or professional services to deploy, and no huge upfront capital expense to incur.

Insider Risk: Now More Than Ever

It should come as no surprise that the current economic climate has increased the risk of fraud from insiders. But the degree to which the insider threat problem has increased is a surprise, as described in a Dark Reading article Bankers Gone Bad: Financial Crisis Making The Threat Worse. According to a new survey by Actimize, nearly 80 percent of financial institutions worldwide say the insider threat problem has increased in the wake of the economic downturn. Only 28 percent of financial institutions had not suffered an insider breach in the past 12 months (not including the breaches we don't yet know about).

How do insiders commit fraud? The profile of the bank fraudster that typically commits these crimes is a trusted, full-time employee, one who is well-versed in its operations and how to circumvent them and remain under the radar. And a favorite method is to use a dormant account resulting from excessive user entitlements:

"Some security measures for limiting user access to sensitive data, such as minimizing user privileges, don't apply cleanly for banks... The best thing they can do is proactively monitor and look for signs that user entitlements aren't being abused."

If looking for signs that user entitlements aren't being abused was possible, everyone would do it, right? Well, it has to be cheap, too: according to the survey, the biggest single challenge to meeting the threat is the cost of doing so.

In the past 12 months, 70 percent of financial institutions say they have experienced a case of data theft by one of their employees. Nearly half of the banks in the Actimize survey say they are losing 1% to 4% -- four percent! -- of their total revenues to insider fraud. With that as incentive, the most plausible explanation for failing to prevent fraud resulting from excessive user entitlements is that banks don't know how. What they do know is that perfect access control isn't possible, and that Identity Management (IdM) systems combined with manual reviews still fails to identify many excessive entitlements.

And they also know that excessive entitlements (also known as excessive access rights) was the top audit finding for the past two years.

Cloud Compliance is developing an Identity and Access Assessment (IdAA) solution to manage entitlements (also called privileges, or access rights). We identify users with excess entitlements, and provide tools for isolating high levels of over-entitlement by group, business unit or by application. Such tools enable root cause identification, and provide the necessary insight for remediation and process improvement. Furthermore, due to our global visibility as a cloud-based SaaS solution, we capture statistics industry-wide that our customers can access for setting their own policy benchmarks. Finally, the Cloud Compliance SaaS solution requires no software to install, maintain and operate, no appliances to deploy, no consultants, advisors or professional services to deploy, and no huge upfront capital expense to incur.

Field Study: Entitlements, Privileges and Information Risk

I came across a paper written by a team at Dartmouth (hat tip to Bruce Schneier) that describes observations from field study research of both retail and investment banks. The study was more in-depth than most surveys we hear about; for example, the study team was embedded for 3 weeks in the security group of an investment bank. The report focuses primarily on internal access controls and the risks of over-entitlement - a topic we've delved into on many occasions including here and here.

Due to the dynamic nature of large banks - and many other organizations - it is quite common for people to move between internal organizations and be transferred across information boundaries.

The frequent shifting of staff may result in information users collecting system entitlements over time if the system access is not actively managed, resulting in a toxic combination of privileges.

We knew about the gradual accumulation of entitlements over time. But a toxic combination of privileges? What's that?

A toxic combination is a conflict of system access that allows a user to break the law, violate rules of ethics, damage customers' trust, or even create the appearance of impropriety.

How did we get from over-entitlements to toxic combinations?

Part of the problem is this: Entitlement management systems assume that an employee's direct supervisor can make informed decisions about what entitlements are required to do their job. But as the Dartmouth team points out

As more organizations take on a matrix structure, it becomes less evident who reports to whom and who is responsible for permitting and terminating data access.

This leads to ambiguous and unwieldy structures for assigning entitlements, or privileges, as shown in Figure 1:

And even if the corporate structure and reporting relationship is clear in all cases, the degree of scale and complexity makes entitlement management a big problem as shown in Figure 2: 

 

The biggest challenge isn't the massive number of entitlements and users, however, but the highly dynamic nature of employees and organizational structure within the firm.

Conventional wisdom holds that role-based access control (RBAC) systems are the answer. By allowing organizations to segregate the massive numbers of employees and entitlements into work groups, RBAC systems make the entitlement management process easier to manage. But the size, complexity and dynamic nature of many large enterprises make role-based access control challenging, to say the least:

At one very large retail bank that we interviewed, the CISO had recently completed an RBAC project creating 11,000 roles across the firm to control access to nearly 22,000 applications. Developing the roles took a team two years and the ongoing review process was expected to be significant.

We explored in an earlier post whether perfect access control was possible. Unfortunately, the answer is no. So if over-entitlement is the norm, leading to toxic combinations of privileges or entitlements, and access control systems - which are so costly to deploy and manage - aren't able to fully solve the problem, then what's an organization to do? Especially an organization that is highly regulated by SOX, FFIEC and FINRA?

Cloud Compliance is developing an Identity and Access Control (IdAA) solution to manage entitlements (also called privileges, or access rights). We identify users with excess entitlements, and provide tools for isolating high levels of over-entitlement by group, business unit or by application. Such tools enable root cause identification, and provide the necessary insight for remediation and process improvement. Furthermore, due to our global visibility as a cloud-based SaaS solution, we capture statistics industry-wide that our customers can access for setting their own policy benchmarks. Finally, in contrast to role-based access control systems, the Cloud Compliance SaaS solution requires no software to install, maintain and operate, no appliances to deploy, no consultants, advisors or professional services to deploy, and no huge upfront capital expense to incur.

Is Perfect Access Control Possible?

Bruce Schneier, the Chief Security Technology Officer of BT and a highly regarded security guru, engaged in a point/counter-point debate with Marcus Ranum in an Information Security Magazine article entitled Schneier-Ranum Face-Off: Is Perfect Access Control Possible?

The question is particularly relevant today, especially in light of the fact that, as I've reported here and here, excessive access rights were the top audit finding over the past two years. Why is that? The general consensus is that organizations should implement a role-based access control (RBAC) system to manage entitlements. But as Schneier points out:

RBAC is very hard to implement correctly. Organizations generally don't even know who has what role. The employee doesn't know, the boss doesn't know--and these days the employee might have more than one boss -- and senior management certainly doesn't know.

Ranum seems to argue that at least part of the problem is that we're paying for decisions made over the past decade to make critical data easier to access and where it can be managed more cheaply, and that many of these decisions were incompetent and negligent.

What both Schneier and Ranum agree on is that over-entitlement is the norm today, and these excess entitlements -- also called excessive access rights -- represent a security and compliance exposure.

So where does that leave us? Based on what I've seen and the customers I've spoken to, I have to agree with Schneier's assessment:

In the end, a perfect access control system just isn't possible; organizations are simply too chaotic for it to work.

If RBAC systems are so hard to implement correctly, and even if doing so still leaves the organization with excessive access rights and their associated risks and vulnerabilities, what can be done? As I've suggested in my prior post, user activity monitoring in the form of an Identity and Access Control solution can complement RBAC identity management systems by providing feedback that uncovers excess entitlement in the form of dormant (aka zombie) accounts. Therefore, even if RBAC is very hard to implement correctly, and a perfect access control system just isn't possible, at least the organization can gain visibility into and remove the vulnerabilities and compliance exposure associated with excessive access rights.

Cloud Compliance is developing an Identity and Access Control (IdAA) solution as referred to above. We identify dormant accounts, and provide tools for isolating high rates of dormancy by group, business unit or by application. Such tools enable root cause identification, and provide the necessary insight for remediation and process improvement. Furthermore, due to our global visibility as a cloud-based SaaS solution, we capture statistics industry-wide that our customers can access for setting their own policy benchmarks. Finally, in contrast to software-based IdM solutions, the Cloud Compliance SaaS solution requires no software to install, maintain and operate, no appliances to deploy, no consultants, advisors or professional services to deploy, and no huge upfront capital expense to incur.

Identity and Access Assessment

Deloitte reports that excessive access rights was the top audit finding for the most recent two years surveyed. Not only is it the top audit finding, but IDC states that excessive access rights result in the biggest financial exposure for organizations—and up to 60% of rights on most systems are expired and therefore dormant. The problem is that IT and security staff at most companies don’t know that this condition exists—or more precisely, they suspect it exists but don’t know where.

Compounding the problem for these companies is that auditors have in recent years learned that by spot-checking recent transfers and terminations, they are more than likely to uncover excessive access rights. This has contributed to the high rate of audit findings in recent years.

Conventional wisdom holds that the solution to this issue is better Identity Management (IdM) systems with role-based access control (RBAC) capabilities and a user interface that can be understood by line-of-business managers, who could then be counted on to keep access rights current and accurate. Unfortunately LOB managers are often reluctant partners in this enterprise; the path of least resistance for them is to keep existing rights when in doubt. And the high rate of audit findings suggests the weakness of this approach.

Whether companies have an IdM system or not, they most likely prepare for audits by manually analyzing HR records and job descriptions in conjunction with role definitions and entitlements. This quarterly or annual process is invariably referred to by customers as a fire drill. In many cases, contractors or temp workers are brought in for this task—adding to the expense but rarely improving the outcome as measured by audit findings.

In the real world, access rights or entitlements are constantly changing, for legitimate reasons: employees are hired and terminated; contractors come and go; service providers and outsource firms require access on a project basis with often unclear timelines; federated identity management systems expand the concept of trusted user beyond the enterprise boundary; departments and whole companies undergo reorganizations; mergers and acquisitions result in major restructurings; layoffs lead to rapid and sometime undocumented role changes; and employees transferring within a company inevitably have to overlap responsibilities (and access) between their old and new jobs. Unclear and imperfect communications between HR, line-of-business staff, and IT exacerbate the problem.

There is no perfect IdM system and there’s no foolproof rights management process. Since the systems and processes for managing rights inevitably fall short of 100% accuracy, some kind of feedback or assessment mechanism is required to achieve least privilege objectives and improve IT audit performance. That’s why Cloud Compliance is developing the industry’s first Identity and Access Assessment (IdAA) system—to provide feedback that identifies, reports on and helps remediate excessive access rights and other access audit issues.

Cloud Compliance will address the IdAA challenge with a unique, innovative SaaS solution. Our cloud-based analytics assesses log-based access activity for selected applications, typically those that are audited or that access sensitive data such as personal identifying information (PII). We identify dormant (aka zombie) accounts, and provide tools for isolating high rates of dormancy by group, business unit or by application. Such tools enable root cause identification, and provide the necessary insight for remediation and process improvement. Furthermore, due to our global visibility as a multi-tenant SaaS solution, we capture statistics industry-wide that our customers can access for setting their own policy benchmarks. Finally, in contrast to software-based IdM solutions, the Cloud Compliance SaaS solution requires no software to install, maintain and operate, no appliances to deploy, no consultants,  advisors or professional services to deploy, and no huge upfront capital expense to incur.

Ronald Reagan famously said “Trust, but verify”.  Many IdM systems are trusted to maintain entitlement and access rights.  But the systems themselves rarely have verification capabilities.  They would benefit greatly from an Identity and Access Assessment solution that provided verification, and in doing so improved audit performance and regulatory compliance.

Visualizing Security Metrics

This is the third and final post in my series discussing Security Metrics: Replacing Fear, Uncertainty and Doubt by Andrew Jaquith. As I noted, Jaquith makes some intriguing and vital points about the need for "good" metrics and "serious analytic scrutiny" to inform executive decision-making on issues of security, compliance, and risk governance. This is an especially important topic today, with organizations everywhere trying to figure out how to stay secure and improve compliance while cutting their expense budget.

Most organizations, when considering appropriate investment levels to deal with risk, are not lacking for data. But lots of data does not equate to relevant information required for sound decision-making. Jaquith's point is that information in the form of metrics -- good metrics, which he defines -- is lacking in many enterprises.

But once good metrics have been defined, how are they communicated to stakeholders? Jaquith dedicates an entire chapter to visualization. He starts by listing his six design principles for visualization of metrics:

1. It is about the data, not the design (resist urges to "dress up" the data)
2. Just say no to three-dimensional graphics and cutesy chart junk (it obscures your data)
3. Don't go off to meet the wizard (or talking paperclips)
4. Erase, erase, erase (removing tick marks and grid lines results in a crisp chart with few distracting lines)
5. Reconsider Technicolor (default colors are far too saturated, and should be muted. Consider a monochromatic palette)
6. Label honestly and without contortions (pick a meaningful title, label units of measure, don't abbreviate to the point where the meaning is not clear)

Like me, Jaquith is an admirer of Edward Tufte, author of several books about information visualization including the classic The Visual Display of Quantitative Information (1983, Cheshire, CT: Graphics Press). According to Tufte, a key to effective visual displays is understanding the goal of your presentation. In Tufte's own words:

At the heart of quantitative reasoning is a single question: Compared to what? Small multiple designs, multivariate and data bountiful, answer directly by visually enforcing comparisons of changes, of the differences among objects, of the scope of alternatives. For a wide range of problems in data presentation, small multiples are the best design solution.

Hence, we have small multiples as a visualization strategy. Here's an example:

From this display, one can look at different categories (in this case, departments) to view comparative performance over time. Once can readily imagine security/compliance applications for this approach, such as dormant accounts by resource, or excessive access rights by department.

In his book Beautiful Evidence (2006, Cheshire, CT: Graphics Press) Tufte introduces a refinement to this concept called the sparkline, which he defines as "small, intense, simple datawords". The example Tufte uses to explain the sparkline concept is a patient's medical data, taken from Beautiful Evidence:

Besides Tufte's small multiples and sparklines, Jaquith's visualization suggestions include indexed and quartile time series charts, bivariate charts, period-share charts, treemaps, and Pareto charts. The key point is that there's not a single graphic approach that works in all cases; one needs to determine the essence of what is being conveyed. The audience almost always consists of busy people, often executives, who need to have information presented clearly and in context. It doesn't do anyone any good to be able to point out after a security event that the "smoking gun" data had been seen, but it was either lost in the noise of too much data, or its significance was not clear.

P.S. It's not necessarily relevant to this post, but my favorite graphical display of quantitative information is an advertisement for one of Tufte's books that regularly appears in Scientific American and The Economist: