Published: August 31 2009, 10:52 AM | 1 Comment(s)
by Matthew Gardiner

There has been a tremendous amount of chatter and yes even some hype regarding the need and potential for providing identity and access management (IAM) related services to organizations via SaaS delivery.  To me the hype here is getting quite out of control and is in great need of more realism, which I aim to provide here. 

I have a lot more to say on this topic then I can possibly fit into a single blog.  But, I am hardly the only person out there saying "hold on there a moment" regarding this topic.  I recently read a great presentation given by Robert DeSisto of Gartner entitled "Software as a Service:  Uncertainties Revealed" which had a lot of salient points.  Also Ian Yip has some good blogs on the topic as well.

 The summary of my position is that there is no magic when it comes to identity services.  If you hear an argument that goes something like this - "Organizations have complex and expensive identity and access management processes that are expensive and difficult to resolve with on-premises IAM software.  If they placed these processes into the hands of an identity SaaS provider, costs go way down, security is improved, and compliance is made easier" - be wary.  This massively understates the issue.

Why is reality more complicated?

• There is a huge difference between IT applications and IT infrastructure. Narrowly focused applications that are delivered via Web front-ends are great candidates for SaaS delivery as integration back into the enterprise tends to be more manageable. But IT infrastructure or middleware services, such as IAM, are a very different story. Infrastructure by its very definition must be appropriately integrated into the enterprise premises and processes. Moving that infrastructure off-premise makes the integration problem harder, not easier.
• IT organizations will be hybrid, using a mix of on-and off-premise applications, for as far as the "eye can see". I blogged on the hybrid issue previously. This hybrid issue greatly affects the potential for identity services, as on-premise applications cannot have their IAM activities ignored in favor of identities in the cloud. Enterprises must be able to handle both effectively. In my opinion managing identities in SaaS-based applications via on-premise identity software is much easier than the converse.
• You can outsource services, but you cannot outsource compliance responsibilities. You think it is painful complying with audits with on-premise software, imagine doing the same thing with off-premise software.
• IAM deployments are complex because IT systems and processes in essentially all organizations are complex. Organizations cannot outsource their "spaghetti" and expect better results. In fact, I argue that IT services can't effectively be outsourced until they have been internally outsourced (abstracted) first. Identity services and IAM systems are a great example of this.
• Vendor viability is an even bigger issue with SaaS-provided services than it is with on-premise software. If a traditional software vendor goes belly-up, at least the software keeps running and the customer can make transition plans. When a SaaS provider goes under things could move much faster - as in here today -gone tomorrow.
• Trust - Security is largely about creating and enforcing trust. It you outsource your security systems and practices you must trust your SaaS provider as much or more than you trust your own organization.

I could continue with this list, but I will stop to clarify one thing:   I am not saying that there is no aspect of identity management that can be outsourced or "Saas-ified."  There is definitely an opportunity for certain aspects of IAM to be provided by third-parties such as identity proofing, identity provider for hire, real-time risk assessments, and others.  And perhaps even broader IAM services can be provided to small organizations of maybe 500 to 1000 employees or less that already have a high percentage of applications provided via SaaS delivery.  But a move to SaaS-based Identity Services certainly won't happen quickly with all the hurdles and issues that need resolved by a company offering to provide them.

Published: August 31 2009, 05:25 AM | no comments
by CA GRC Blog Admin

While we may not be ready to give up on summer just yet, the fall conference circuit is getting underway this week with the 2nd Annual Effective SOX & MAR Strategies in the Re/Insurance Industry Conference hosted by Marcus Evans in Boston. The event runs Monday, August 31st through Tuesday, September 1st and hones in on key strategies for managing SOX and Model Audit Rule (MAR) compliance, particularly for those in the insurance industry.

According to the event organizers, the Model Audit Rule (MAR) is quickly coming to fruition and compliance will be in full effect in 2010. The MAR presents unique challenges that must be discussed from all angles, both for non-SOX companies and those that are looking to evolve their SOX strategies into full MAR implementation. This conference will bring together SOX/MAR professionals from re/insurance to discuss these pressing issues.

CA will be co-presenting a special evening workshop tonight (Monday, Aug. 31) with PwC covering "How Insurers are Successfully Using GRC to Build Effective Model Audit Rule Programs." The session runs from 5:30-6:30 pm ET, and will include at least 30 minutes dedicated to Q&A and networking. Attendees will walk away from the session with:

• An understanding of what public insurers are doing to prepare for MAR


• The ability to define the scope of compliance, and how insurers are re-scoping their efforts


• Models for compliance that have been successful, including AS5 and risk-based approaches


• How to link internal controls to integrated GRC programs


• Pitfalls to avoid

In addition, Peter Stapleton, a regular contributor to the blog, will be leading a short session on Tuesday, Sept. 1, starting at 11:45 am ET, focused on "Leveraging a GRC Strategy to Manage Multiple Compliance Programs."

Peter will be touching on Lean GRC best practices, as well as:

• The challenges of multi-regulation compliance


• How standards and a program approach to compliance can help


• Lean thinking applies in many areas to GRC, and can help reduce costs and wasted efforts

If you plan to attend the event, make sure to say hello to the team at our booth on site, where you can also view a demo and learn more about managing MAR and SOX compliance with GRC.

Published: August 28 2009, 06:55 AM | no comments
by Chris Palmer

Information Governance, Information Assurance, and Digital Continuity seem to be taking over from records management and archives in the blogosphere just as electronic documents have taken over from paper, but are they of any greater substance or is it again the availability of new formats prompting a re-invention of original (and well tried) principles?

The UK National Archives is overseeing the development of a Digital Continuity Framework for national, local and quasi-governmental organisations which will likely be adopted by many others with a concern for the long-term preservation of their digital information. However, they are taking a very mechanistic view with little mention of records management principles to identify what is vital information or of Information Assurance to prevent loss of that information. Can one really be divorced from the others?

If an organisation is to put much effort, over so long a period of time, into storing, updating and reviewing its information, surely it makes sense to do that only for that information which has value, either directly for the organisation itself, or for the wider community, from a historical point-of-view? To do it for every scrap of data the organisation has ever accumulated is surely not feasible, nor worthwhile. That's where records management comes in!

Equally, if that long-term archive is not secure, either from external penetration (for spoliation or theft) and from accidental or deliberate malicious distribution, then you don't need to store it as it will probably be available on the internet for anyone to read, anyway! That's where Information Assurance (aka Data Loss Protection) comes in!

Together, as Information Governance, and overlaying a resilient and recoverable infrastructure, the organisation could look forward to long-term digital continuity, as well as having access to records in other formats, too!

Published: August 26 2009, 03:27 PM | no comments
by Matthew Gardiner

CA and Microsoft just completed a collaborative project in which CA SiteMinder and CA Federation Manager and Microsoft's Geneva (primarily Active Directory Federation Services 2.0) worked together in three federated security scenarios.  To get the particulars of what was tested; check out the joint Microsoft and CA white paper.  This is the next logical step in our security oriented collaboration with Microsoft and shows that Microsoft is delivering on its commitment to support SAML, which I blogged about last November.

To give you a better idea of the interoperability scenarios that are covered in this paper I will give you a quick summary here.

• Case 1 - AD FS 2.0 acted as the identity provider and CA Federation Manager, in conjunction with CA SiteMinder, protected the relying party.
• Case 2 - The roles were swapped, with CA Federation Manager operating at the identity provider and AD FS 2.0 and Windows Identity Foundation for Access Control providing security at the relying party.
• Case 3 - CA SiteMinder and CA Federation Manager protected access to a Windows Identity Foundation based application.

Why is this important?  One takeaway is that organizations with IT infrastructures from both CA and Microsoft can invest with the confidence that CA's Web security solutions will continue to complement and provide security services for the Microsoft security components and development platforms, both now and into the future.

The conclusion of the paper says it best: "By enabling identity federation, as well as the mixing and matching of solution technologies in innovative new configurations, CA and Microsoft are enabling customers to maximize the value of their IT investments."

Published: August 26 2009, 08:01 AM | no comments
by Reed Irvin