CA Community






This Blog
Syndication

May 2011 - Posts

Security at CA Technologies = Identity and Access Management

Published: May 16 2011, 10:07 AM | no comments
by Michael Denning

This is my first blog post to the Security Management blog since I joined CA Technologies at the end of November 2010 as the General Manager for the Security business focused on Identity and Access Management (IAM). I'll do my best to make sure it's not the only blog I ever post.

Although those of you who monitor this blog know our business - Identity and Access Management - I feel compelled to affirm our commitment to the IAM business given the recently announced agreement to divest the area of security that focuses on anti-virus, anti-spyware, gateway security, and host-based intrusion prevention to Updata Partners.

CA Technologies remains deeply committed to the Security business focused on IAM and to the continued development of our solutions for:

This is a key market for CA Technologies that underlies our growth strategy and is delivering value for our customers, whether the technology is deployed on their premises or as a cloud service.

When I joined the company last November, I knew I was joining a leader in the IAM market. We have made strategic investments over the last 2 ½ years with four acquisitions and an internal development program that delivered new solutions that support virtualization security. Our investments have allowed us to expand our IAM portfolio enabling us to take identity and access management to the next generation where we not only control users and their access, but we also control what they can do with the information.

Our commitment to the IAM market extends into our work with industry standards and guidance as evidenced in our involvement with NSTIC, OIX, Kantara, OASIS, and others.

So if anyone had doubts about our continued commitment to Identity and Access Management, please direct them my way. We are very excited about some of the things we have on the horizon for IAM and look forward to sharing them all with you in this forum. 

Share this post:  
Tags: ,
Leave a comment

 

By: Michael Denning
Mike Denning leads the Identity and Access Management business at CA Technologies. He is responsible for ensuring the company’s products, services and partnerships help customers minimize risk, boost compliance and confidently adopt virtualization technologies and cloud services by controlling users...
Read More..

With the Emergence of the Online Identity Verification Marketplace – Who Should Pay?

Published: May 09 2011, 01:36 PM | 4 Comment(s)
by Matthew Gardiner

In a number of recent blogs I have discussed the emergence of an online identity verification marketplace -- most recently in a blog about the just completed NSTIC launch. Of course the emergence of the marketplace depends on someone paying for the services received. No payment, no marketplace. So who should pay for identity services in this new marketplace? Today, at least online, organizations and individuals aren't used to paying for this type of service, so it is an area that all participants need to come to terms with for this marketplace really to take off.

Let's first review the parties that are involved in such a marketplace so that we can better consider the question of who should pay. First there is the user, for whom ultimately all these enabling security services are provided. Next there are the identity providers and attribute providers (may or may not be the same entity) who provide the identity verification services as well as verified attributes (age, address, citizenship, professional credentials etc.) about the user.  And finally there is the relying party or service provider - the entity with the application(s) that the user would like to use. 

So who should pay for these identity verification services, the user or the relying party? As an aside, I recognize that some identity providers are willing to provide their services without a direct cash payment, but in these cases I would argue that they must be receiving value in some indirect way from someone. However for a broad and deep market to occur actual cash payments will need to be part of the equation for most situations.

While there is logic which supports both the user and relying party paying, there are also some challenges for each actually doing so. While of course the identity verification service is being conducted ultimately to enable the user to get access to sensitive applications, the users often don't bear the direct cost of poor identity verification and thus may not feel compelled to pay for a better solution. While there is precedence in the offline world of users having to pay for their identity to be verified - national IDs, passports, and notary services - this hasn't yet translated into the online world. My view is that for very specialized services, such as for professional verification - a radiologist licensed to practice in Massachusetts - users might be willing to pay, but for general, mass-consumer uses, I think users will expect someone else to pay on their behalf.

This brings me to the relying parties. I believe they are the entity that is best positioned to pay for using an outsourced identity verification service. After all without such a service it is up to the relying parties to conduct identity verification on their own, thus any rational entity should be willing to pay a little bit to avoid a larger cost. This is even without considering the potential cost savings that result from reduced online fraud that comes with more rigorous verification that specialized providers could likely provide. So why aren't relying parties rushing forward to identity providers with cash in hand? I believe one factor is that many relying parties don't fully recognize the cost that they currently bear for the identity verification steps that they conduct today themselves. These costs are largely buried inside other process costs, such as account opening costs or the opportunity cost of not having an online relationship at all with a user. 

For this marketplace to thrive it is important that all participants shine the light on the current costs of online identity management and how a marketplace for identity verification could help reduce them for everyone.   

Share this post:  
Tags: , , , ,
Leave a comment

 

By: Matthew Gardiner
Matthew Gardiner is a Director working in the Security business unit at CA Technologies. He is a recognized industry leader in the security & Identity and Access Management (IAM) markets worldwide. He is published, blogs, and is interviewed regularly in leading industry media on a wide range of IAM...
Read More..

Attending the Kuppinger Cole European Identity Conference

Published: May 06 2011, 04:28 AM | no comments
by Tim Dunn

On the 10th through the 13th of May I will be attending the Kuppinger Cole European Identity Conference  where CA Technologies are a Premier Sponsors. I love the fact that the Kuppinger Cole also runs the Cloud 2011 conference in conjunction with the Identity event. It means that the content and debates covered at the conference make it a key event for anyone considering the topic of cloud or Identity and Access Management. On Tuesday the 10th May, my colleague Henk Van Der Heijden will present a key note session on the topic of risk based authentication and access control. On Wednesday 11th May, I will chair a panel discussion on the subject Business Driven Security for SAP Environments. The panel will consist of senior thought leaders from SAP, Daimler, Accenture and KPMG. Matthew Gardiner , who is the President of the Kantara initiative  will have a couple of sessions at the event. Matthew’s deep knowledge of Identity frameworks and Standards mean his talks are always valuable. The industry is making great progress in terms of defining and implementing robust Cloud Security Models. I gave a Keynote session at last year’s event regarding the state of the Identity and Access Management for the cloud. I look forward to seeing how we have moved forward since then.  

 

Share this post:  
Leave a comment

 

By: Tim Dunn
Tim Dunn has spent 13 of his 23-year career in Enterprise software focused on the security market in EMEA. Tim is currently responsible for the strategy and go to market approach for CA Technologies security solutions, ensuring that CA continually evolves technologies which meet customer requirements...
Read More..

PKI Still Matters

Published: May 05 2011, 11:56 AM | no comments
by Merritt Maxim

Infosec veterans probably remember (with a smirk) how Public Key Infrastructure (PKI) was heralded as the next "big thing" in information security at the dawn of the 21st century. As often happens with technology, the reality did not live up the hype and PKI never experienced a level of success equivalent to its hype. For me, I knew PKI was in trouble when it became increasingly common for people to refer to it as a "PKI Infrastructure" proof that many did not even know what the acronym stood for!

While PKI may have under-achieved, certain PKI components are still extremely important.  One of these is key management. In fact, the Diffie-Hellman key exchange protocol which basically created PKI was created to solve the serious technical challenge of exchanging a private key over an insecure channel.

As with many security technologies, key management often goes unnoticed for extended periods of time and only surfaces when someone experiences a problem. And when these problems appear, key management is either the solution or the culprit. In the latter case, key management is generally the culprit because of an improper implementation.

And we continue to digest the unfortunate steady stream of data breaches from the Comodo SSL certificate breach, the RSA Security Advanced Persistent Threat attack, the Epsilon Interactive data breach and the Texas State Comptroller data breach, a common refrain is that data encryption is the solution to these types of problems. While data encryption is certainly a good security best practice, especially for sensitive data of PII, effective key management must accompany any encryption effort to realize maximum protection. 

Much like the Germans flanking the Maginot Line in 1940 to avoid the line's major defenses, today's sophisticated hackers are more likely to attack the key management systems rather than try to brute force attack an encrypted file. And most organizations lack a centralized comprehensive key management system, which leads to inconsistencies and manual processes that are prone to error. A centralized key management solution should deal with the three ‘R's-Renewal, Revocation and Recovery among other things. Just throwing encryption at a problem especially after a breach is not a magic panacea -- it must be deployed within the context of a broader key management system. Key management is necessary to solve problems such as:

  • Volume of keys. In a peer to peer model, using freeware like PGP may work, but when you are an organization with thousands of users, you need centralized key management. Just like organizations need to revoke privileges and entitlements when a user leaves the organization, you need to do the same with cryptographic keys. This can only be achieved by central key management and would crumble in a peer to peer model.
  • Archiving and Data Recovery. Data retention policies vary by regulation and policy, but anywhere from three to 10 years is common. If archived data is encrypted, key management is necessary to ensure that the data can be recovered and decrypted in the future if needed as part of an investigation.

Key management is not going away. As cloud computing adoption grows, key management is going to become even more crucial especially around data storage in the cloud. The recent issues with online storage provider Dropbox prove that encryption and key management are already becoming an issue in the cloud so organizations should make sure as they utilize more data encryption that they have a key management strategy in place to support these data encryption effort.

A great example of what happens with an ineffective key management implementation is the case of convictd spy John Walker who managed cryptographic keys for US Naval communications. Walker copied the keys and gave them to the USSR for cash. There are several books on the Walker case, but I recommend this one.

Share this post:  
Tags: , , ,
Leave a comment

 

By: Merritt Maxim
Merritt Maxim has 15 years of product management and product marketing experience in the information security industry, including stints at RSA Security, Netegrity and CA Technologies. In his current role at CA Technologies, Merritt handles product marketing for CA's identity management and cloud...
Read More..

More Posts