Identity & Access Governance hits the Big Time!!!

Combining Oracle+Sun IdM & GRC 

products with cutting edge partners

like Simeio Solutions, 

Identity and Access Governance 

are center stage in IdM today.

“Whenever the people are well-informed, they can be trusted with their own [governance].”  - Thomas Jefferson

Even back in his day Thomas Jefferson noted that good government, like good governance, was ability being informed and more and more these days Enterprises are looking to their IT resources to not only enable business functions but to provide greater visibility into those functions/applications.  Through Oracle’s applications and the expertise of partners like Simeio Solutions, Oracle is helping deliver this visibility for Identity and Access Governance.

So, who is Simeio?

• Leaders with IAM and Role Management deployments
• Reach:  Global Customer Base with a presence in NY, LA, Atlanta, Dallas, Canada, Australia, and India Canada (2008), ASPAC (Established in Sydney and Mumbai , 2009), EMEA (2010 Planned, UK Q1)
• Focus: Solving critical business needs through IAM, ITGRC and Cloud Computing Fortune 100-1000 as reference-able clients
• Biz/Tech Capabilities:  Simeio has experienced resources able to deliver IAM and IT-GRC consulting projects based on the following areas Simeio has developed quick-start assessment and rapid deployment models allowing for shortened project delivery timelines using both fixed fee and time and materials based contracts; resources across the company, multiple trained across Oracle’s security portfolio (User Provisioning, Role Management and Compliance)
• Services Capabilities:  Simeio has a diversified set of services to differentiate from our competition and be seen as a leader in Identity and Access Management and IT-GRC; Simeio meets with industry analysts (Burton, Gartner, Forrester) on a regular basis to keep a pulse on industry trends and ensure our services align with customer needs; Simeio meets with vendor Product Engineering and Management on a monthly basis
• Value: Strong team that has a reference-able base of customers for Simeio to discuss Oracle Identity Management; Up-sell Oracle Identity and Access Governance suite to existing and new customers
• Strong position in the market with deep understanding on Identity, Role and Compliance Management
• Allows for Oracle to have a dedicated team to go into Oracle accounts and discuss and implement these solutions as a replacement to other role management and identity products and continue to expand Oracle’s footprint within the account

Where do they come from?

• Enterprise Software Experience: Collective team comes from the Vaau (prior to acquisition by Sun)
• Deployment Experience: 90% or more of Sun Role Manage (“SRM”), now Oracle Identity Analytics (“OIA”) deployments done by Simeio
• Migration Experience: Provide a deployment /migration path from other Role Management & Identity solutions to Oracle IdM; example Sun Identity Manager (“SIM”) to Oracle Identity Manager (“OIM”)
• Competitive Experience: Knowledge and experience has led to key wins against competitors such as Aveksa, SailPoint & CA
• Field Experience: Work with field and development around POC’s and beta testing
• Product Experience:  Simeio Developed SRM 5.0 Documentation and was an integral part of the SRM 5.0 release
• Unique IP: Simeio Solutions has Intellectual Property around integrating and fast tracking deployments of SIM/OIM: Packaged 2 step approval workflow built for quick deployment; Package for quick integration between SIM-SRM and OIM-SRM; Packaged custom reports providing immediate business value; Expertise in developing custom connectors for home-grown applications
• Unique Approach: Skilled resources out of our center of excellence for custom development; “zero-day” rule based provisioning solution; Quick ROI and value to the business; 7 day manual process reduced to 5 minute automated provisioning

How do they help with IdM Governance?

• To borrow a phrase, they have their own dog in this hunt: Simeio Solutions Intellectual Property such as DirectAXs  and offer services in the cloud for Provisioning, Single Sign-on and Access Request
• Compliance & Role Management:  Simeio Solutions Intellectual Property around integrating and fast tracking deployments of SRM; best practices SoD library; plus 160 Business Rules and thousands of technical rules
• Well Published: Authored multiple independent white papers published in Role and Compliance Management
• Well Respected:  Already published in several technology analyst papers
• Role Management for the Enterprise (RME) & GRC:  Best of breed practices for IT-GRC consulting projects Simeio is currently seen as the leader with the most Sun Role Manager deployments Simeio has developed quick start packages and delivered numerous projects with both Sun and Oracle Identity Solutions Simeio has reference-able deployments to Fortune 100-1000 clients

What exactly do they offer On Demand?

• ROMAXs - Role Engineering, Role Management
• ICOMAXs - Access Re-Certification, Identity Auditing
• GRCAXs - Policy Management, Controls Testing, Risk Assessment
• IAMAXs - User Provisioning, Self Service
• SSOAXs - Web Single Sign-On, Federation, Web Access Control, and Role Mining/Management

The alternative to flexible infrastructure that allows dynamic access to business resources BUT gives visibility is protection through limiting access:

“The best government is a benevolent tyranny tempered by an occasional assassination.” – Voltaire

While this might have worked for Voltaire most modern Enterprises are looking for IT infrastructure that enables business innovation and growth; Oracle and its partners like Simeio are poised to deliver this.

Identity Management as an Appliance by AegisUSA

In light of the Oracle/Sun acquisition closing today, AegisUSA existing solution demonstrates the power of Sun/Oracle Identity Management delivered as a hardware appliance.

Who is AegisUSA?

• IAM solution provider
• Over 60 clients nationwide
• Created IAM IP over last 5 years
• Built IAM products focused on specific solutions
• Market focus
• Mid Market
• Higher Ed
• Healthcare
• State and Local Government

What is the challenge with the traditional approach?

• Small Identity Customer = $500K Project
• $50-150K Software License
• $200K PS
• $50K Hardware
• 1000-3000 Employees
• 3-6 month deployment
• Organizations with 1000 users and below may be priced out of both the solution and the suite and therefore may not be good opportunities to prospect

What is the benefit of AegisUSA Appliance?

• Small Identity Customer can’t afford $500K
• $50-150K Software
• $50-75K Solution
• 30 Day Deployment

What is it?

• Appliance Solution
• Hardware – 2 Sun Fire x4150 Servers
• Sun Identity Management Software Suite
• Identity Manager
• OpenSSO
• Directory Server
• Supporting Sun Software
• MySQL, Solaris 10, Open MQ, Glassfish
• Professional Services to Install, Connect, and Configure
• Appliance Support

What are the benefits of the Appliance approach?

• Foundation for Further Expansion
• Differentiator from other “point” solutions.
• Open Architecture
• Easy to Understand, Implement, and Support
• Requires Minimal Professional Services to Deploy
• Solves “Low hanging fruit” identity problems
• Provides Quick wins
• Increases Visibility for IAM Initiative

IdM includes a broad set of use cases, so where did they start?
Password Management

• Account Discovery (3-5 apps – 1 Authoritative)
• Change Password
• Forgot Password
• Change Authentication Questions
• Password Policy Configuration
• Help Desk Admin
• Password Reset
• Change Password
• User Audit Report
• Standard auditing and reporting
• Branding

Federated Identity

• Infrastructure to join InCommon Federation
• Leverage existing AuthN (LDAP)
• OpenSSO with Shib SAML Profile
• Documentation Package for clients

Single Sign On

• Initial Loader and Existing Directory Integration
• SSO Object Class Updater
• Policy and Rule Configuration
• IDM Authentication
• Application Authentication and Simple Authorization
• Session Persistence
• Request SSO Access.

Google Apps Provisioning

• Leverage existing ‘directory’
• Well defined set of rules for provisioning accounts
• Allow for sponsored/guest account creation

This is a great example of how Oracle/Sun Identity Management software can be delivered as a hardware device to increase customer success and reduce implementation cost. We look forward to see further innovations that come from Oracle/Sun + Partners!

Government is going to the clouds...

“The government's living in its own cloud cuckoo land...” - Bob Brown

For reasons ranging from cost savings to real time collaboration and innovation or job growth; increasingly government agencies around the globe are racing to roll out cloud services. And like most IT departments there are areas of major overlap where various groups are competing for budget and influence.

Like an awards show, below I have highlighted some of the more notable Cloud Initiatives in progress within the Public Sector, starting here in the United States:

My Favorite Cloud (Being a Space Camp graduate): Nasa Nebula

• According to Wikipedia "A nebula is an interstellar cloud of dust, hydrogen gas, helium gas and plasma."

• The pun-intended pilot program is under development at NASA Ames Research Center and is primarily based on open-source components and provides a virtualized dynamically scalable computing infrastructure .... hence a cloud.

• Today it is used for public outreach primarily but theoretically for scientific collaboration and mission support.

• As we see with Enterprises, innovation out paces infrastructure and NASA researchers see Nebula as a way to dynamically share discoveries to rapidly iterate on theories to more quickly lead to scientific discovery.

• As with any organization with high value IP, data handling, privacy, and access requirements are critical so security is fundamental as well as the need to comply with agency and federal policies such as the Federal Information Security Management Act (FISMA).

• Nebula's Infrastructure-as-a-Service leverages Eucalyptus, a cloud management system from UC Santa Barbara that is compatible with Amazon's EC2 web service.

• However Nasa assures us that sensitive information is NOT being stored on Nebula

Obama's Favorite Cloud: Apps.gov

• Goal - Per the launch announcement, “to lower the cost of government operations while driving innovation within the government.”

• Apps.gov is an online storefront for federal agencies to quickly browse and purchase cloud-based IT services, for productivity, collaboration, and efficiency.

• Breaking from their historical challenges we saw before 911 leading to the creation of the Department of Homeland Security, where data (+apps) were hosted by individual agencies and on fenced off devices

• As the Fed spends north of $75 billion annually on IT, the potential benefit from even minimal optimization is enormous

• Additionally, for anyone who has gone through a Fed procurement process, it is painfully clear that glaciers of molasses in January move faster. Enabling a more dynamic model of sharing resources could, theoretically, enable Federal agencies to roll out new services much more quickly saving time, money (on people), and be more effective .. more upside.

• Peter Mell of NIST succinctly put it, "2010 will be the year of the cloud computing pilot." I look forward to continuing this exciting conversation with you all!

Most Seafaring Cloud: Navy's CANES Initiative

• Why it's cool – Like any cloud initiative, it seeks to make data and applications shared resources accessible by users/apps ... but the Navy makes it accessible by Sea.

• The Consolidated Afloat Network Enterprise System (“CANES”), as you might suspect, consolidates hardware/software for centralized access which will deliver a common hosted computing environment for the entire fleet ... freeing up the ships to focus on their day job, protecting us from the bad guys ... sounds like a great idea to me!!!

• The Navy is also looking at their own version of a Virtual Private Cloud for the individual boats (ok, they prefer the term vessel) called "grey clouds"

Toughest Cloud: DISA Cloud Initiative

• The Defense Information Systems Agency (“DISA”) is currently putting together several Cloud services for the US Department of Defence (“DoD”).

• These include Forge.mil, an open source initiative (Thanks for supporting the US software industry) which is a group of SaaS applications that support the DoD IT community.

• Started in October 2008, Forge.mil is a DISA-led activity that theoretically delivers operational efficiency, cost savings, and would help protect the operational environment from potentially harmful systems and services

• Another example is GIG Content Delivery Services (“GCDS”) which is actually not owned by the Public/Federal Sector , and this computing platform is shared/deployed across the DISN (NIPRnet & SIPRnet).

• GCDS is designed to focus on delivering applications/data in a secure and reliable fashion no matter the state (or location) of the network or end points.

• Some interesting advantages of GCDS include localized caching anywhere, global redundancy and fail-over, multi-vector scaling, defense in depth protection, edge level data and network control, rapid implementation, and neurologically based network security.

Most Empowered Cloud: US Department of Energy's Magellan

• If you can't run with the big dog's stay on the porch - Funded by the American Recovery and Reinvestment Act through the US Department of Energy (DOE), the aim is really to test if cloud computing is all it is cracked up to be or another passing trend (What, CORBA won't change the world?)

• The DOE centers at the Argonne Leadership Computing Facility (ALCF) in Illinois and the National Energy Research Scientific Computing Center (NERSC) in California are installing basic but comparable systems as a test bed to assess the effectiveness of cloud computing from the perspective of energy efficiency.

• What's in a name? - Viewed as an exploration of the next frontier in IT, Magellan is named (no surprise here) in honor of the Portuguese explorer whose voyage was noted as the first to circumnavigate the globe. Also the “clouds of Magellan”, 2 galaxies were named after him so it gets even more cute.

The Most Pail Cloud: Department of the Interior's NBC Cloud Initiative

• The Department of the Interior's National Business Center (“NBC”) is planning a set of cloud services to be offered to the broader community of federal agencies.

• Having historically operated as a service provider, NBC (no peacock included) was originally established to be a shared services provider for what those of us in the commericial sector might think of as G&A activities such as accounting, HR, etc.

• Starting in 2004, NBC took on the role of being the US government wide service provider under the Information Security Systems Line of Business and in so doing quickly stumbled into the typical issues/requirements of multi-tenancy we see in the commercial space.

• Today NBC (still no peacock) is planning to start with 6 cloud solutions: NBCGrid (IaaS), NBCFiles (Cloud Storage), NBCStage (PaaS), NBC Hybrid Cloud, NBCApps (SaaS Marketplace), & NBCAuth.

Around the World

“Behind every cloud is another cloud.” - Judy Garland

James Bond's Favorite Cloud: The UK's G-Cloud Initiative (it even sounds classy)

• Announced by Great Britain's Federal CIO, this onshore and private initiative by the government is aimed at delivering a middleware platform for delivering data and applications as shared services in a iTunes.gov.uk like application store.

• Initiated with a study/investigation into the effectiveness of Cloud Computing and Virtualization, the apparent success of their test results turned into a full blow IT initiative

• As in the US, the goal is to empower UK government agencies to benefit from the costs savings and efficiencies of a shared computing environment while also maintaining the appropriate levels of security, accountability and control required government programs.

• Having previously kept such efforts within specialized teams/groups, this is the first effort to bring IT innovation directly under the responsibility of their operating agencies (or for those of use from the private sector think business owners not IT).

The Cloud with the most painful acronym: The EU's RESERVOIR project

• While Government agencies are known for their use of acronym's the EU (already an acronym) takes the cake with the Resources and Services Virtualization without Barriers Project (“RESERVOIR”).

• As in the US and the UK, the project is designed to provide cost savings, efficiency, and scalability across a shared pool of IT resources and geographies.

• With On-Demand resource provisioning and Web 2.0 use of applications as a services and networks as platforms to expedite time to market for new government resources to help the EU compete on the global stage

• The EU hopes to leverage RESERVOIR to enhance the competitiveness of their economy and bring about a powerful ICT infrastructure for the reliable and effective delivery of services as utilities.

Most Friendly Cloud: Canada's Cloud Initiative

• The inititaive was essentially otlined in a paper from the Canadian Government's CTO of Public Works as a strategy for helping diminish the negative impact of IT on the Environment

• It also suggests that leverage the inherent cooling advantages of the geography of Canada make the country an ideal location for hosting world wide cloud initiatives

• Looking at this from the perspective of a traveler, Canadians are possibly the most generally likable travelers and hosting high value infrastructure there might make it safer from unintended terrorist attacks.

The Sunniest Cloud: Japan's Kasumigaseki Cloud Initiative

• Dubbed the ICT Hatoyama Plan as outlined by the Digital Japan Creation Project, Japan’s Ministry of Internal Affairs and Communications has released plans to deliver a massive cloud computing infrastructure to support all of the government’s IT systems.

• Tentatively named Kasumigaseki after Japan's first high rise building (1^st building in the clouds) the plan is to deliver the infrastructure in stages with full role out by 2015.

• As seen in other countries the goal is IT efficiency for cost savings and speed of rolling out new solutions and services

• Japan’s Ministry of Internal Affairs and Communications (MIC) anticipates that the project will boost the economy

Security’s Baby New Years for 2010

As the ball drops on the 1st decade of the new millennium…

What will represent the Baby New Year of 2010 for Information Security?

Will our 2010 resolutions mitigate the threats or fall inevitably short?


Wikipedia defines Baby New Year as a “male baby wearing nothing more than a diaper, a top hat and a sash across his torso that shows the year he is representing. Sometimes he is holding an hourglass or is otherwise associated with one”.

Not too ominous at face value but this icon represents the anticipation, excitement, and uncertainty everyone feels in facing a new era. On the eve for 2010, the likely evolutions in Information Security (those foreseen and those yet unimagined) are certain to bring out the same feelings in CSO’s, CISO’s, CIO’s, CEO’s across the public and private sector.

Step 1: Learning from the past attacks

"Among all forms of mistake, prophecy is the most gratuitous.” - George Eliot
What was expected?

• Early predictions this decade anticipated that information security would be much better, more efficient, less complicated, with fewer attacks.
• Popular thinking was that vulnerabilities would flatten/decline, and so would breaches.
• Applications were expected to get simplified, smaller, less interdependent and less extensible
• Some even suggest that by 2010, a security Martin Luther would lead us through a class-action lawsuit that sparks a full-blown security reformation.
• In 1991, D. James Bidzos, then president of RSA created the buzz phrase “digital Pearl Harbor”; referring to a global InfoSec attack compounded by disrupted backup systems and leading to cascading failures and worldwide panic where the origin is later pinpointed to an avoidable vulnerability.
• Viruses and data breaches were seen as mischievous acts of disruptive individuals rather, not criminal enterprises.
• PKI was seen as the imminent solution to all authentication problems
• Reformers such as SEI’s Watts Humphrey, proposed solutions to software vulnerabilities through formalized software engineering best practices and requiring professional licensing, as within the medical field, to minimize threats by heightening quality and consistency.

“Whoops there it is!” - The Fresh Prince of Bel-Air
What wasn't expect?

• Hoaxes - For example, the Baby New Year Hoax of 2007 claimed a Baby New Year Virus had infected up to 42 million computers worldwide.
• Complexity - Instead of being simplified applications became more complicated, architectures more sophisticated through SOA, virtualization, SaaS, etc.
• Out Sourcing - Rather than becoming a highly regulated, licensed profession software development moved to an out sourcing model where vendors and customers build solutions through composite teams world wide
• Abstraction - Information Security moved to an abstraction model with shared/standard components across applications for authentication, authorization, provisioning, roles management, etc.
• Protocol flaws- For example, researcher Marsh Ray of PhoneFactor discovered a hole within SSL/TLS that allowed man-in-the-middle attacks.
• Security as a Facade – For example, Security2010 offering dummy security cameras and solar powered dummy security cameras
• Social Networking – 10 years ago we struggled with AOL IM, Yahoo Webmail, and peer-to-peer networks like Napster and focused on server port 80; but by the end of the decade, the top concerns were Facebook, Twitter, and other Web 2.0 applications.
• Worms – Unlike Oscar the Grouch friend Slimey, the 2005 Samy worm on MySpace or Facebook’s Koobface, demonstrated the risks in opening the web to malware contributions from users, innocent or malicious.
• Get Shorty - Twitter fans love of mini-URL’s lead to vulnerabilities of their own
• Mafiaboy to Organized Crime – The Feb 2000 Denial of Service attack from the Canadian teenage named Mafiaboy temporarily brought down sites including CNN, Dell, eBay, and Yahoo but by the close of the decade attacks were lead by well organized and funded criminals to produce data breaches at Dave & Busters, Hannaford Brothers, Heartland Payment Systems, and TJX and Iraq Shia fighters hijacking the security camera’s in drone airplanes
  
• Gone Phishing – Clever con artists leveraging fast flux to rapidly switch domains locations and sites that felt like known banking sites successfully extracted PII from users trying to log-in, update, or review their accounts.

Step 2: Anticipating future threats

“Never assume the obvious is true.” - William Safire
What can we foresee now?

• Jail Bait – Apple’s restrictive policies on “approving” applications and limiting user control of the device has lead to a large & growing sub-culture of “jailbroken” phones. While this gives the user more access it opens the device to vulnerabilities. Conversely security vendors like Symantec, McAfee, Sophos, etc. cannot develop antivirus applications for the iPhone as Apple blocks necessary low-level access to the device.
• Rock’m Sock’m Androids - Google's Android is a natural attack for 2010, as Google is more open in allowing applications, but this is open to abuse by seemingly desirable applications functioning as malware.
• Hey! You! Get off of my cloud – Cyber-criminals combining stolen credit cards and hosting cloud services like Amazon’s EC2 have already started to use the new platform for Bots-as-a-Service or Malware-as-a-Service. Not to mention the legal liability facing cloud services around protected data from PII to pornography being stored on their servers unbenounced to them.
• It’s getting blurry - As public and private organizations extend their use of smartphones, web 2.0, and social media to interact with clients, employees, and contractors, they blur the perimeters of the network. Organizations will need to shift the focus towards data protection beyond network/infrastructure security as the question shifts from “Who has access to what?” to “What are they doing with it?”
• MyCloud.gov - Government agencies are increasingly moving data and services of low or moderate risk to cloud services to attain cost savings, such as Nasa’s Nebula http://www.cloudbook.net/nebula-gov or from the Pentagon http://www.networkworld.com/news/2009/100509-pentagon-cloud-computing.html?page=2
• Enough is Enough – As with the recent bombing attempt, the continuous evolution towards heightened security at airports and long, uncomfortable security screenings for most passengers will likely lead to biometrics finally making it to prime time. Consumers will be willing to compromise privacy and bear the cost to simplify their life with everything from air travel to eliminating the 100+ passwords they have to remember or keep in a file on their computer or sitting on the desk.

“No question is so difficult to answer as that to which the answer is obvious.” - George Bernard Shaw
What can’t we anticipate?

• Greatest Thing Since Sliced Bread – As we have seen throughout the evolution of enterprise software, there seems to be a never ending flow of revolutionary architectures changing how we build products, deploy solution, and conduct business. This includes CORBA, P2P, SOA, SaaS, Virtualization, and Cloud Services just to name a few. As each new platform emerges there will be new vulnerabilities associated with them.
• What’s Old is New Again – Appliances keep coming back as vendors like Intel and AMD seek to drive high-use functions into the chip set and organizations look to reduce the cost and risk associated with major deployments through the use of packaged solutions. However each new wave of appliances has its own associated risks.
• The Perfect storm – Who knows, perhaps the combination of social networking, smart phones, and cloud services will lead to the “digital Pearl Harbor” that was predicted in 1991

How did we do compared to our predecessors projections, how will we be judged by those who come after us? Only time will tell.

The Next Cloud Security Frontier: DLP for the Cloud

While there is a growing consensus that security is the keystone to successfully leveraging Cloud Services and Composite Applications, filtering and securing the data being exchanged is a BIG problem facing us ahead.


Viruses and Malware are the STD's of the Internet and Identity Theft is the equivalent of virtual counterfeiting so as with every other issue/requirement that faces user interactions, SOA interactions face the same challenges.

Existing Cloud Security solutions have focused on authentication, entitlements, which is where Identity & Access Management for users started. However the next generation will need to address the “STD's” and Counterfeiting risks as well like Symantec, McAfee, Sophos, and others have done with DLP and desktop security.

Vordel has recognized this emerging requirement and started addressing it with DLP functionality in their recently announced Cloud Service Broker product that will allow customers to analyze content and act on it whether it is flowing into or out of their environment.

There are already legal precedents and implications which, if called into play, could have substantially negative financial and reputation effects on Cloud Service provides like SalesForce.com, Google Apps, and Oracle On-Demand as well as their clients. One example outlined in this article outlines how storage as a service introduces legal implications based on unchecked content within a packet containing personally identifiable information (PII) or other regulated data creates a liability for organizations that receive it.

Network World even references this as part of a likely growth trend for Enterprise Security in 2010


So how do we get ahead of the 8-Ball on this one?

What is the risk?

• All content sent to Cloud services must be analyzed for leaked data, in order to enable Data Loss Prevention.
• Content-level threats (viruses, malware, PII, MIIA, etc.) need to be identified and blocked, including application-level attacks at the API and payload level.
• It is not enough to know “Who has access to what?”; Enterprises need to know, and be able to demonstrate, what they are doing with it? Leaking PII or any regulated data creates a substantial risk to the enterprise.
• Receiving PII, ranging from social security numbers or unencrypted credit card accounts to child pornography creates just as much liability as leaking that data.

How should we address it?

• Architecture - Look for flexible SOA Security solutions and XML Gateway's that allow for seamless integration with content filtering and protection services.
• Don't spread STD's i.e. Viruses/Malware – Leverage proven tools for content inspection connected to active research labs to analyze the content of packets while it is open to minimize risk AND latency.
• Stop Counterfeiting i.e. Data Protection – Leverage the content analysis tools found in proven DLP solutions to review, quarantine, delete, protect, or stop information during the same packet inspection.
• Protect against Internal Threat with IRM – The same risks that exist with users are shared here for services. Lock it down with IRM to seal sensitive or regulated data before it goes out the door but still allowing business processes and services to function effectively.

As enterprises host and share data via software-as-a-service (SaaS) and Composite Applications with Public/Private Cloud services, they need to \consider the use of DLP, AV, and IRM technologies to protect themselves and the information being exchanged.

7 Secrets of Fraud & Identity Theft

Between the media attention and ever increasing security & audit requirements, here are some interesting points on what is behind all this.


#1 -- How broad is the impact?

• 10 million of US Citizens (1 in 10) were victims of ID Theft in 2008 (Javelin Strategy and Research, 2009).
• U.S. fraud totaled $31 billion in 2008 (Javelin Strategy and Research, 2009).
• Across the world businesses lost $221 billion a year due to identity theft (Aberdeen Group).
• Average vicitims lost $851 and $1,378 out-of-pocket trying to resolve identity theft (ITRC Aftermath Study, 2004).

# 2 -- How hard is it to fix?

• Almost 20% of victims don't learn that their identity has been stolen for four or more years (Identity Theft Resource Center Aftermath Study, 2004).
• 50.2 million Americans were using a credit monitoring service as of September 2008 (Javelin Strategy and Research, 2009).
• Taking up to almost 6,000 hours (Average 330), the equivalent of the time working 2 full-time jobs for a year, to correct the damage from ID theft (ITRC Aftermath Study, 2004).
• 25.9 million Americans carry identity theft insurance (as of September 2008, from Javelin Strategy and Research, 2009).
• After suffering identity theft, 46% of victims installed antivirus, anti-spyware, or a firewall on their computer. 23% switched their primary bank or credit union, and 22% switched credit card companies (Javelin Strategy and Research, 2009).

# 3 -- What are the Common Sense ways to avoid it?

• One of these things doesn't belong – Check your bills, question things that don't make sense and question charges or bills that are missing.
• WHY? Thieves may make a charge and reverse it just to test that the number is valid before stealing it. Also if you did not get the bill, it might be going to someone else that hijacked your account.
• Don't call us... - Never give out identity data to someone who called or emailed you, if your bank or credit provider needs info contact them on a known-good phone number or website
• WHY? Odds are they wouldn't ask if they knew, many thieves go on phising trips over the phone, web, or email often telling you they are from your bank and “here to help”.
• Pick up the phone – Frequently service providers will request that you write down and mail your credit card information, give it to them by phone instead.
• WHY? How hard is it for someone in the mail room to copy them.
• Somebody is watching you – They put those mirrors on ATM machines for a reason, watch out for someone looking over your shoulder in the real world or online.
• WHY? Ever take a Quiz on Facebook like “Which cat would I be? These can be loaded with questions that are also used as your secret questions to retrieve passwords with banks, credit cards, etc. Take a quiz, get your id hijacked.
  

#4 -- How are we getting attacked?

• Stolen wallets and physical paperwork accounts for almost half (43%) of all identity theft (Javelin Strategy and Research, 2009).
• Web/email attacks account for only 11% (Javelin Strategy and Research, 2009).
• Credit/Debit cards were stolen from 38% of victims (Javelin Strategy and Research, 2009).
• Social Security number were stolen from 37% (Javelin Strategy and Research, 2009).
• Name and phone for 36% (Javelin Strategy and Research, 2009).
• Financial account for 24% (Javelin Strategy and Research, 2009).
• 35 million+ records were compromised in corporate breaches in 2008 (ITRC).
• Racking up your phone bill with long distance calls, and not let you know until it's too late.
• Getting a replacement for your credit card just by making a phone call
• Starting a new life under a dead person's identity.
• Sell your home, or take out a mortgage against it, without your knowledge.
• Use up electricity and leave you with the bill.

# 5 -- Does Ice make it feel better?
Freezing your credit report won't always stop many ways of committing


# 6 -- Is there a Conference for this?

• Starting on the 19th of January 2010, will be the 12th annual IIR Fraud World conference
• Opening & Chairing the event will be Oracle's own Des Powley; Technology Director, Security & Identity for Oracle UK, Ireland, & Israel
• Des will also be delivering a session on “The Importance of Delivering Enhanced Identity Management, Fraud Detection & Risk Management”

#7 -- Can you watch the movie instead?

• The 2008 documentary "HACKERS ARE PEOPLE TOO" takes an honest look at the subculture and it original origin and the hijacking of the term “hacker”.
• The more theatrical version directed by Iain Softley from 1995 “Hackers” is also enjoyable.

Are Enterprises ready for Identity Management as a Service (IMaaS) ?

While solutions are available and the economics of the solution are desirable it is still early days.


Is the technology available?

• Recently Simeio Solutions launched their new version of DirectAXs software-as-a-service (SaaS) suite.
• In 2007, Oracle & Wipro announced Managed Identity Service
• If you do a Google search there is a seemingly endless list of options including startups looking to change the game such as “Symplified”

So why is it desirable?

• Pricing/Packaging - Pay-as-you-go or subscription pricing allows organizations to measure the direct ROI on an quarterly basis plus delivers lower upfront costs and assured service levels
• Deployment - Historically IAM implementations have been labor-intensive and create organizational headaches with change control and process engineering which can be costly.
• Integration - Disjointed products from multiple vendors, suites, or coming into an Enterprise through various acquisitions create incompatibilities but can be challenging to unwire/replace or merge.
• Governance - Provides an immediate/direct combination of identity and access management (IAM) with governance, risk and compliance (GRC) capabilities
• Hosting - Solutions can be fully hosted and remotely managed or on premise and managed externally managed
• Administration – Provides a centralized/unified management of IAM and GRC capabilities for a streamlined user experience with integrated reporting

So what is the problem?

• Multi-tenancy – Existing solutions/architectures require enhanced features for multiple customers to access the same console, provide for data partitioning, and filtering to prevent unauthorized data access.
• Converging Suites - As Identity Management becomes increasingly application centric the drive is towards suites that weave IAM into the fabric of the application framework as Oracle and SAP are moving towards
• Security Concerns - Heightened compliance and security regulations make identity and access management a critical component of today's enterprise, too sensitive to manage externally
• 1-Cloud-to-many-Applications - Enterprise deployments require 20-100 applications to be individually integrated into the IAM suite, connecting user provisioning, single sign on, role management and compliance to the single point of the cloud, across the web with each application creates throttling, latency, and SLA-priority challenges and diminishes the performance of the underlying applications and users.

The march towards dynamic, composite applications architectures is definite but the rate is uncertain and the challenges and risks for the early adopters are high.