![Identity and Access Assessment ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Recommended
More Related Content
What's hot
What's hot (18)
Viewers also liked
Viewers also liked (7)
Similar to Cloud Compliance Use Case Demo
Similar to Cloud Compliance Use Case Demo (20)
Recently uploaded
Recently uploaded (20)
Cloud Compliance Use Case Demo
- 1. Cloud Compliance Identity and Access Assessment (IdAA) Use Case Demo, Oct 2009
- 4. The Excess Rights Dashboard The Excess Rights Dashboard presents a multidimensional view of least privilege compliance by showing the recent trend as well as a breakdown by application, by group or department, and by user.
- 5. The Excess Rights Dashboard This view presents FFIEC audited applications for a financial services firm. Resource views can be defined for specific audits – FFIEC, SOX, PCI, internal, etc.
- 6. The Excess Rights Dashboard Access control assessment results are indicated for each dimension: time; resource; group or department; and users. Trends and problem areas are easily identified.
- 7. The Excess Rights Dashboard Scale-independent metrics measure performance along each dimension, and are the basis for objective-setting. Here, we look at dormant rights percentage to measure least privilege compliance performance.
- 8. The Excess Rights Dashboard Overall performance is tracked by the upper-left status indicator. In this case, 7% of accounts are dormant – higher than the 6% objective and therefore colored red.
- 9. The Excess Rights Dashboard This trend tells us that prior to Cloud Compliance being deployed, access controls were not performing well. Then, using our solution, dormant rights were significantly reduced. But dormant rights have jumped up this month…
- 10. The Excess Rights Dashboard In the Resource view, we see that Equity Trade is the likely source of this month’s increase in dormant rights. We can click on that application to see what’s going on.
- 11. Equity Trade We have now isolated Equity Trade from all other applications. Note that the Trend, By User Group and By User displays have all been updated to reflect the new view.
- 12. Equity Trade We see that the problem lies with the Bond Traders group. They have been provisioned with rights to Equity Trading that are now dormant. Let’s drill into the Bond Traders group to investigate.
- 13. Bond Traders Now we have isolated the view to Bond Traders with provisioned rights to the Equity Trade application.
- 14. Bond Traders We see that Bond Traders are broken into Executives and three Trader sub-groups. It looks like Executives have a business need, but the Bond Traders sub-groups don’t need access to the Equity Trade application.
- 15. Bond Traders In the User view, we see that these Traders all went dormant on the same day. If the dormant policy is 60 days, then they were all granted rights 67 days ago.
- 16. Bond Traders In this case, an HR admin granted these rights based on generic job descriptions. Mergers, layoffs, and ad-hoc rights requests often lead to the same result.
Editor's Notes
- So let’s look at an example of how it works ….. This is the Excess Rights Dashboard. It presents a multidimensional view of how effectively users are provisioned and de-provisioned across applications, groups, and over time. Overall performance is tracked by the status indicator in the upper left It also identifies problems emerging along the various dimensions of access and identity. Problems with a specific application, group, or even an outlying user are extracted from the noise. Scale-independent metrics measure overall performance along each dimension. In this case we are looking at dormant rights as an indicator of how well rights are provisioned. Configurable management objectives allow you to set goals and compare results to your objectives. In this case, we are looking at a view that focuses on a group of applications that are in scope for an FFIEC audit in the financial services industry. You can set up audit views that are specific to specific audits – FFIEC, SOX, internal, PCI, etc. The trend view tells us that when we first deployed Cloud Compliance, the firm learned that they were not performing well, but using our analysis, they were able to manage it down to reasonable levels. We also see that recently excess rights are creeping back up. By looking at the Resource view, we see that the Equity Trade is the likely source of the problem. We can click on that application to isolate that application to see what’s going on.
- So let’s look at an example of how it works ….. This is the Excess Rights Dashboard. It presents a multidimensional view of how effectively users are provisioned and de-provisioned across applications, groups, and over time. Overall performance is tracked by the status indicator in the upper left It also identifies problems emerging along the various dimensions of access and identity. Problems with a specific application, group, or even an outlying user are extracted from the noise. Scale-independent metrics measure overall performance along each dimension. In this case we are looking at dormant rights as an indicator of how well rights are provisioned. Configurable management objectives allow you to set goals and compare results to your objectives. In this case, we are looking at a view that focuses on a group of applications that are in scope for an FFIEC audit in the financial services industry. You can set up audit views that are specific to specific audits – FFIEC, SOX, internal, PCI, etc. The trend view tells us that when we first deployed Cloud Compliance, the firm learned that they were not performing well, but using our analysis, they were able to manage it down to reasonable levels. We also see that recently excess rights are creeping back up. By looking at the Resource view, we see that the Equity Trade is the likely source of the problem. We can click on that application to isolate that application to see what’s going on.
- So let’s look at an example of how it works ….. This is the Excess Rights Dashboard. It presents a multidimensional view of how effectively users are provisioned and de-provisioned across applications, groups, and over time. Overall performance is tracked by the status indicator in the upper left It also identifies problems emerging along the various dimensions of access and identity. Problems with a specific application, group, or even an outlying user are extracted from the noise. Scale-independent metrics measure overall performance along each dimension. In this case we are looking at dormant rights as an indicator of how well rights are provisioned. Configurable management objectives allow you to set goals and compare results to your objectives. In this case, we are looking at a view that focuses on a group of applications that are in scope for an FFIEC audit in the financial services industry. You can set up audit views that are specific to specific audits – FFIEC, SOX, internal, PCI, etc. The trend view tells us that when we first deployed Cloud Compliance, the firm learned that they were not performing well, but using our analysis, they were able to manage it down to reasonable levels. We also see that recently excess rights are creeping back up. By looking at the Resource view, we see that the Equity Trade is the likely source of the problem. We can click on that application to isolate that application to see what’s going on.
- So let’s look at an example of how it works ….. This is the Excess Rights Dashboard. It presents a multidimensional view of how effectively users are provisioned and de-provisioned across applications, groups, and over time. Overall performance is tracked by the status indicator in the upper left It also identifies problems emerging along the various dimensions of access and identity. Problems with a specific application, group, or even an outlying user are extracted from the noise. Scale-independent metrics measure overall performance along each dimension. In this case we are looking at dormant rights as an indicator of how well rights are provisioned. Configurable management objectives allow you to set goals and compare results to your objectives. In this case, we are looking at a view that focuses on a group of applications that are in scope for an FFIEC audit in the financial services industry. You can set up audit views that are specific to specific audits – FFIEC, SOX, internal, PCI, etc. The trend view tells us that when we first deployed Cloud Compliance, the firm learned that they were not performing well, but using our analysis, they were able to manage it down to reasonable levels. We also see that recently excess rights are creeping back up. By looking at the Resource view, we see that the Equity Trade is the likely source of the problem. We can click on that application to isolate that application to see what’s going on.
- So let’s look at an example of how it works ….. This is the Excess Rights Dashboard. It presents a multidimensional view of how effectively users are provisioned and de-provisioned across applications, groups, and over time. Overall performance is tracked by the status indicator in the upper left It also identifies problems emerging along the various dimensions of access and identity. Problems with a specific application, group, or even an outlying user are extracted from the noise. Scale-independent metrics measure overall performance along each dimension. In this case we are looking at dormant rights as an indicator of how well rights are provisioned. Configurable management objectives allow you to set goals and compare results to your objectives. In this case, we are looking at a view that focuses on a group of applications that are in scope for an FFIEC audit in the financial services industry. You can set up audit views that are specific to specific audits – FFIEC, SOX, internal, PCI, etc. The trend view tells us that when we first deployed Cloud Compliance, the firm learned that they were not performing well, but using our analysis, they were able to manage it down to reasonable levels. We also see that recently excess rights are creeping back up. By looking at the Resource view, we see that the Equity Trade is the likely source of the problem. We can click on that application to isolate that application to see what’s going on.
- So let’s look at an example of how it works ….. This is the Excess Rights Dashboard. It presents a multidimensional view of how effectively users are provisioned and de-provisioned across applications, groups, and over time. Overall performance is tracked by the status indicator in the upper left It also identifies problems emerging along the various dimensions of access and identity. Problems with a specific application, group, or even an outlying user are extracted from the noise. Scale-independent metrics measure overall performance along each dimension. In this case we are looking at dormant rights as an indicator of how well rights are provisioned. Configurable management objectives allow you to set goals and compare results to your objectives. In this case, we are looking at a view that focuses on a group of applications that are in scope for an FFIEC audit in the financial services industry. You can set up audit views that are specific to specific audits – FFIEC, SOX, internal, PCI, etc. The trend view tells us that when we first deployed Cloud Compliance, the firm learned that they were not performing well, but using our analysis, they were able to manage it down to reasonable levels. We also see that recently excess rights are creeping back up. By looking at the Resource view, we see that the Equity Trade is the likely source of the problem. We can click on that application to isolate that application to see what’s going on.
- So let’s look at an example of how it works ….. This is the Excess Rights Dashboard. It presents a multidimensional view of how effectively users are provisioned and de-provisioned across applications, groups, and over time. Overall performance is tracked by the status indicator in the upper left It also identifies problems emerging along the various dimensions of access and identity. Problems with a specific application, group, or even an outlying user are extracted from the noise. Scale-independent metrics measure overall performance along each dimension. In this case we are looking at dormant rights as an indicator of how well rights are provisioned. Configurable management objectives allow you to set goals and compare results to your objectives. In this case, we are looking at a view that focuses on a group of applications that are in scope for an FFIEC audit in the financial services industry. You can set up audit views that are specific to specific audits – FFIEC, SOX, internal, PCI, etc. The trend view tells us that when we first deployed Cloud Compliance, the firm learned that they were not performing well, but using our analysis, they were able to manage it down to reasonable levels. We also see that recently excess rights are creeping back up. By looking at the Resource view, we see that the Equity Trade is the likely source of the problem. We can click on that application to isolate that application to see what’s going on.
- By clicking on equity trade we has isolated equity trade activity from all other applications to see what’s going on with that application. Here we see that the problem is obviously with the bond traders group. It looks like that group has been provisioned with a lot of rights to the Equity Trading application that they are not using. Now let’s drill into the Bond Trading Group to see what’s going on there.
- By clicking on equity trade we has isolated equity trade activity from all other applications to see what’s going on with that application. Here we see that the problem is obviously with the bond traders group. It looks like that group has been provisioned with a lot of rights to the Equity Trading application that they are not using. Now let’s drill into the Bond Trading Group to see what’s going on there.
- Now we further isolated the view to just equity trade, and just Bond Traders. Now we can see that Bond Traders are broken into 4 sub groups. A group of executives and three groups of traders. It looks like the executive have a legitimate need, but the traders themselves really don’t need access to equity trading. By looking at the by User view, we can see that all the dormant users went dormant on the same day. This particular application has a dormant period setting of 60 days, so it looks like all of these users were granted rights in one fell swoop 60 days ago. A lot of process problems could be at the heart of this result. An HR or IT person got a couple of requests from traders for access and got tired of going through the process so he just gave the rights to everyone. An executive wanted one of his guys to have access so he just requested access for the group. Reorganizations, layoffs, mergers, or just new role management initiatives in which HR and IT are trying to guess at rights based upon corporate job descriptions can all lead to this same effect.
- Now we further isolated the view to just equity trade, and just Bond Traders. Now we can see that Bond Traders are broken into 4 sub groups. A group of executives and three groups of traders. It looks like the executive have a legitimate need, but the traders themselves really don’t need access to equity trading. By looking at the by User view, we can see that all the dormant users went dormant on the same day. This particular application has a dormant period setting of 60 days, so it looks like all of these users were granted rights in one fell swoop 60 days ago. A lot of process problems could be at the heart of this result. An HR or IT person got a couple of requests from traders for access and got tired of going through the process so he just gave the rights to everyone. An executive wanted one of his guys to have access so he just requested access for the group. Reorganizations, layoffs, mergers, or just new role management initiatives in which HR and IT are trying to guess at rights based upon corporate job descriptions can all lead to this same effect.
- Now we further isolated the view to just equity trade, and just Bond Traders. Now we can see that Bond Traders are broken into 4 sub groups. A group of executives and three groups of traders. It looks like the executive have a legitimate need, but the traders themselves really don’t need access to equity trading. By looking at the by User view, we can see that all the dormant users went dormant on the same day. This particular application has a dormant period setting of 60 days, so it looks like all of these users were granted rights in one fell swoop 60 days ago. A lot of process problems could be at the heart of this result. An HR or IT person got a couple of requests from traders for access and got tired of going through the process so he just gave the rights to everyone. An executive wanted one of his guys to have access so he just requested access for the group. Reorganizations, layoffs, mergers, or just new role management initiatives in which HR and IT are trying to guess at rights based upon corporate job descriptions can all lead to this same effect.
- Now we further isolated the view to just equity trade, and just Bond Traders. Now we can see that Bond Traders are broken into 4 sub groups. A group of executives and three groups of traders. It looks like the executive have a legitimate need, but the traders themselves really don’t need access to equity trading. By looking at the by User view, we can see that all the dormant users went dormant on the same day. This particular application has a dormant period setting of 60 days, so it looks like all of these users were granted rights in one fell swoop 60 days ago. A lot of process problems could be at the heart of this result. An HR or IT person got a couple of requests from traders for access and got tired of going through the process so he just gave the rights to everyone. An executive wanted one of his guys to have access so he just requested access for the group. Reorganizations, layoffs, mergers, or just new role management initiatives in which HR and IT are trying to guess at rights based upon corporate job descriptions can all lead to this same effect.