Tuesday Nov 17, 2015

The Lifecycle Management Opportunities of a Data Breach (Part 3) - Simeio Solutions

Identity lifecycle management is one of the most critical parts of a security and identity and access management program.  Identifying the assets and setting a baseline for acceptable risk needs to be considered before starting any security lifecycle project and must involve the proper stakeholders.  Let's refer back to our original blog post where we discussed the Ashley Madison breach.  When the company began, they had advertised their service with a commitment to delete customer info upon their request, but as the headline breach revealed, that was not the case.  The hackers were able to expose data related to tens of millions of accounts which suggests some part of the identity lifecycle management process was not properly followed.   The fact that so much data was compromised from the Database could imply that the attack originated there.  Soon after the attack, it was reported that a former contractor for the company may have been one of the responsible parties.

To some degree, we had a perfect storm brewing.  We had a company that was offering a service that some felt was morally unethical.  We had large amounts of sensitive data stored un-encrypted in a Database.  And we appear to have privileged account access given to a contractor, which may not have been revoked upon separation from the organization.   There have also been some additional discoveries made on the end-user accounts as well – such as the fact that many of the customer accounts utilized very basic passwords – one password cracking group has claimed that they were able to crack 11 million users’ passwords.  This latter topic is beyond the scope of this blog, but suffice it to say that it is important for organizations to enforce strong password policies.  

It is easy to look at the Ashley Madison situation through the tinted lenses of morality and assume nobody should care, doesn’t apply to me or they had it coming.  The reality is, the scenarios at Ashley Madison should keep every security officer awake at night.  Regardless if the attack/theft and ransom is around the morally questionable content of users, or the confidential financial records of customers, the same steps must be made to prevent the same outcome.

In our last blog we talked about privileged account access and how OPAM protects the keys to the kingdom.  But what about the everyday lifecycle of an employee or a contractor?  How do they request and receive access to the assets they need to do their job and nothing more?  How do we take away access rights as their relationship with the company changes (promotions, re-assignments, terminations)?

The Oracle Identity Governance Suite (OIG) enables us to manage entities across different targets/applications in a centralized manner. The solution can address the most complex business and security requirements without changing existing policies, procedures or target sources.

Self-service enables users to raise requests for themselves for access to particular resources or entitlements. It allows for fine-grained configuration such as restricting a user's self-service capabilities by defining policies and rules based on user attributes. For example, taking a scenario where the user is a contractor, certain fields can be denied attributes for such user types. Thus reducing the time of UI customization and preventing users from modifying user data which is not expected.

OIG has built in Admin roles which can be used for carrying out Admin specific tasks. New customized Admin roles can be defined by adding capabilities to a particular organization scope. It allows the creation of attribute based assignment of Admin roles, thus we can define our own membership rules.
Request based approvals enable the respective stakeholders, like role owner or entitlement owner to be involved in the approval process.  This is an important capability for scenarios where a user needs access to a particular account or entitlement. In the latest OIG PS3 release, workflows were introduced as a replacement for approval policies and can provide more logical responses for end user requests.

Role lifecycle management provides an efficient mechanism to automate and scale the provisioning and logical grouping of accesses and controls as well as helping to detect violations which we will cover in more detail in our next blog.

OIG ensures that on-boarding and off-boarding actions are followed based on the start and end dates respectively. It provides a set of access policies which are role based (which in turn can be attribute based) which ensures that uniformity is maintained across various target systems. Role to Access policies mapping is done during role configuration. If this association is done with lifecycle management enabled, it goes through a role owner approval process, thus ensuring role owners are aware of provisioning actions. The provisioning process based on tasks ensures that the proper workflow is followed. Immediate access termination can be done by administrators from the Identity console for users which are found to violate policies whether accidental or malicious. 

Proper sunrise and sunset of account access and entitlements is critical for contractors or in scenarios where access to privileged accounts and entitlements needs to be granted to users – in such cases we can define start and end dates of a particular entitlement and thus control access for a particular period providing another layer of protection against misused access rights.  OIG can automate the process of immediately revoking user access rights upon termination or suspension. This eliminates a commonly exploited security gap and opportunity for policy violations that can occur after the dismissal of an employee or contractor – which is the exact scenario that was assumed exploited at Ashley Madison.

The Oracle Identity Governance Suite can be used to establish a lifecycle management process that allows organization to have comprehensive governance of identities. It allows organizations to identify risks and make sure they address the organization’s defined policies. In the next blog in this series we will discuss more on certifications, audit, compliance and reporting and how it ties together with lifecycle management as part of a holistic security solution to enhance compliance.

For more information on how Simeio Solutions can help you with reducing exposure to data breach with Oracle technologies, please visit them at www.simeiosolutions.com

Wednesday Nov 11, 2015

Managing the Keys to the Kingdom - Privileged/Shared Accounts - Simeio Solutions

This is our second in a series of commentaries on minimizing the risk of becoming the next front page news story on data breaches. 

Privileged and Shared Accounts are some of the most critical assets to manage in an organization since they provide broad access to systems and sensitive corporate and state information. Privileged Accounts are those that typically allow administration of a system or provide higher levels of access within a system such as Linux/Unix ‘root’ or Oracle Database ‘sys’.

There can be many reasons why a user with access to a privileged account does bad things - they were not given an expected raise, denied a vacation or a promotion, or maybe they disagree with the ethical and moral policies of their employer.  Poor password management practices, such as sharing passwords for privileged accounts, or falling prey to smart social hacking is a simple way for others with malicious intentions to gain access to the Keys to the Kingdom.  There can also be privileged escalation attacks where a user  can gain additional access to a system beyond what he or she has been authorized to have by exploiting a vulnerability in that system.

As we discussed in our last blog entry, most data breaches are caused by events such as employees losing, having stolen, or simply unwittingly misusing, corporate assets.  After questioning over 7,000 IT executives and employees across North America and Europe, a recent industry report has found that 31 percent of employees cited simple loss or theft of credentials as the explanation for data breaches they had experienced, ahead of inadvertent misuse by an employee 27 percent of the time. External attacks were mentioned in 25 percent of cases with abuse by malicious insiders at 12 percent. The same selection of causes was cited at much lower levels for business partners.

It is equally important to keep an eye on service accounts associated with test and demo environments.  The principle of least privilege is the key - only assign privileges which are necessary for an employee to effectively do their job, and put the necessary controls in place to remove privileges when no longer warranted. Start with the most restrictive state possible and build out from there.

Organizations are struggling to manage a large number of administrative accounts in a secure, efficient, and scalable way. So the problem is how to handle the situation where we only provide access to a privileged account when it’s required to perform a specific task and how do we audit and report on those situations.

Oracle Privileged Account Manager (OPAM)
Fortunately, there are technologies available to protect an organization’s privileged or shared accounts.  When coupled with industry best practices, a program can be put in place to ensure that your organization doesn’t become the next headline data breach story.  

The following diagram and flow sequence describes how Oracle Privileged Account Manager in conjunction with the Oracle Identity Governance Suite is used to protect the Keys to the Kingdom.  

Flow sequence:
1.    Requester raises request for access to certain systems, groups, etc..
2.    Approver (manager, system owner, etc.) can deny, approve, or delegate request.
3.    As per the roles and policies configured for this request, OIG will provision appropriate access.
4.    (Privileged) User will login to the OPAM self-service console and be authenticated for the request.
5.    OPAM allows the user, for example a database administrator, to use a privileged account by “checking out /check in” a password for a particular enterprise application, operating system, or database server.
6.    ICF connectors provide out of the box integration with various target systems.
7.    When session access is granted, a notification (text message or email) can be sent to an OPAM Admin/IT Security admin.  OPAM Admin/IT Security admin can keep/terminate the session as appropriate.

The request based flow as depicted above ensures that the proper admin team is notified for the access which the present users have. Policies and roles ensure that the only access granted to a user, is that which they require (as per the principle of least privilege). It is always critical to do a periodic review of the policies and roles that are configured.  Sunrise and sunset of accounts and entitlements, access violations and certifications can all be handled by Oracle Identity Manager which will be discussed in a future blog post.  The password policies in place here can ensure strong authentication standards are followed. Additionally, the end users don’t need to remember multiple passwords – they actually never have to see the password for these protected, privileged systems. 

Default passwords are prone to risks so OPAM is configured to automatically change the password and thereby eliminating the possibility of the password being reused.  The system is set to change the password on every check-in, thereby precluding the administrator from reusing the same password again and hence is less prone to sniffing of password of privileged accounts. There may be cases where we need to rollback our privileged account target and in that case OPAM maintains a password history.

OPAM additionally provides session management and auditing capabilities to address various use cases. The OPAM dashboard shows real time status. By creating a single access point to the target resources, OPAM Privileged Session Manager helps administrators to control and monitor all the activities within a privileged session. When session access is granted, a notification can be sent to an auditor. Compliant third-party clients (e.g. Putty, OpenSSH) are supported.  OPSM will monitor SSH session activities through keystroke logging and records the input/output for each session into searchable historical records (transcripts) to support forensic analysis and audit data. OPAM leverages an OPAM agent on the target to capture and record user activities into a MPEG-4 encoded video for Windows playback. OPAM audits and logs all operations and provides its own built-in audit reports.

Additional benefits of OPAM are further realized when deployed in conjunction with some of the other capabilities delivered through the Oracle Identity Governance Suite.  This integration provides an enterprise with a complete governance solution to support ordinary and privileged users in order to meet compliance requirements. We will go into greater depth in our next blog on how OIG provides a simple and robust solution to fully manage the user life cycle with all essential features to secure enterprise assets.

For more information on how Simeio Solutions can help you with reducing exposure to data breach with Oracle technologies, please visit them at www.simeiosolutions.com

Tuesday Oct 27, 2015

Ensuring You Don’t Become the Next Data Breach Story (Part 1) - Simeio Solutions

Recent headline Cyber Crimes at major retailers, health insurers, and even US Government agencies suggest that those involved were not necessarily performed by criminal masterminds, but rather by individuals that at one time had been properly credentialed to access systems or by individuals that were simply exploring open doors to identify vulnerabilities,. As information technology moves further toward the cloud to provide services, we will start to see more security breaches on a greater scale than ever before.

The hack at Ashley Madison has captured the attention of the media on several continents. And it is of no surprise that the former CEO suggested that the hacking incident may have started with someone who at least at one time had legitimate, inside access to the company’s networks — such as a former employee or contractor. In another instance of data theft from a health insurer, it was determined that critical data and records were not properly encrypted leading to the theft of millions of records of personally identifiable information.

As per "The Federal Trade Commission", Identity theft was once again the number one complaint from Americans this year.

Oracle’s Defense-in-Depth strategy and solutions offered as part of the Oracle Identity Management suite of products can prevent the cyber breaches that we are becoming so accustomed to see on the nightly news.

Today’s blog will focus on a few specific capabilities of Oracle Identity Governance (OIG) and show how they can be used to protect against certain types of common exploits.

1. Privileged/Shared Accounts – Keys to the Kingdom.

Privileged and shared accounts unfortunately exist within every organization - designed at a time when security was an afterthought if even thought of at all. How does one prevent or limit privileged accounts like DB Admins from performing malicious actions when compromised? OIG provides session management and auditing capabilities which become the single point to control and monitor activities within privileged sessions. OIG will provide notification alerts on account checkout. You can also define the life of a session and limit the usage of commands.

2. User life cycle management – Role Appropriate Access and Removal of Orphaned Accounts

OIG allows for attribute based role management for application and administrator roles. One can define custom, fine-grained Admin roles. For new user on-boarding, privileges are based on roles, business rules and requests. We can also define sunrise and sunset of application and entitlements which limits the access of users such as contractors or temporary employees for defined time periods. Normal termination based on end date and immediate termination helps to remove privileges and accesses across all target systems. Simply, an individual should only have access and entitlements within and across applications to be effective at their job, and should lose access when they no longer have a business need.

3. Enforceable Password Policies – Start with the basics

Hard-coded passwords, weak/common passwords, and infrequently rotated passwords are at the center of some of the most commonly exploited attacks on organizations. OIG protects privileged/shared accounts with passwords that are mathematically infeasible to ever guess or break and can rotate them on a regular basis. Likewise, password policies can be set for all protected resources requiring individuals to use complex passwords and require regular password changing – making it impossible for an attacker to simply guess the right key to get them through the front door.

4. Protect and Audit

OIG provides the tools to protect privileged accounts. Checking credentials in and out, also allows us to keep track of who has been using these shared accounts. OIG goes one step further, and allows us to monitor specific session activities – capturing and recording user activities as an MPEG video.

Beyond privileged and shared accounts, OIG has powerful certification capabilities - whereby users, managers, and respective application owners can validate and check the accesses of individuals and their specific entitlements. Segregation of Duties (SOD) analysis is efficient and preventative, warning users about potential violations before even the submission of a request.

5. Encrypt the Data – If it cannot be read, it is useless.

There are many rules and regulations mandating encryption and it makes for sound advice regardless. For example, if you have to comply with the PCI-DSS standard, then credit card numbers need to be stored encrypted. OIG allows for encryption of critical attributes of applications – whether that might be credit card information, social security numbers, or other HR data. Additionally, while outside the core scope of this blog series, tools such as Oracle Advanced Security carries out strong encryption of databases to fully protect sensitive information whether at rest or in transit.

Cyber crime has a devastating economic impact on society and at the individual company level can cause reputation and punitive damage from which an organization might never recover. OIG is a vital information safeguard. It exists to protect sensitive data and information from the ever-evolving landscape of security threats. Regardless of the position that a company takes on the extent or viability of such threats, a strong OIG implementation helps to mitigate the risks of cyber crimes.

What's coming next?

Future blogs in this series will discuss in greater depth how the Oracle Identity Management solutions can prevent your organization from being the next front-page exploit.

For more information on how Simeio Solutions can help you with reducing exposure to data breach with Oracle technologies, please visit them at www.simeiosolutions.com


Oracle Identity Management is a complete and integrated next-generation identity management platform that provides breakthrough scalability; enables organizations to achieve rapid compliance with regulatory mandates; secures sensitive applications and data regardless of whether they are hosted on-premise or in a cloud; and reduces operational costs. Oracle Identity Management enables secure user access to resources anytime on any device.


« November 2015