Posted September 27th, 2006 Our marketing team recently completed a survey of IT types at banks and credit unions, asking about data breaches, identity theft, information security costs and risks. The survey uncovered some interesting results, especially regarding how they regard insider threats (very seriously) and the estimated organizational costs of a major data breach (more than you’d think).
With most of the security discussion focused on consumer banking (phishing, stronger auth of retail online banking), we were also intrigued by feedback about business banking customers. The majority of respondents agree that business customers demand greater security for Web and electronic banking services. They also agreed that business customers would be willing to limit access to certain services for specific users connecting from specific computers.
This is a departure from thinking on the consumer side — banks just can’t force individual users to log in from only one machine. (Even if logging in from another machine requires you to take and extra step, like answering a secret question.) Getting consumers to work with anything other than username and password is going to be challenging; this is one reason why I have so much hope for CardSpace. (I am tempted to refer to consumers as lazy but a) that’s not really accurate and b) they have been trained into their malaise.) Continue reading "Banks: Data breaches, info security, and risk – oh my!"...
Posted September 7th, 2006 In prepping for the panel he is leading (and I am speaking on), Eric Norlin has been reading through the mire that is NAC literature. I’ve talked about how Network Access Control (NAC) is a thorny term that is misunderstood, misused, and a bit misleading: here and here. Eric recently called for TNT, among others, to rebrand/rename the entire market space to something more clear than NAC. He suggested Network Identity Management or N-IdM. He suggested that N-IdM would be distinguished from Application Identity Management (A-IdM) – what we think of as traditional identity management. Let’s look at the typical services that A-IdM and N-IdM offer. Under the A-IdM umbrella:
- Directory Services (including meta and virtual)
- User Provisioning
- Web Access Control
- Federated Identity Management (really Federated Access Control and someday, maybe, Federated User Provisioning)
- Centralized and Stronger Authentication
- Role Management (both top-down and bottom-up)
- Reduced / Single Sign-on
- Compliance analysis and attestation
- Report and alerting
In the N-IdM bag of tricks we have: Continue reading "Out: NAC, In: N-IdM?"...
- End-point services (Identification, Authentication, and Health)
- Network admission control (Are you allowed on the network?)
- Network access control (Where are you allowed to go and what can you see?)
- Policy-driven Connectivity
- Connection protection (Tunneling and encryption)
- Identity-centric activity analysis, reporting, auditing, and alerting
|
|
what others say