Identity Management in Big Business - Twenty-Four Seven Security

« Many Companies Are Chasing the Wrong Security Risks: Podcast with Security Innovation | Main | Visa Sets Own PCI Standard »

October 29, 2007
Identity Management in Big Business

First, I'd like to say how glad I am that Mike Rothman has joined the security intelligentsia at ebizQ. It all started with a couple of very informative podcasts I did with Mike (here and here), and now, instead of me directing questions for Mike to answer, we're getting the answers directly from the source. Read Rothman's excellent intro article for ebizQ right here.

Now on to our regularly scheduled blog: Identity management is one of the thornier issues companies have to deal with today -- it is rife with problems of cost, compatabilitiy, complexity, and privacy -- but because of compliance, the issue is one the must be addressed. And where bigger companies often have great advantages when it comes to many security issues, in the case of identity management, it is very easy for bigger companies to get lost in a maze of identity complexity.

I found this quote on the Digital Identity Forum: "We've had the new cards for over a year, and not a single user ID or password has been eliminated. You now must have the card so you can unlock the computer so you can even GET to the programs that need user ID's and passwords. And you must use another PIN with the card. In other words, it's just another layer."

So instead of a more streamlined and simplified system, it's just one more hoop to jump through and one more identity to go missing. And adding one more layer just adds more cost. Instead, properly implemented identity management demands change throughout a company (and the bigger the company, the harder it is to change). And as the Dave Birch concludes in the blog:

"I'd probably push a little further and say that a proper digital identity infrastructure would mean that the security or otherwise of the network would become irrelevant (since all of the security would be pushed off the edge of the network) so that the distinction between internet, extranet and intranet would simply become a matter of which virtual identity is communicating with which over virtual identity."

That might be true with the perfect identity management system and perfectly trained users, but then you still have the problem of insider attacks.

Also, another reminder to sign-up for the ebizQ Security Newsletter, where you get all the security news, (including Mike Rothman, one of the top ten IT bloggers (which would pretty much make him the top security blogger)) directly into your in-box. You can do that right here.