Untitled Document
Today's turbulent economy is producing a perfect storm for massive insider
threats. Shotgun mergers on a grand scale, which historically would take months
of due diligence to complete, are happening over the weekend. Staggering levels
of layoffs are being announced weeks before they're being executed, leaving
employees in a state of fear and uncertainty. And, to add to our angst, the
talking heads on the nightly news maintain a running dialogue about the economy
that bounces between global recession and massive depression.
At the same time, there is more temptation and more opportunity to commit fraud
than ever before. Why? Because there is now a market for stolen data -- a sophisticated
network of organized criminals trafficking in personal information -- social
security numbers, bank account information, etcetera. Via the Internet, criminals
are actually soliciting employees to trade confidential information for money.
A former Countrywide Financial employee was recently arrested for selling mortgage
customer data to one of these criminal networks over a two-year period. As many
as two million customers may have had their personal data compromised.
To avoid falling victim to escalating insider threats, organizations should
take note of a rapidly emerging category of identity management called identity
governance. Identity governance enables companies to identify, measure, and
manage the risk associated with employee access to sensitive applications and
data. These products and services address the business and IT dimensions of
managing risk. Identity governance approaches identity management as a cross-department,
enterprise discipline that provides a layer of intelligence to give institutions
the business insights needed to strengthen IT controls and protect corporate
assets.
Now more than ever before, the issue of good identity governance is a strategic
imperative for global companies. It is critical for organizations to inventory,
analyze and understand the access rights of their employees -- and be ready
to answer the critical question who has access to what? The better
a company understands which users have access to critical corporate assets,
the better it can realistically understand its potential risks if the organization
acquires another company, is acquired by another company, or undergoes a significant
downsizing.
-1-