Original work please.

 

This week, our focus shifts to IT services which are used in the management and mitigation of insider threat. Insiders, because of their access to information and information resources (e.g. workstations, servers, networks), potentially have the opportunity and the means by which to steal intellectual property, commit fraud, and perform other types of mischief and mayhem (ranging from pranks to deliberate sabotage).

For our focus firm, Sifers-Grayson, access control and identity management have not been a serious concern ... or so their executives and managers thought. The majority of employees and managers are from the local area where there is a strong sense of community. The founders of the company belong to families who were among the original settlers for the county. They contribute heavily to local charities and youth organizations. They rely upon these connections to family and community when hiring and have a strong tradition of promoting from within.

The problem is that Sifers-Grayson's operations and sales have taken them into the vast geographies of the Internet and cyberspace. There is an emerging awareness among the engineering staff of the potential for outsiders to attack the company through its Internet connections. The thought that an insider might cause trouble for the firm is still hard for them to accept.

The company can no longer afford to depend upon social morays and norms to protect it against the possibility of insider threats. The new contracts specifically require proper labeling of information ("data classification") and require control over access to government furnished information ("GFI"). This means that the company needs to change its culture and change its management processes.

The primary means for protecting against insider threats is to control insider access to information, information systems, and the information infrastructure. The two most basic processes used to protect against insider threat are identity management and access controls. Data classification is also an important protective process since it enables the use of the value or sensitivity of information when determining how and when to grant access. Privilege management is a third protective process which is used to protect against the misuse of permissive access to software applications and operating system functions. The principle of least privilege is an important control over this permissive access. Finally, separation of duties is a key business process which is used to prevent insiders from abusing access to information and information resources. 

Key Concepts from this week's readings include:

1. Insider Threat
2. Data Classification
3. Separation of Duties
4. Least Privilege
5. Role Based Access Controls
6. Mandatory Access Controls

Major Assignment Due this Week: Case Study #2: IGA Technology & Product Review. Case Study #2 asks you to identify and review a commercially available Identity Governance & Administration (IGA) product which can be used to manage who is granted access (identity) and how much access is allowed (privilege).

 

 

I have attached some resources as well

 

http://www.csoonline.com/article/3113451/security/identity-governance-and-admin-beyond-basic-access-management.html

 

https://msdn.microsoft.com/en-us/library/aa480030.aspx

 

http://www.capterra.com/identity-management-software/

Attachments:

• 1508743627-2012_005_001_34033.pdf
• 1508743628-CSIA 310 Case Study 2 Identity Governance Administration v2.docx
• 1508743639-ferraiolo-kuhn-92.pdf