Identity Management in Higher Education

/0 Comments/in , /by

Introduction

Technology plays a crucial role in the universities and institutions where students, alumni, faculty, and staff depend on high-tech services and tools to study, live, work, and play. As these institutions embrace the Internet for student services, administrative systems, research projects, self-service, and profile management, online security is at a premium. Users must feel protected for web channels to grow and enhance the user experience. At the same time, compliance mandates have become more complex and university breaches become more numerous; both which threaten the institution’s assets and brand name. Institutions that cannot meet this security demand will suffer.

PathMaker Group can help prepare educational institutions for these challenges by developing solutions for:

– Centralizing application access control.
– Providing strong, multi-factor authentication.
– Providing sophisticated real-time risk analysis and access prevention based on events and rules.
– Automating routine account management activities.
– Meeting regulatory requirements for reporting and attestation.
– Enabling new modes of inter-campus interactions.
– Protecting user identity data with a secure, scalable and highly available infrastructure.
– Bridging islands of user identity information across a variety of infrastructures. Read more

IBM Pulse 2012

/0 Comments/in , , /by

Business Without Limits!

Pathaker Group is an IBM Premier Partner with the sales and technical certifications required to sell and implement an ever expanding array of best in class security solutions from IBM. Be sure to put Pulse 2012 on your calendar and stop by the Solution Expo and visit our booth. Business partners and customers will learn how IBM is shaping the IT Security Landscape with newly acquired technologies and integrated solutions to meet the growing challenges that we face.

Check out some info from IBM about Pulse!

“Pulse 2012 returns to the MGM Grand in Las Vegas March 4-7, 2012 and we invite you to take part in the action! Experience first-hand how organizations in every industry are using Visibility Control Automation to improve the economics of their business infrastructures and speed the delivery of innovative products and services.

With over 7,000 attendees including industry-renowned speakers, Pulse 2012 is your ticket to hundreds of technology leadership sessions, industry-focused breakouts, and technical skill-building workshops. At this year’s conference you’ll have an opportunity to network with colleagues, participate in hands-on labs, and attend our largest-ever Solution Expo. Don’t miss this significant event!

The Pulse conference is now accepting session submissions! Visit the IBM Speakers page for the timeline, benefits and guidelines, or to answer the Call for Speakers today!” (IBM) Read more

Security and Identity Management Solutions for the Healthcare Industry

/0 Comments/in , , , /by

Do you work in the medical or healthcare industry? Is your company in need of security or identity management solutions? If so, here are some of the key ways in which PathMaker Group can provide value in this field.

Enterprise Single Sign-on Doctors and nurses have a lot of passwords to manage as well as using shared workstations creating potential issues around people sharing a user ID to an account and people leaving an application or patient information open on a shared workstation. With ESSO, PathMaker Group can give the users a secure way to store all their passwords and automating the login and logoff process.

  • ESSO can be paired with an RFID badge – a quick tap of the badge can log a user on or off from the workstation, saving the time of entering the user ID and password over and over again as they switch between machines all day. A proximity sensor can be added to workstations to automatically lock them when a user forgets to tap out as they walk away from the machine.
  • Shared Workstation Management – Shared machines can be configured to be locked when an ESSO user leaves the workstation. When the next user comes in, any apps left open by the prior user can be gracefully closed to prevent the new user from having patient access under the prior user’s account.
  • Context Management ESSO can further streamline the process of accessing patient records across multiple applications. Tools, such as CareFX Fusion Context Management, provide the ability to script the sharing of patient identification across applications, removing the need for constant searches and patient lookups. Read more

Addressing NIST’s New Risk Management Framework

/0 Comments/in , , , /by

The National Institute of Standards and Technology (NIST) created a series of publications that provide guidance for federal agencies on the implementation, certification and accreditation of federal information system security. The same guidelines hold true for all commercial agencies/companies as well.

So the question that comes to our mind What is NIST’s New Risk Management Framework? NIST describes the RMF model as a series of six repeating steps designed to identify the security mechanisms necessary for an IT system, implement those protections, and validate their proper operation over the systems lifecycle.

 

 

 

 

 

 

 

Read more

Security and PCI-DSS Compliance

/0 Comments/in , , , , /by

The question of whether compliance makes your networks secure often comes up when performing Payment Card Industry (PCI) Data Security Standard (DSS) remediation and audit work. Many believe that compliance with the PCI-DSS means their networks are secure from exploitation. Unfortunately this is not the case. Passing an independent PCI audit usually indicates reduced vulnerability for those PCI related areas tested, however the PCI segments are usually a small portion of the overall networks.

The payment card industry has one goal in mind and it is not to protect or provide security for your network. Their goal is to protect credit card and card holder data. They do this to limit their potential liability and transfer responsibility for that liability to the entities that provide, accept, use, store or transfer credit card and card user information. That is almost all businesses and many institutions here and around the world. Read more

The Importance of Hiring an Experienced, Qualified Security Assessor for Your PCI-Compliance Audit

/0 Comments/in , , , , , /by

With the stiff penalties associated with failure to meet standards set by the PCI Security Council, ensuring that your company remains compliant and avoids security breaches requires regular PCI compliance audits. Hiring qualified security assessors can help you avoid a number of potential pitfalls associated with audits. Opting to hire the most experienced candidates offers a number of benefits, including:

  • Getting it Done Right
    In 2004, CardSystems Solutions was hacked, resulting in 263,000 stolen credit cards and roughly 40 million compromised. This breach occurred despite their security auditor giving them a clean audit just three months prior. Hiring experienced PCI compliance auditors to perform your audits lessens the likelihood of potentially costly mistakes.
  • Continued Security
    Experienced PCI compliance auditors not only understand current standards, but they understand the areas in which the current standards fall short. This allows you to proactively anticipate security risks and protect your customers’ data. Understanding the current problems, as well as the next generation of threats, allows you to remain in compliance and prevent costly security breaches. Read more

Different Types of Incidents that Can Result in Compromised Network Security and Information

/0 Comments/in , , , /by

Network security is an important consideration for any business that is connected to the internet, but especially for businesses entrusted with sensitive customer information. Penetration testing and PCI compliance are important safeguards for protecting customer data, but what are the ways in which customer data might become compromised?

  • Malware
    Malware is one of the most pervasive network security threats these days. Malware is a comprehensive term to describe viruses, worms, Trojan horses, tracking cookies, and many other types of threats that include malicious code or software that aims to breach your confidentiality. They can be detected and removed with most software security suites.
  • Cybercrime
    While malware attempts to breach your security from inside your computer, cyber criminals attempt to breach your security from afar. Hacking and cyber crime causes tens of millions of dollars in losses every year. One way to prevent cybercrime is to have an IT security professional perform penetration testing on your system to find loopholes and close them. Read more

Using IBM Tivoli Access Manager for Enterprise Single Sign On to Secure your Passwords

/0 Comments/in , , , /by

A sticky note on your monitor is a good way to remember to bring home a gallon of milk to stay out of the doghouse with your spouse. A sticky note hidden around your desk with all your passwords is a good way to end up in the doghouse with your company’s IT security group!

Let’s face it; it’s hard to remember the passwords for every application we have to use at work. It’s even more challenging when the interval to change passwords is different for every application. Hmmm is my email password myusualpassword12, myusualpassword13 or myusualpassword14?

It’s natural to want an easy way to keep track of them. This leads to insecure things such as using your dog’s name, much easier than remembering X1nP4!e. It’s also easy for someone that knows you to socially engineer that password. Writing the complex password down is easy too. Again simple for someone to flip the keyboard to that sticky note and gain access to your accounts. Read more

Zombie Attrition Process (ZAP)

/0 Comments/in , , /by

Zombies are everywhere; they lurk in existing and new systems. These zombies don’t lust after our blood or consume our flesh. It is much worse than that. These zombies can cause companies to fail audits, they can be used for unauthorized access, and worst of all they can cost companies money. Technically we are talking about lifeless accounts that exist on systems and no one knows who they belong to. To us on “Team ZAP” or the Identity Management team these accounts are known as ‘Orphan Accounts’. I don’t know about you, but identifying and removing Zombies just sounds more fun.

Not the kind of Zombies you’re interested in? If you are wondering for how to prepare for the basic flesh eating zombie apocalypse, visit our friends at the Centers for Disease Control.

 

Picture from: http://emergency.cdc.gov/socialmedia/zombies_blog.asp

If you want information on how to deal with Zombie or Orphan Accounts then keep reading. For full disclosure, dealing with Zombies is not for the faint of heart and I am not saying you wouldn’t get your hair mussed. Here at PathMaker Group we don’t mind getting a bit dirty when we deal with Zombies or Orphan Accounts in this proven approach: Read more

Successful Security Projects

/0 Comments/in , , /by

Great solutions require strong products, thorough planning and aggressive deployment.

Why close the barn door after the horses escape? or An ounce of precaution is worth a pound of cure. Another one, Why solve a problem that we do not have?

These expressions come to mind when addressing security issues for the premises where we work, our homes, bank accounts, credit cards and anything else of value to us. In this environment where everything is faster and better, comes the need for us to understand the complexity of it. This world is where we live and we need to protect our assets. The expression Nip it in the bud before it becomes a problem is best suited for security. Just by observation, we see exposures and are grateful we saw them first. Read more