Entitlement management delivers the ability to decide who gets access to a given application, what functions they can access within the application, and what they can do with the application once they are inside.
One custom application at a time
The managing of entitlement is not necessarily new. Organizations have had entitlement functionality within certain applications for quite some time. The problem has been that entitlement management has been included only in custom applications developed in-house, or by developing custom code to enable entitlement management of off-the-shelf products. Either way, entitlement management has been costly, tedious and time consuming.
In addition, this approach makes consistency virtually impossible. It is difficult to ensure that each application has entitlement management functionality to begin with. It is equally difficult to configure the entitlement management functionality consistently
Requires Free Membership to View
SearchFinancialSecurity.com members gain immediate and unlimited access to in-depth technical advice, strategies, and expert guides for securing data in high-risk financial environments. Join me on SearchFinancialSecurity.com today!
Michael S. Mimoso, Editorial Director
from application to application in those that do have it. Features and functions that exist in one application may not exist in another, creating gaps in the ability of the organization to effectively manage entitlement.
EMS to the rescue
The ability to consistently manage entitlement throughout the environment is a goal of many companies. Companies within the finance sector industry and regulatory mandates such as Sarbanes-Oxley Act (SOX), Gramm-Leach-Bliley Act (GLBA), and the PCI Data Security Standard (PCI DSS) make it almost imperative. Financial companies need to be able to enforce entitlement policies across all applications, but custom applications and custom code for commercial applications don't provide an efficient method for managing, verifying or auditing entitlement for the environment as a whole.
 |
||||
|
|
|||
|
||||
An EMS takes the configuration, maintenance, and enforcement of entitlement out of the application and moves it to the network. An EMS typically consists of three major components that provide a layered approach to entitlement management:
- Policy administration provides centralized management of entitlement policies.
- The decision point evaluates resource requests against the policies
- The enforcement point enforces the entitlement policies.
By implementing an EMS, financial organizations can remove the cost and complexity of building custom entitlement solutions into applications, and achieve more granular and consistent control of entitlement throughout the environment. Management is more efficient because policies can be changed or added within the EMS and automatically applied across the infrastructure. Compliance goals can be achieved because entitlement policies are consistently enforced across all applications, and auditing for compliance verification is enabled through the centralized interface.
Managing entitlement
The concept of entitlement management systems is relatively new, but there are an increasing number of options available for organizations that want to implement EMS. Cisco Systems Inc. (which purchased Securent Inc. -- EMS's pioneer), Jericho Systems Corp., and CA Inc. are among the growing field of vendors offering EMS products. For financial organizations, an EMS may be a prudent investment to provide consistent control over which applications users can access, and what they can do within those applications once they have access.
It is not as simple as cutting a check to an EMS vendor and deploying an appliance on the network. Depending on the size of the organization, the number of applications in use, and the number of applications that already have their own entitlement management functions built in, the process of properly configuring the EMS implementation can be tedious. Time will have to be invested to develop pervasive entitlement policies and fine-tune the configuration of EMS to properly manage and enforce them.
About the author:
Tony Bradley is a CISSP, and a Microsoft MVP. He is a Director with Evangelyze, a Microsoft Gold Certified and Voice Premier Partner focused on unified communications technologies. Tony is also a respected expert and author in the field of information security whose work is translated and read around the world. He contributes regularly to a variety of Web and print publications, and has written or co-written eight books. In addition, Tony is the face of the About.com site for Internet/Network Security, where he writes articles and tips on information security and has almost 40,000 subscribers to his weekly newsletter. Mr. Bradley has consulted with Fortune 500 companies regarding information security architecture, policies and procedures, and his knowledge and skills have helped organizations protect their information and their communications.
This was first published in July 2008