Milton H. Hernandez

Privileged identity management in enterprise service-hosting environments

IAM needs will only grow as devices, servers, and end points continue to increase . Current schemes are not sustainable as the number of IDs will explode. Environment is heterogeneous, and constantly adding new systems including Cloud. Our solution offers a platform where a user gets an individual user ID on a system - but only if they need it, when they need it, for only as long as they need it . Reusable ID scheme reduces the number of IDs in the system yielding cost savings on lifecycle management activities, improved security compliance . A compliance readiness platform can be enabled to prevent, flag, or monitor questionable access in or near real-time . Provide easily accessible logs to prove compliance policies.

Hybrid Role Mining for Security Service Solution

IT services delivery is a complex ecosystem that engages 100000s of system administrators in service delivery centers globally managing 1000s of IT systems on behalf of customers. Such large-scale hosting environments require a flexible identity management system to provision necessary access rights, in order to ensure compliance posture of an organization. A popular and effective access control scheme is Role Based Access Control (RBAC). Ideally, a role should correspond to a business function performed within an enterprise. Several role mining algorithms have been proposed which attempt to automate the process of role discovery. In this paper, we represent the user-permission assignments as a bi-partite graph with users/permissions as vertices and user-permission assignments as edges. Given a user-permission bi-partite graph, most role mining algorithms focus on discovering roles that cover all the user-permission assignments. We show that by relaxing the coverage requirement, one can improve the accuracy of role detection. We propose a parameterized definition of a role based on graph theoretical properties, and demonstrate that the role parameters can be controlled to balance the accuracy and coverage of the roles detected. Finally, we propose a heuristic to illustrate the efficacy of our approach and validate it on real and artificial organizational access control data.

Integrated user activity monitoring for regulatory services

Regulations such as FFIEC [5] and HIPAA [6] require activities of system administration to be captured and reviewed regularly. In IT service delivery environment, system maintenance activities are usually performed by the service provider whose system administrators access customer environment based on problem and change ticket being assigned.