New Software Fine-Tunes Access To Data And Apps - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
Software // Information Management

New Software Fine-Tunes Access To Data And Apps

Securent Entitlement Management Solution can be used to manage entitlement privileges not only to applications but to databases as well.

It's not hard to sell IT managers on the need for access controls that govern who has access to what within their IT environments. Any number of news stories recounting the exploits of insiders pilfering corporate data or employees inadvertently spilling confidential data out onto the Net is enough to make company a fan of access control. The problem, until recently, has been managing access controls across dozens of applications and the inability to specifically define access privileges.

This is changing as a relatively new category of access-control software, known as entitlement management, hits the market. The most recent iteration was Monday's launch of version 3.0 of Securent Inc.'s Entitlement Management Solution.

Securent EMS includes three components: one for centrally administering, managing, and monitoring entitlement policies; another for making access-control decisions in real time; and a third for enforcing those decisions. With version 3.0, Securent's software can be used to manage entitlement privileges not only to applications but to databases as well. This latest version can also be used to create entitlement management capabilities within a number of software portal products, including Microsoft Office SharePoint Server 2007, JBoss Portal 2.4 and 2.6, and BEA WebLogic Portal 9.2.

There's certainly no shortage of identity or access management vendors, many of them more established than Securent. Where Securent claims to stand out among its competitors, which to some extent includes BEA Systems, CA, and Jericho Systems, is its ability to define and enforce access right down to individual fields within an application, depending upon the type of access a user is permitted.

First American Corp., a provider of mortgage, title, and other property-related information, has big plans for entitlement management software as the company renovates its 10-year old intranet using the JBoss open-source Java application server software offered by Red Hat. The company began investigating its options about a year ago. The company first considered Oracle identity-management software, whose strength comes from the capabilities the Oracle acquired in recent years along with Oblix and Thor. But Oracle couldn't refine access control to the individual field within an application, said Gus Tepper, First American's VP of software development, in an interview.

First American is hoping that Securent's entitlement management software will give the company's system administrators the ability to restrict access to down to individual fields within the company's intranet applications. Users will not even be able to view certain fields unless it's required based upon their position with the company, the location of their office, or other specific criteria. Such capabilities aren't so much a foolproof security function as a way to maintain control over access to confidential company and customer information. "What it really does is keep people's hands out of the cookie jar," Tepper said.

Tepper clearly sees regulatory compliance requirements as driving the demand for entitlement-management software. "Today, when you get a group of SOX auditors in here, there's no central place they can go to see who has access to what," he said. "A lot of people move to different divisions within the company, but they're retaining their entitlements to information from their former departments. We need to put identity information in a central location."

Programmers have generally built access privileges into the applications they write. But First American wants some way to define access privileges once and apply them to a number of different applications. Securent enables this by letting its customers create a Web service that's called whenever a user tries to access an application.

The first phase of Securent's yearlong intranet revamp is set to go live August 20. That portion of the project will create and send notifications to all relevant departments when an employee is hired, fired, or moved to a different location. Subsequent features will be added as the project progresses, although Tepper says there are no plans right now to use Securent to restrict database administrator access, even though version 3.0 features this capability. If Securent is sufficiently able to protect First American's intranet applications and data, the company may consider a Securent implementation that offers entitlement management for Web-base applications used by customers, contractors, and business partners.

Securent's Entitlement Management Solution includes management and policy administration software, as well as policy enforcement agents and a software developer's kit for companies that want to use the entitlement management software with custom-written applications. The software also supports the Extensible Access Control Markup Language standard, which lets companies add consistent and seamless policy enforcement to applications and databases, including Oracle and Microsoft SQL Server.

Tepper considers his company's investment in Securent software to be a "low-to-mid size" expense at "a little over six figures." But that doesn't mean there isn't a lot riding on the success of this project. "I'm not in the business of throwing away a hundred grand," he said.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
Slideshows
How to Land a Job in Cloud Computing
Cynthia Harvey, Freelance Journalist, InformationWeek,  6/19/2019
Commentary
How to Convince Wary Customers to Share Personal Information
John Edwards, Technology Journalist & Author,  6/17/2019
Commentary
The Art and Science of Robot Wrangling in the AI Era
Guest Commentary, Guest Commentary,  6/11/2019
White Papers
Register for InformationWeek Newsletters
Video
Current Issue
A New World of IT Management in 2019
This IT Trend Report highlights how several years of developments in technology and business strategies have led to a subsequent wave of changes in the role of an IT organization, how CIOs and other IT leaders approach management, in addition to the jobs of many IT professionals up and down the org chart.
Slideshows
Flash Poll