The Business Of Identity, Access And Security V1.0

The business of identity, access and security Theo Nassiokas Head of Risk & Compliance, Information Security Westpac Banking Corporation Identity Management Forum 2007 – November 28 - 30 th What’s in it for me?

Overview ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Executive summary ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Identity Management (IDM) What is it?

Identity management defined ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Two perspectives of IDM ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Regulatory focus Access control or identity management?

What comes 1 st – The chicken or the egg? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

The common regulatory thread ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Compliance, risk & governance and identity management

Regulatory compliance ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Policy compliance ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Business risk ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Risk is easy!? Source: Dr Peter Tippett - ICSA Labs (Verizon Business), Mechanicsburg, Pennsylvania, USA

Governance ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Governance ,[object Object],Corporate governance consists of five main areas CORPORATE GOVERNANCE Risk/Security Governance Administrative and Financial Governance Operational Governance Regulatory and Legal Governance IT Governance

Objective of identity management

Conservative corporate culture ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Innovative corporate culture ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Research re: IDM as enabler ,[object Object],[object Object]

Research re: IDM as enabler ,[object Object]

Research re: IDM as enabler ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Identity management convergence

Physical and logical convergence ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Who are the stakeholders? IDM Governance Physical IT Legal, Regulatory Industry codes IP Data Protection Act (UK) Sarbanes Oxley S302, 404, 409 USA PATRIOT Act ISO 27001 California Senate Bill 1386 BCP failure Phishing Cyber crime Basel II ISO 27002 Virus incidents Physical Theft Of Info Unauthorised Software Usage System Access Control License Breach Staff screening Checks Outsourced Service Provider Control Information Access Control Network domain access Unauthorised Physical access Targeted Attack – Mass Extinction Event Privacy laws

IDM convergence is innovative ,[object Object],Example – Convergence strategy ,[object Object],Strategic Planning achieves strategy Capability Today Capability Tomorrow ,[object Object],[object Object],[object Object],[object Object],[object Object],achieved through:

Is leading an innovation easy? ,[object Object],[object Object]

Aligning IT projects with business

Why is alignment to business important? ,[object Object],Assessment of Identity Management Requirements Vision and mission for Identity Management Identity Management Strategy Identity Management Strategic Plan Identity Management Operational Plans And Budgets Assessment of technology Requirements Vision and mission for technology Technology Strategy Technology Operational Plans And Budgets Technology Strategic Plan Assessment of the Business Vision and mission for the Business Business Strategy Business Operational Plans and Budgets Business Strategic Plan

The innovation effectiveness curve

Conclusion ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Questions? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Thank you for your time!

Appendix A – Security Convergence ,[object Object],(Source: Forrester Research, "Trends 2005: Security Convergence Gets Real“) Actual ‘security convergence’ project budgets, based on surveying 60 end users from Canada, Europe and the United States: $7,039 $3,707 $1,713 $691 $311 Total $315 $191 $92 $35 $10 Other projects performed jointly by IT and physical security departments $277 $172 $81 $30 $10 Small projects $453 $202 $93 $36 $10 Large-scale convergence projects $994 $542 $248 $90 $30 Physical/logical access control projects $5,001 $2,600 $1,200 $500 $250 Public sector 2008 2007 2006 2005 2004 Spending on Converged Security Projects (per year in millions)

The Business Of Identity, Access And Security V1.0

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

En vedette

En vedette (13)

Similaire à The Business Of Identity, Access And Security V1.0

Similaire à The Business Of Identity, Access And Security V1.0 (20)

Dernier

Dernier (20)

The Business Of Identity, Access And Security V1.0

Notes de l'éditeur