Identity and Access Management

1. Identity and Access Management IIA Detroit Chapter Dinner Meeting Vis Ta Tech Conference Center January 8, 2008 Stuart McCubbrey Director, Information Technology Audit General Motors Corporation Sajai Rai Partner, Advisory Solutions Practice Ernst & Young LLP

2. Agenda • Introduction • Business Drivers • Identity and Access Management Background • Key Concepts • Identity Management vs Entitlement Management • Identity Components • Access Rights and Entitlements • Provisioning Process • Administration of Identities and Access Rights Process • Enforcement Process • Use of Technology • The Role of Internal Auditors • Identifying Key Risks and Controls

3. Business Drivers • Identity and Access Management • Touches entire business • Mix of Technology and Process • Key Drivers • Reduced information security risks • Reduced IT operating and development costs • Improved operating efficiencies and transparency • Improved user satisfaction • Increased effectiveness of key business initiatives • Improved regulatory compliance

4. Identity and Access Management Background • Three Key Questions • Define who has access to what information? • Is access appropriate? • Is access and activity logged and appropriately monitored? • Adoption Risks • Organization complacency • Participation • Planning • Communication • Incorporation of all systems into the process • Process complexity • Weak process • Lack of enforcement

5. Key Concepts • Identity Management vs. Entitlement Management • Identity and Access Management Process • Entitlement Management

6. Key Concepts • Identity Components • Identity Types • Identity Onboarding • Identity Offboarding • Access Rights And Entitlements • Entitlement Changes • Privileged Account Management • Segregation of Duties

7. User Provisioning Process • Approve • Propagate • Request • Communicate • Log

8. Administration • Periodic Audit • Segregation of Duties • Entitlement Review • Policy Administration • Creation of IAM Policy if non-existant • Periodic update of IAM Policies • IAM Strategy • Components • Process • Activities • IAM System Administration • Manage processes & systems • End-user Password Administration • Creation and communication of initial passwords • Resetting lost or stolen passwords • Managing complexity of passwords • Reporting • Lists of identities and accesses for review • Approval lists • Lists of group and supervisory accounts

9. Enforcement Process

10. Use of Technology in Identity and Access Management • Provisioning Process • Request forms & Workflow capabilities • Communication of changes • Generate initial passwords • Perform Segregation of Duties Analysis • Enforcement Process • Authentication • Authorization • Logging and Reporting • Create logs of use • Generate reports of users with access • Single-Sign On • Remote Access

11. The Role Of Internal Audit In Assessing IAM

12. Assessing Inherent Risk – Four Foundational Questions • Can all users accessing any system be uniquely identified? • As a supervisor, do you know all systems your employees have access to? • Are all roles that create segregation of duties conflicts identified and do you know who can use them? • When Human Resources exits employees from the organization, is all system access terminated? Show of hands – Who can confidently answer “Yes” to all four questions? Yes = Apply your Audit Resources elsewhere; No = There is risk to assess

13. Assessing Inherent Risk – Why is IAM important? • Central to Confidentiality & Integrity of Business Information • Information Security is commonly defined as protecting the Confidentiality, Integrity & Availability of Business Information • IAM directly covers the “C” and the “I” and even indirectly the “A” • Applies to: • The Information element itself • Credentials to access the information • System software that hosts the information • Application transactions that can allow access Do you care who can view and change your business information? Of course you do…… Your Company’s success depends on it

14. Assessing Inherent Risk – Why is IAM important? • Regulatory Compliance • If IAM is linked to Information Security, then multiple laws and regulations apply: Sarbanes Oxley, HIPAA, Gramm-Leach-Bliley, various privacy laws etc., etc., etc. • Companies have received SOX Significant Deficiencies for Access Control deficiencies (STATS ??) 10 years ago – A Big Collective Yawn from Management Today – Public disclosure of control weaknesses

15. Assessing Inherent Risk – Why is IAM so problematic? • Proliferation of Identities Required • # of applications (GM has over 2,500) • # of different platforms hosting applications & devices: Mainframe, Windows, UNIX, Cisco, VPN etc. • # of non-employee users: Suppliers, Dealers, Joint Ventures, Consumers, Outsourced Providers etc. • Human beings & programs • Varying levels of access required, from limited view access to full administrative control • Bigger risk issue for larger, de-centralized companies In 1989, I had one ID & password to log onto the mainframe – That changed with PC & Server platforms

16. Assessing Inherent Risk – Why is IAM so problematic? (CHART – LAYERS OF IT CIRCLE DIAGRAM)

17. Assessing Inherent Risk – The Big Picture • Assess IAM risk in terms of People, Process & Technology: • People: Any process or technology is going to be executed by human beings • Are people aware of policies & processes? • Are those policies & processes clear and effectively communicated? • Are there specific management control expectations? • Are there consequences for non-compliance? • Accountability without consequences is meaningless The “problem” is rarely access change requests not being processed, its more they were never submitted

18. Assessing Inherent Risk – The Big Picture • Assess IAM risk in terms of People, Process & Technology: • Process: Is everybody on the same page? • Is there a common understanding of how to add/change/delete Identities and Access levels? If not, execution will be all over the map • Are the processes documented? • Are the processes manual-intensive? If so, they are very people-dependent and prone to error and/or non-performance How global, common, standard are the processes?

19. Assessing Inherent Risk – The Big Picture • Assess IAM risk in terms of People, Process & Technology: • Technology: Is it there? • Are there multiple directories holding access data (identities, authentication credentials, authorization levels)? Are they at all linked? • Is there any automated workflow in the various access add/change/delete processes? All manual? • Are their usable reports for data owners to conduct periodic access reviews? You can’t control what you don’t know

20. Assessing Controls – Key Control Themes • Prevention vs. Detection • Sure, you need periodic access reviews – But they are after-the-fact, typically manually intensive and resisted by system owners • Focus on controls at the front-end of the “Add-Change-Delete” access process: • Are SOD conflicts and business need truly assessed before access is granted? • Are their links between Human Resource processes and systems and down-stream systems to revoke access? A controlled process at the start should mean cleaner access reviews later on

21. Assessing Controls – Key Control Themes • Use layers to your advantage • When users leave, ensure the front doors are shut off first: Network, e-Mail, VPN • Helps mitigate the risk of unauthorized external access, can work on internal application access revocation next • With internal application access, the risk is narrowed to users with existing access using inactive accounts

22. Assessing Controls – Key Control Themes • Data Cleansing • Is Management addressing dirty data? • Identify and remediate duplicate IDs: How can you have accountability if you can’t link access activity to a specific human being or program? • Identify and remove application segregation of duties conflicts

23. Assessing Controls – Key Control Themes • Reduced Signon (let’s not call it “Single Signon” just yet…) • As you reduce the distinct numbers of identities required, you reduce potential points of control failure • Have applications use central authentication sources (e.g., LDAP Directories, Active Directory) • Synchronize passwords between applications Start to unwind the complexity

24. Assessing Controls – Key Control Themes • User Education & Awareness • Usually the most cost-effective control • Do employees know the true cost of uncontrolled access? Can you make them care? • Do they want to do the right thing, but just don’t know how? • Does an existing Information Security Awareness Program exist and does it address access risks?

25. GTAG 9 – Identity and Access Management

26. Questions and Answers