Free Newsletter
Register for our Free Newsletters
Newsletter
Zones
Access Control
LeftNav
Alarms
LeftNav
Biometrics
LeftNav
Detection
LeftNav
Deutsche Zone (German Zone)
LeftNav
Education, Training and Professional Services
LeftNav
Government Programmes
LeftNav
Guarding, Equipment and Enforcement
LeftNav
Industrial Computing Security
LeftNav
IT Security
LeftNav
Physical Security
LeftNav
Surveillance
LeftNav
View All
Other Carouselweb publications
Carousel Web
Defense File
New Materials
Pro Health Zone
Pro Manufacturing Zone
Pro Security Zone
Web Lec
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
 
News

Mounting demand for large enterprise identity management.

CyberArk Software : 27 March, 2008  (New Product)
Enterprise Password Vault from Cyber-Ark enables identity management at the application level and is ideally suited to larger organisations.
Recent breaches around the world, amounting to billions of dollars, have shaken the world's business community into closely scrutinizing their "back-office" security controls. Companies such as Cyber-Ark Software are seeing an unprecedented demand from corporations globally looking for solutions that will securely manage their privileged identities.

Cyber-Ark Software recently released a breakthrough approach to securing application-to-application credentials - which has been timely in light of predictions that both Jerome Kerviel at Societe Generale and the anonymous informant who gave out customers' details at the Liechtenstein Bank, part of the LGT Group to both the German and UK Tax Authorities, were able to do so due to the lack of security controls over privileged users. Enterprise Password Vault (EPV) 4.5 addresses the full range of security and audit challenges surrounding application identities within applications, scripts and application servers.

"The investigations are not complete, but both of these recent occurrences within European financial institutions most probably came down to the lack of IT security controls and processes to protect and manage privileged access to systems and applications," said Udi Mokady, president and CEO of Cyber-Ark. "Organizations have got to learn to take greater care of their sensitive information to make sure it is not accessible to staff without proper controls. Securing sensitive data and managing access to privileged accounts is crucial if more institutions are not going to haemorrhage vital information, costing them greatly financially as well as leaving their reputation somewhat tainted."

Research by CERT and law enforcement agencies shows that 86 percent of those who've committed cyber-crimes held technical positions and an overwhelming 90 percent had system administrator or privileged system access.

Managing credentials for application authentication poses security, auditing and administration challenges, and the lack of management of these powerful identities has been the "elephant in the room" in the IT infrastructure. Medium to large enterprises usually have thousands of servers, each running many applications, thousands of processes, and scripts that constantly use the credentials in order to communicate with databases and other systems.

Despite this fact, while more than 90 percent of enterprises regularly change passwords for employees, up to 42 percent never change hard-coded and embedded passwords for application IDs, testing scripts and batch jobs. This is in direct conflict with their own internal security policies, and is increasingly being highlighted by both internal and external audits covering a range of governmental and industry specific regulations such as SOX, PCI, Basel II and NERC/FERC.

"While all of the platforms accessed via a privileged password are critical and vulnerable, a particularly complex situation arises with embedded application passwords," said Sally Hudson, research director for IDC's Security Services and Identity Management Products program. "The danger of these application-embedded passwords being misappropriated or mishandled is growing accordingly, and organizations should take measures to make Application Identity Management a strong component of their overall IAM system implementation."


"What we're seeing and hearing from customers, partners and prospects is that securing privileged accounts—and application passwords in particular—is their number one area of concern right now. Cyber-Ark has never seen a greater interest from global companies seeking us out for a technology solution that can securely manage, store and audit their application identities," added Mokady.


The latest release of Cyber-Ark's Enterprise Password Vault (EPV), version 4.5, provides the only solution to fully address the challenges of Inter-application authentication. EPV eliminates the need to store App2App passwords in applications, scripts or configuration files, and allows these highly-sensitive credentials to be centrally stored, logged and managed with Cyber-Ark's patented Vaulting Technology. Using EPV, organizations may comply with internal and regulatory requirements for regularly replacing passwords and securely monitoring privileged access across all systems, databases and applications.

EPV 4.5 enhancements for Application Identity Management (AIM) include:.

Application and Scripts Credential Management:

* Secure Cache for Performance and Availability - EPV 4.5 introduces an advanced local password cache which greatly improves the solutions performance, scalability and availability to thousands of calling applications and scripts.


* New Application identity Management infrastructure - Version 4.5 introduces the next generation of the Application Identity Infrastructure. With options for error detection, timeout periods and other finely tuned options, applications can now optimize secure, efficient and auditable password management.

Application Server Credential Management:

* No Code Changes Required - Cyber-Ark's EPV 4.5 introduces a patent-pending approach to eliminating hard-coded credentials in Application Servers' data sources. The unique advantage of this solution is that no code changes are required in applications that use the application server's data sources. With out of the box support for IBM WebSphere and BEA Weblogic, EPV 4.5 ensures that critical passwords required for applications running on Application Servers are always available but are never exposed or vulnerable.

* Eliminating Downtime During Password Change Process - EPV 4.5 introduces a novel approach to password replacement for pooled credentials that does not require the Application Server to be restarted in order to synchronize its connection pools. With many customers using mission-critical production Application Servers, the ability to avoid restarting them as part of a password replacement process provides huge benefits in reduced administrative overhead, operational risk mitigation and no downtime.
Bookmark and Share
 
Home I Editor's Blog I News by Zone I News by Date I News by Category I Special Reports I Directory I Events I Advertise I Submit Your News I About Us I Guides
 
   © 2012 ProSecurityZone.com
Netgains Logo