What I've been up to

It's been almost ten years since I have posted anything here and well I want to bring this blog back to life. My original thought was to post random notes on technical issues as well as solutions and well life got busy. When I first started this I was an independent IAM consultant/architect and focused on IBM technology (ISIM, ISAM, etc). I have since joined Sirius Computer Solutions (2015) and took the reigns as the principal architect for our IAM practice. It's been a wild and fun ride building a small practice with less than 10 customers to a large and successful part of our overall $820M security business completing more than 100 implementation projects a year. More importantly we have grown from a single vendor expert implementation team to a customer focused IAM consultancy supporting over 18 vendors in the IAM space including IBM, SailPoint, Okta, Duo, Microsoft, Micro Focus, SecureAuth, Ping, One Identity, Idaptive, RSA, Radiant Logic, Saviynt, CyberArk, BeyondTrust, Centrify and Thycotic. I also keep a pulse on the IAM market and am constantly reviewing up and coming vendors including Auth0, OneLogin, ForgeRock, Transmit Security, Clear Skye, Aquera, Remediant and others.

Over the next few months I'm wanting to post about various solutions we have developed, new technology as well as vendor and product reviews. My overall thought process around IAM is that the technology is only 30% of the overall strategy to build a successful IAM program so some of the things I am going to post about will be around organizational alignment, change management, etc. By putting this out there I'm committing myself to putting great content that I hope the community will find interesting and helpful. If there are any specific topics or questions feel free to contact me.

Thad Smith

Comments

Post a Comment

Popular posts from this blog

Load Balancing Web Services with WebSEAL

I came across this bit of information from an old email from several years ago, and wanted to capture it here for future reference. In case you're thinking of using a WebSEAL server as a proxy for a web service based application (SOAP or REST), there are some details you need to be aware of in how you tune your servers for a successful implementation. The advantage to using a WebSEAL server for proxying web service traffic is that you can enforce authorization based on the client ip address (typically a client web application). This isn't as strong of security as performing authenitcation and authorization using WS-Security or SAML, but if these options aren't available, WebSEAL can increase the security by only allowing certain ip addresses to access the application using POPs (Protected Object Policies). What you have to be aware of is the fact that the client opening the connection to the WebSEAL server is typically another application. This creates a problem if th...
Read more

Leveraging Azure MFA with CyberArk

Image
Posting this here for future reference. We had a customer that wanted to leverage Azure MFA for authenticating users (IT Administrators) to CyberArk for accessing servers and checking out privileged credentials. CyberArk has two mechanisms to support this: 1) RADIUS authentication or 2) SAML authentication. We initially attempted to implement RADIUS authentication using Microsoft's Network Policy Server with the Azure MFA plug-in but threw up the white flag after many hours of debugging network packet captures. In the end we implemented this use case using Azure SSO to provide SAML-based single sign-on to CyberArk. RADIUS authentication is a bit more "legacy"but has been the de facto protocol for step-up authentication use cases for many years. I won't get into the history of RADIUS but it has been around for a very long time (almost as long as the internet) and is widely used for network authentication such as to an IPSEC-based VPNs and 802.11X based Wireless network...
Read more

Role-based Identity Management Best Practices

Image
This is a white paper that I put together a few years ago for a large financial organization that was struggling with how to approach RBAC or role-based identity management without having the new AI and machine learning capabilities with some of the new IGA solutions such as SailPoint IdentityAI. Introduction Role-Based Identity Management and Role-Based Access Control (RBAC) has long been the nirvana of Identity & Access Management programs since the concept of distributed systems was introduced. The idea of aligning access needs to the business functions that users fulfill and streamline provisioning of that access has proved to be a constant challenge in terms of both IT operational efficiency as well as Compliance, Risk and Security needs. This paper aims to address the challenges for effectively managing role-based access and identify best practices to help organizations achieve better IT efficiency, reduce risk and increase security for their users, data and applications. Rol...
Read more