Regulatory Compliance

Every major compliance regulation requires organizations to link access controls, role-based privileges, and user activity to named users. In cross-platform environments, establishing this accountability is a complex task given the existence of multiple identity silos such as NIS and LDAP databases, platform-specific proprietary directories, and local config files managed system by system.

Centrify addresses these IT security and compliance requirements with a Unified Identity Services solution: a single, integrated architecture for authentication, access control, privilege management, policy enforcement and compliance. See the topics below for details on how Centrify's unified approaches addresses specific compliance regulations.

Simplify and streamline your IT environment while enforcing the separation of duties and role-based access controls required by the Federal Information Systems Management Act

IT security managers in federal agencies face increasingly complex challenges in securing and managing information systems that span Windows, Linux, UNIX and Mac platforms. While Active Directory serves as the single, central hub for managing Windows workstations and servers, many Linux and UNIX deployments have evolved in their own silos, each managed through separate identity stores and administrative processes. A growing number of Mac workstations are also entering the mix, introducing another layer of complexity. In addition, access to these diverse systems must be managed across a workforce that contains a mix of permanent and temporary employees, vendors and contractors.

With the passage of the Federal Information Systems Management Act (FISMA) in 2002, federal IT security managers - and the vendors and consultants who work for them - have been tasked with addressing loose practices around access control, privilege management, accountability and auditing in particular. The National Institute of Standards and Technology (NIST) has issued Special Publication 800-53 to provide guidance on complying with FISMA. While NIST SP 800-53 divides FISMA compliance into a wide range of issues, from physical security to training to IT auditing, four of its 17 sections are of specific interest to federal IT security managers. (See our FISMA white paper and on-demand webinar for a comprehensive examination of these issues.)

At a high level, however, the most essential requirements are to:

• Establish accountability by uniquely identifying each individual and linking their access rights, permissions, and audited activity to a single user identity
• Enforce a separation of duties between enterprise IT managers, who administer user identities and set policy, and departmental staff, who administer systems
• Apply role-based access controls and permission management on a least-privilege basis, giving each user access only to the systems and functions needed to perform their jobs
• Audit user activity, capturing sufficient detail to establish what events occurred, who performed them, and the outcome

In addition, the Office of Management and Budget continues to push federal IT departments toward commercial off-the-shelf (COTS) procurement in order to reduce costs, promote standardization, and eliminate standalone solutions.

The Centrify Solution

Centrify's FISMA solution simplifies and streamlines your IT infrastructure by centralizing identity and access management for Linux, UNIX and Mac systems and applications within Microsoft Active Directory. The Centrify Suite does this while addressing FISMA's essential identity and access management requirements to:

• Consolidate all identity stores in Active Directory, providing the ability to link access rights, permissions, and audited activity to a single, centrally managed user identity
• Enforce separation of duties and "need to know" access control by using Centrify's unique Zone-based access controls to define logical sets of systems that can have their own authorized users, administrators, and security policies
• Implement least-privilege security by centrally managing role-based permissions for superusers on Linux and UNIX systems
• Add additional layers of security for classified information by isolating and protecting systems holding sensitive information, and encrypt data in motion as it moves across the network.
• Capture detailed audit logs on UNIX and Linux systems to verify that access controls are working as designed and to monitor for suspicious activity

In addition, leveraging a ubiquitous platform like Active Directory helps you contain costs and eases the task of standardizing identity and access management processes across agencies and vendors.