Ping Identity acquires Sxip Access

Andras Cser

Ping Identity announced that it acquired Sxip Access for an undisclosed sum. The rationale of the acquisition is to allow Ping Identity's products to meet enterprise-wide, typically SSO challenges. This is important to be able to further extend Ping's market share with software-as-a-service providers. Is it a breakthrough?  Hardly. Questions still remain as to how major enterprises can integrate Ping Identity's new extended product line with an existing infrastructure in identity management and provisioning. Forrester increasingly sees broken ladder steps in the progression from the SMB market to the enterprise market for those identity and access management (IAM) vendors that have incomplete IAM product lines. Ping Identity still needs to make substantial investments to build an IAM suite, or forge strategic partnerships with pure-play provisioning and role vendors to successfully compete long-term in the IAM arena of large vendors.

Legislators to the rescue

Chris McClean

One of the most substantial trends we expected to see in governance, risk, and compliance in 2008 is the tightening of regulations in response to major risk management failures. Yesterday, we saw a clear example of that, as the US Senate approved a bill that would nearly double the size of the Consumer Product Safety Commission, largely in response to the massive toy recalls that took place last year.

Also this week, the UK’s Medicines and Healthcare Products Regulatory Agency showed signs of cracking down on disclosure of drug trial results after problems persisted with certain anti-depressant drugs in relation to teenage suicide (even though criminal charges will not be filed).

The sub-prime issue may likely be the next major target for legislative changes, although most discussion seems to be focused on consumer protection at this point, not tighter control over lenders.

Read more

Reward: $68 million for ratting out your employer

Chris McClean

It has been a busy few weeks of news for whistleblowers.  Earlier this month, former Merck sales manager H. Dean Steinke was awarded $68 million of the roughly $400 million recovered by states and federal agencies when the company settled a lawsuit he brought against it seven years ago. (This was part of a larger $671 million Merck paid to settle complaints of overcharging government health plans and offering inappropriate incentives to doctors to prescribe its products.)

While a number of whistleblowers have been lauded by the press over the years, Steinke’s $68 million presents the possibility of more tangible incentives to those aspiring to expose corporate crimes. Other recent, related news includes:

- Court extends SOX whistleblower protection. Last week, a US District Court judge in New York found that whistleblower protection under the Sarbanes-Oxley Act applies to employees outside the United States, helping empower virtual armies of international employees that may have something to report.

Read more

Dell Acquires MessageOne And Buys Its Way Into SaaS

Stephanie Balaouras

Stephanie It’s official, the future of information management and infrastructure is software as a service (SaaS). Today, Dell announced its intent to acquire the powerhouse in email continuity and archiving, MessageOne. This acquisition will give Dell the cornerstone that it needs to build out its own suite of SaaS offerings. Dell clearly didn’t want to be left out of race as it watched Iron Mountain successfully building out its SaaS offerings and watched its competitors and partners complete significant acquisitions in the market including Seagate Services’ acquisition of Evault, EMC’s acquisition of Mozy and IBM’s recent acquisition of Arsenal Digital Solutions. Then there’s Symantec who is building out its Symantec Protection Network.

Read more

OpenID family grows – How it can transform Identity Federation between enteprises

Andras Cser

With Google, IBM, Microsoft, VeriSign, and Yahoo! joining the OpenID Foundation, we may actually feel that something in federated access management is going to change. It is finally not the case of a vendor proposing a new standard – and adding to the cacophony of federation standards – but a set of moves towards a simple technology that today can alleviate password management woes at service providers.

Technology aside, OpenID will greatly help with reducing and removing the legal obstacles in the way of  identity federation’s proliferation. When payment-grade, commercial, and trusted identity provider service becomes a reality – VeriSign’s joining the OpenID camp clearly points in that direction – and software-as-a-service companies (like salesforce.com),  accept OpenID authentication from these trusted identity providers, then enterprises can truly start thinking about outsourcing password management identity management processes. When required, strong authentication integration with OpenID can rely on VerSign’s VIP or other vendors’ strong authentication acceptance network.

Read more

What Constitutes A $7B Control Failure?

Chris McClean

The media yesterday (Wall Street Journal, Associated Press, Economist, etc.) were all over 31-year-old Jérôme Kerviel, the trader at France’s Société Générale who has apparently confessed to fraudulent trades resulting in an estimated loss of roughly $7.2 billion.

In further coverage, we hear that the bank has apologized to share holders, filed legal claims against Kerviel, and promised the public that the incident does not suggest any larger issues with the company’s risk management. The Wall Street Journal however, follows up with a story questioning the effectiveness of regulatory oversight that can let something like this transpire despite Société Générale’s claims that controls were adequately tested and did not fail.

Read more

Keeping up with global regulations

Chris McClean

The Foreign Corrupt Practices Act (FCPA) has been seemingly more newsworthy than usual recently (even impacting Hollywood elite), with somewhat conflicting accounts of the US cracking down on bribery both here and abroad, and the rationale for the US to accept some level of bribery for the sake of broader national interests.

Read more

Risky by association

Chris McClean

The holiday season gave media and industry one more opportunity to discuss Mattel’s massive product recalls this year, and admittedly, I still find myself interested in the story. In this case, it was the World Business Council for Sustainable Development’s article calling out Mattel’s “Epiphany at Christmas”. 

The revelation: “If it's got your company's name on it, it's your problem.”

Read more

New Year's Resolutions for choosing online retailers

Andras Cser

With CardSpace and Higgins being in nascant and almost non-existent market adoption mode, you may wonder what authentication features you want to be looking for when shopping online. Usernames and passwords are a thing of the past: you can safely assume that you will use a computer to log in which has a keylogger or trojan capturing your keystrokes, and with it your username and password.

Savvy customers are increasingly turning towards online retailers and financial institutions which provide at least some form of multi-factor authentication to protect against password theft. The following list gives a compass to consumers and vendors to navigate the misty waters of online transactions.

Smart cards / USB tokens (very costly, high level of security, great user inconvenience)

Hardware based solution that contains applications, PKI certificates used to authenticate to a site. These cards can include a magstripe for physical access management and RFID proximity sensors.

Read more

Categories:

Risk Management Lessons from the ‘Mortgage Meltdown’

Chris McClean

Great article this morning in the Wall Street Journal about Goldman Sachs’ performance during the credit meltdown. The company has expectations of record income this year, while competitors are faltering left and right.

There are three important issues in this story — and in the sub-prime crisis in general — that all good risk management professionals know, and should keep in mind as often as possible.

Read more