Identity Management System
Buy custom Identity Management System essay
Jacket-X is a large corporation located in a large city. It is involved in the development, manufacturing, marketing and distribution of specialized jackets, which are used in the waste disposal and various health and safety related applications. It is also involved in development of new glove designs and coatings. These developments are done at a research laboratory located near a large university. There are several factories and warehouses operated by Jacket-X in various parts of the country. The distribution and selling of the gloves are done in various retail and wholesale outlets all around the country. The growth of the company has been enhanced by the high use of technology, which helped increase productivity and efficiency of the operations of Jacket-X. This has led to introduction and implementation of an identity management system, which has raised privacy interests among the employees. The corporation has also offered an initial public offer to sell its shares to the public. This will enhance the corporation to raise funds for development of new research laboratories. To offer the shares to the public, Jacket-X has to prove that the financial reporting system complies with the Act of Sarbanes-Oxley (SOX) (Prentice & Bredeson, 2009).
The increased use of technology in Jacket-X Corporation has raised various Cyber security concerns. An identity management system will help the organization to provide a facility of workflow-based identity by providing passwords and identity reconciliation. These products will allow user authentication and validation, while providing basic access to the management and control of resources. An identity management system will also provide an ability to implement various rules based on various compliance validations. The system will also provide access and authorization controls and various enterprise rights for management. Strong authentication and authorization of access will include the use of tokens, passwords, biometric controls and the innovative, new approaches of improving authentication and authorization. The identity management system will be pivotal in providing the network access controls, authentications and authorization. The network access controls will have additional features, which will facilitate virus definition and protection and application protocols (Agre & Rotenberg, 2000).
In the previous year, the corporation had experienced various issues with the payroll system. However, no evidence could be found to confiscate any person for fraud or embezzlement of the organization funds. This developed serious concerns on the vulnerability of the financial reporting system security (Smith, 2002). Therefore, as the company announces offering of its shares to the public there is a need to develop a systematic identity for the organization to ensure the security of its resources and assets. Every person has his/her own identity, and the organization needs to develop its own identity in the operations and performance of the duties. Jacket-X Corporation needs to incorporate the concept of its identity in the use and development of the information technology in the firms. Identity management occurs in every stage of the organization operations. These may be applied in the sales forecast in the organization and the determination of method and frequency of the forecasting. The identity management system will facilitate the company to develop measures used in the development of a secure business environment. The identity management system will be used by the company in management of authorization system and restriction of access to unauthorized persons. The system will allow the company to assign identities to various employees and customers. However, security concern has been a global concern on the identity management enabled networks. The rising intrusion and unauthorized access in the cyber space have been issues in the current use of the cyberspace. Within the implementation and development of an identity management system for Jacket-X the management, the corporation has invited various vendors, and only three vendors have responded (Khosrow-Pour, 2006).
Privacy Concerns of Identity Management System
In designing of an identity management system, Jack-X Corporation must consider the purpose of the system and various privacy needs of the organization. However, in the digital age creation and management of individual identities has been a considerable challenge. The identity management system should have defined programs and mechanisms that administer security through proper mechanism that authenticates use of information of an identity. Authentication of identity information should be done on both the internal and the external environment of Jacket-X. Privacy of all participants in an identity management system is paramount, and the system should be developed in such a way that all participants are assured of their security. In order to ensure the privacy of the participants, the development of an identity management system should follow the principles of fair information. These principles are used in relation to use and collection of personal data. These include the traditional approach where they included the name, address, identifiers used by the government were the main form of information and data protected in identity management systems (Sharma, Rashid & Gupta, 2009). The identity management system developed by Jacket-X should encourage openness, such that the system containing personal data is known publicly. It should provide the description of system main purposes and the usage of the personal data. The identity management system developed by Jacket-X should encourage individual participation. This means that the individual should have access to information relating to them. The individuals should have access to remove any information and data about them, such as untimely, irrelevant and inaccurate. In ensuring the privacy of the individuals, there should be a limitation of the personal data collected, data and information relating to a person should only be obtained with his/her consent. The data stored in the identity management system should be relevant, complete, timely and accurate. The system adopted by Jacket-X should restrict disclosure of personal data, such that data is only used for the purpose, for which it was collected. The data stored in the identity management system of Jack-X should be secured against loss, destruction, modification, unauthorized use and access (Camenisch, Fischer-Hübner & Kai, 2011).
The development of the identity management system by Jacket-X will be around the five areas of concern in an identity management system. These include the identification, auditability, authorization, authentication and accountability. In identifying the vendor for the identity management system, an evaluation will have to be done on the organization, which will provide Jacket-X with the best qualities of these desired features of an identity management system. Poor management of the identity management system brings issues relating to uncertainty of the users privacy, and this may block many users from using the identity management system. The existing access controls can easily violate the users’ privacy easily, since the privacy protection in an identity management system aims at securing information whether the user is authorized or not. The identity management system deals with the broad administrative area, which deals with identification of the stakeholders in a system and controls their access to the organization’s resources. This is done by establishing and associating the users’ rights and restrictions on the system.
Jacket-X Requirements on the Identity Management System
Jacket-X has placed various requirement of the required system, which rotates around the five concerns in an identity management system. These include the authentication requirement, such that the system should have the ability to support authentication across the various facilities of the company. The authentication should vary with the facility and the restriction of access to the facility. The system should be developed based ion centralization, whereby the provider of identity is centralized, and the identities are linked to the centralized provider. In addition, the system must comply with Sarbanes-Oxley act report, which provides guidelines to public corporations. Jacket-X has enrolled plans to sell its shares to the public, and the developed identity management system must comply with the set requirement for publicly owned corporations as stated by Sarbanes-Oxley Act. In this Act, the company is required to show financial responsibility, improve, and demonstrate transparency to all stakeholders, such as the customers, shareholders, and the public. The act ensures submission of adequate internal controls over the financial reporting. Compatibility of the identity management system is an essential feature to be considered by Jacket-X in development of their system. Compatible identity management system will facilitate the expansion programs of the company as it plans to acquire smaller manufacturing companies, which will be operating their own identity management systems. The system will have to be compatible with other systems to work together efficiently with other systems. Since the company operates manufacturing business, there are a considerable number of employees who work on a temporary basis. It is estimated that 10% of Jacket-X employees are employed on a temporary basis, and the system should facilitate easy inclusion and deletion of the individuals in and out of the system.
There is a proposal to create a higher-grade security system for the corporation’s research laboratories. The higher grades security systems will require authorization and authentications, which must be supported by the identity management system. This will be essential in ensuring the security of the system and assurance of security in these research laboratories. The developed identity management system should incorporate the corporation’s functionality and efficiency of the operations. The use of technology is meant to facilitate the productivity of the organization’s resources, and the identity management system includes use of high technology. The designation of the system should include the incorporation of engineering and designation of products to facilitate improvement. The developed system must ensure delineation by the role of the access right to ensure the security of the system. The engineering roles need to be differentiated since there are a few layers of engineering roles in the system. In order to facilitate controls, the developed identity management system should be able to provide all the records of the actions taken by the users. This will be essential for the organization in prevention of fraud on the system since the records will improve the accountability in the use of the system. The right of usage should be controlled where users with higher privileges in the usage of the system should not be able to hide any of operations and activities in the system. The system should be able to protect sensitive information stored in the system such as newly researched designs from unauthorized access. This will require customization of protocols of recording highly sensitive information to authorize only a few individuals who have the right of access. The identity management system should facilitate customization of quarterly audits every year. The audit enhances transparency in the organization and evaluation of the organization efficiency in achievement of the goals.
In the previous year, the human resource in Jacket-X reported inherent vulnerabilities in the internal operations. For example, there were concerns that were raised about the payrolls in the organization, and there were no evidence to implicate any person for fraud or embezzlement of funds. Therefore, the developed system should ensure the incorporation of the payroll to eliminate complications relating to payroll. In designing the new system, the designer will have to identify the vulnerability of the current system to ensure that the developed system will have fewer or no defects and vulnerabilities. The vulnerabilities arising from the development of the payroll include inclusion of ghost or bogus employees in the payroll to the master payroll. The new system should offer security measures as to the access of the master payroll to avoid alterations. There may be development of false time cards by employees, which generate hours that have not been worked. The new system should create checks for administrators to avoid creation of falsified checks in the system. The new system should create an audit trail on addition of an employee; this can be achieved through maintenance of records for all people who access the system. Jacket-X Corporate should consider outsourcing from payroll specialist who will help the organization in merging payroll data to the server through software, which will prevent direct modification by employees. The new system will allow automatic rectification of errors found in the system by the specialists. After validation of the payroll, the system should create limitation of access to the master payroll, so as to avoid alterations. The system should provide controls for access in the post validation of the payroll to prevent the creation of falsified checks by payroll administrators. The system should create a systematic process where any change in the payroll is passed through approval of management. When Jacket-X is making considerations of the preparation of the payroll included in the identity management system, it should consider separation of roles and privileges offered to different employees. It should create the necessary restrictions to ensure controls of access.
Securing of the local area network and the wide area network in the current digital age have become a challenging affair. Various tools have been developed to protect data and information in these networks. These include the intrusion detectors and firewalls, which have been essential in developing the security of a network. However, these tools cannot work effectively if untrained IT personnel manage them. The personnel have various roles in the organization, which include identification of various loopholes in the system and developing a system that improves the security of the system. In the current digital age, there has been a successive race between attackers and developers of the system security making the security maintenance challenging in the business environment. Development of the identity management system will include interconnection of various systems within the system through means such as router. These will encourage interchange of data in various departments within Jacket-X. However, the developed system should ensure that the interchange of data is secure by direction of data through the appropriate route. The system should provide measures that recognize and determine the source and destination of the exchanged data. The system should be able to verify whether the data transferred from one network to the other is authorized and authenticated. In order to ensure safety in the identity management, system must have an intrusion detection and prevention system (IDPS). These systems will monitor the system network traffic and develop alert system of any malicious intrusions. Management of intrusion detection and prevention system should develop policy on system violations based on the configuration of system security respondent (Benantar, 2005).
In the management of the network security, the vendor of the identity management system should consider development of a demilitarized zone network (DMZ). This network zone is essential in providing components, which Jacket-X needs to provide for external users of the internet. The demilitarized zone network should have free access to the internet to operate effectively. This zone network increases the security of the local area network, since external users have an access to the demilitarized zone network only. The system should also develop SMTP gateways, which will allow communication through emails in the organization. These must be placed before a mail server where different policies are to facilitate communication in the organization. The identity management system should include a well-developed website, which will allow external visitors to the corporation website access the offerings made to them and any details concerning the corporation operations. The necessary measures should be taken into consideration, so as to ensure the security of the system website from external, unauthorized intrusions. The firewalls are developed to regulate the activities in the internet between the system and the external networks. Firewall has been one of the most essential security components in a network. The private network should be highly isolated from the internet and should provide extremely limited access since they contain extremely sensitive information (Bertino & Takahashi, 2010).
In ensuring security in the network, the vendor of the identity management system should ensure the physical security of the network. This can be facilitated by the use of ensuring sufficient log in to the network and encryption of sensitive data. The system should ensure monitoring of activities in the system to increase accountability in the use of the system. The system should have controls for user access and auto detects of unauthorized access to the system. There should be various policies developed to ensure log in controls and user activities, in the system. To ensure security of the data in the system, there should be clear guidelines as to access and usage of the data in the database. The backup procedures should be put in place, and the various protocols followed in file sharing. Password controls are essential in enhancing the security of the corporation. However, there are various guidelines in the use of passwords, which include developing a strong password, rotating and expiration reviews of the password and the system password security (Benantar, 2005). The system should facilitate authentication mechanisms using passwords and username for logins to prevent unauthorized access. The passwords should be selected at passwords. The identity management system should facilitate deletion of the people who leave the organization. The rights of access by the IT experts and managers should be reviewed constantly to ensure they do not sabotage the internal operations (Vacca, 2010).
In the implementation of the identity management system, the best plan should involve collaboration of management and staff across departments. This would facilitate a collective creation of the rules that support reporting and compliance with the various regulations. This system would use the bottom-top and top-down approach. This will facilitate acceptance of the developed system by the management and employees of the organization. In order to enhance compliance and the visibility, the system should enhance the generation of monthly reports on compliance and accounting operations (Deswarte et al, 2004).
In conclusion, the issue of cyber security in the modern digital era has raised many concerns in the use of information and technology. However, the use of information technology is imperative for the organization for improvement of productivity in its operations. Jacket-X corporation implementation of the identity management system will be essential, as the organization has sold its shares to the public. In the development of identity management system, the vendor should consider the privacy of the various users of the identity management system. Use of single sign on the system will be pivotal in ensuring the privacy of the users of the system.
Buy custom Identity Management System essay