Using Novell ZENworks® for Securing Devices to Meet Regulatory Compliance

Larry Russon

NRM Product Manager

Novell, Inc.

Market Trends

Achieving regulatory compliance in the Windows environment is considered important

Importance increases sharply for companies with >2500 employees

Importance was indicated most consistently by financial, government, healthcare and manufacturing verticals

The primary concern for meeting Windows regulatory compliance goals is to be able to determine and limit end user access rights

Receiving notification and reporting on changes was viewed as far less critical

The majority of organizations who have not yet achieved compliance believe they are still >6 months away from their goal

Almost half of respondents believe achieving regulatory compliance is more IT resource-intensive than Y2k compliance was

How important is meeting new compliance related regulations in your Windows environment?

2%

22%

41%

35%

Not

Limited

Is

Very

Importance of Compliance Issues

Larger companies (>2500 emps) almost universally (>92%) view compliance as important or very important

No company with >2500 emps marked meeting compliance goals as not important

Majority of respondents (76%) view regulatory compliance as important or very important

Only a tiny minority (2%) described this need as not important

How important is meeting new compliance related regulations in your Windows environment?

Four industries attributed above average importance to meeting compliance goals

Finance (91%), Healthcare (83%), Government (83%) and Manufacturing (82%)

Finance and Healthcare companies were more than twice as likely to mark meeting compliance goals as very important in comparison to any other industry

76% of Finance and Healthcare respondents marked compliance as very important versus 28% of all other industry respondents

Compliance Importance by Industry

How much of your time do you expect to spend next year on tasks designed to help meet regulatory requirements?

Majority of respondents (55%) expect to spend >1 week on tasks exclusively related to compliance

35%

20%

45%

<40 Hrs

40-120 Hrs

>120 Hrs

The more important regulations are to a company, the greater time they expect to spend on achieving compliance

63% of respondents whose company views compliance as important or very important plan to spend >1 week on related tasks

Only 31% of respondents whose company views compliance as not important or of limited importance plan to spend >1 week on related tasks

Time Spent by Respondent on Compliance

When do you expect to achieve your compliance goals for the Windows environment?

Unfortunately, many respondents (37%) are still not sure how long it will take them to achieve compliance in their environment

Only 18% of respondents have already achieved their compliance targets

Among the remaining respondents who were able to assess the time required to achieve compliance, the majority (59%) expect it take longer than 6 months

18%

37%

24%

22%

<3 mths

3-6 mths

6-12 mths

>12 mths

Time Remaining to Achieve Compliance

Are more IT resources involved in meeting your current compliance objectives than were involved in achieving Y2K compatibility?

Many respondents (43%) believe that achieving regulatory compliance is more resource-intensive than achieving Y2k compliance was.

The majority of respondents (55%) working in Finance, Government or Manufacturing believe regulatory compliance is more resource-intensive than Y2k compliance was, versus 33% of respondents from other industries.

The majority of organizations (51%) who view meeting regulatory compliance as important or very important believe this is more resource intensive than Y2k compliance was.

Who is the primary driver for regulatory compliance in your organization?

There is high variability around which department is the primary driver for regulatory compliance within a business

The IT and Finance departments account for the majority of responses (52%)

The Security department is a strong third (20%)

What is the most significant hurdle in meeting regulatory compliance for your Windows environment?

No clear consensus on what is the most significant hurdle to achieving compliance

Discouragingly, the top hurdle cited, unclear regulatory definitions (28%), is also the only one that is out of the control of the implementing organization to remediate

Rank the following objectives by importance in meeting compliance needs for your Windows environment

Respondents clearly indicated that determining who has access and limiting who can do what is more important than notification and reporting on activity

This ordering is true within all industries and all company sizes

Overall 74% of respondents marked determine or limit as their top priority

Overall 67% of respondents marked notify or report as their lowest priority

Priority per task

(1-highest, 4-least)

Rank the following technologies by importance for meeting compliance needs in your Windows environment

Respondents clearly indicated that technology that helps manage user rights is the most important compliance need for the Windows environment

This ordering is true within all industries and all company sizes

In addition, desktop lockdown was ranked last within all industries and all company sizes

While companies from different industries and of different sizes show significant variation in how they view their Windows regulatory compliance needs, there is concurrence on what steps they need to take…

Determining and limiting end user access through user rights management is universally accepted as being of primary importance

Priority per task

(1-highest, 5-least)

Take Aways

Organizations view meeting regulatory compliance goals as a priority for their Windows environment

In particular, larger companies (>2500 emps) and specific industries (finance, healthcare, government) have the greatest needs

These companies believe determining and limiting user rights is the most critical measure needed to meet their objectives

But most businesses believe there is still considerable time and effort remaining before they are able to achieve their Windows compliance goals

Regulatory Compliance Challenges

International Mandates

Basel II

U.S. Federal Mandates

Sarbanes-Oxley Act (SOA)

Health Insurance Portability and Accountability Act (HIPAA)

Gramm-Leach-Bliley Act (GLBA)

Department of Defense (DoD) 5015.2 (“Design Criteria Standards for Electronic Records Management Software”)

Patriot Act

SEC Rule 17a-4

State Mandates

California SB 1386- state privacy law

Industry-Specific Mandates

HIPAA –Healthcare Industry

GLBA – Financial Services Industry

Risk Domains

Corporate Governance Risk

Sarbanes-Oxley Act

Operational Risk

Basel II

SEC Rule 17a-4

HIPAA

Gramm-Leach-Bliley Act

California SB 1386

DoD 5015.2

Customer Risk

Patriot Act

Common “Threads”
with Respect to Compliance

Corporate Governance (CG)

Risk Assessment (RA)

Risk Management (RM)

Privacy (P)

Security (S)

Record Retention (RR)

Documentation (D)

Auditing (A)

Reporting (R)

Certification (C)

Customer Identification Program (CIP)

Regulatory Penalties & Fines (RPF)

Secure Device
information security requirements

Requires agile and

secure management

solution

Security Preparedness

Security Expenditure

Company A

Company B

Prudent

Zone

Prudent

Zone

Adapted from Doug Lewis, The Edge Consulting Group

Security Lifecycle

Measure

Audit

M

i

t

i

g

a

t

e

D

e

f

e

n

d

Declaritive policy (group policy, desktop lockdown)

Application Distribution

Deployment (Imaging, Scripted Installation)

Policy/RBAC/Audit (Common Policy Decision Point)

State Management (Real-time process execution)

Inventory\Asset Management

Security Vendors (VPN/firewall, antivirus, content filtering, etc.)

Application & Services Vendors (ERP, CRM, database, hosting, etc.)

Hardware Vendors (Appliances, servers, gateways, etc.)

Configuration Management

Identity Manager & Composer Connectors

Process Automation (Rules & roles-based management)

Identity Self-Service & Administration Portal (account, password, entitlement )

Identity Manager

Security Management

BPM Manager

Authentication\Authorization (Legacy & Web protocols, advanced methods)

Workflow modeling (concurrent and nested)

Technical View
Technology Stack

Secure Device
– a deployment strategy

Identify the purpose of each device

ZENworks dynamically creates a virtualized representation of each managed node to ease and ensure a secure desktop complaint with corporate policies

Identify the network services provided on the device

ZENworks with Identity Manager pieces provide secure control to network services ie. electronic mail, access to the Web, file transfers, access to corporate databases

Identify the users or categories of users of the device

ZENworks makes it easy to establish management transactions based on user roles that reflect their authorized activity

Determine privileges each category of user has on the device

ZENworks provides dynamic local user functionality that allows administrators to securely manage access and privileges on a desktop to local resources and network services

Secure Device
– a deployment strategy (cont.)

Develop threat detection strategies

ZENworks and Nsure® Audit components provide a centralized common event notification method based on the existence of various logs that systems produce

Secure remote management

ZENworks provides secure/encrypted administration commands and data that traverse the network between the target computer and the administrator's workstation

Identify actions to protect information contained on hardware that is no longer in use

ZENworks is addressing this with in house and partnership tools that facilitate the steps you need to take to ensure that the information contained on hardware being updated, replaced, removed from service, or disposed of is eliminated, ... erase and reformat disks, clear firmware passwords, ...

Secure Device
– software components

Software components:

Patch Management

Security updates

Risk Assessment

Compliance/Mitigation

Inventory

License Compliancy

License Usage/Metering

Rogue Applications

Machine State/Deviation

Roll back

Backup/Restore

Emergency Recovery

Data Protection

Encrypted File System

Anti-virus

Device Kill/Disk Shredding/Firmware wiping

Secure Device
– software components (cont.)

Software components:

Data Access Protection

Personal Firewall

VPN

Certificate Authority Management

Browser Lockdown

Application Lockdown

USB/Firewire/CD/FD Lockdown

Identity Management

Single sign-on

Multi-factored authentication

Logging/Auditing/Notification

Central logging

Log Analysis

Non-Compliant activities/state

Demonstration

Using ZENworks to enforce cross domain Windows Group Policies

Using ZENworks to Clear page file entries

Using ZENworks to prevent access to log files

Using ZENworks to ensure Data reliability and restoration

Using ZENworks role-restrictions for Remote Management

BS_2005_TUT116

2003-12-08T12:43:39