Privileged Identity Management News Line July 2011

Top of Mind

It's a New... Release of E/RPM!

Philip Lieberman, President & CEO
Lieberman Software

Over the last 7 months we have been working on a new version of Enterprise Random Password Manager (ERPM version 4.83.2) and Random Password Manager (RPM, also version 4.83.2). Last week it was finally released to the delight of our customers and partners. It was also a great source of pride for our developers and testers to finally release the build after all of the hard work they put in. Whew!

We had a lot of objectives in this release, but there were a few persistent themes. First, we always listen to customers and their reported bugs and deployment issues. Generally, we fix bugs immediately when we can reproduce them, but when they become Heisenbugs (they disappear when you look for them), we had to bring out the big guns. I am proud to say that we finally fixed every last one.

On the scalability front, we have been working over the last 7 months with very large customers deploying at mind boggling levels of scale and complexity. Imagine managing a company with distribution and sales offices in every major city on the planet that has Internet connectivity and reliable electricity (more or less), and manufacturing also similarly distributed, with the requirement for continuous compliance 7/24 everywhere and the requirement for a full audit-ready deployment in less than one month (including re-architecting and remediation). To describe the challenges best, we were seeing the most powerful database engines simply giving up on some queries due to their complexity and scale. The good news here is that we have rewritten database queries, re-worked some of the table organization, redesigned dialogs with extra filters, added progress indicators, revised web pages for faster loading, and generally reshaped what was necessary to get back to sub-second responses where possible (we can’t break the speed of light). Yes, it is deployed and working great! For normal customers (with less than 100K systems), everything in this release will just seem a little snappier.

We have always been known as the company with great auto-discovery, correlation and propagation and there are a ton of new features to make deployments even faster and more complete. We have added Oracle WebLogic, IBM WebSphere, new directories and shortly SAP NetWeaver support. There is also new support for auto-discovery of SQL Server instances as well as support for SQL Reporting services.

With the recent security breach of the RSA SecurID token system, we got the message loud and clear that having RSA SecurID as the only 2-factor token solution was unacceptable to many of our customers. So, we joined OATH as a coordinating member, developed a complete multi-factor authentication stack to not only support pretty much all of the OATH tokens out there (hardware/software), but also added support for Yubico tokens with a special offer of 3 free YubiKey tokens to get you started. We even added an instant and free multi-factor capability to support email or SMS token codes.

Another goodie in this release, is the OEM licensing of a browser based JAVA component (known as MindTerm from CryptZone) to allow you to do transparent SSH, Telnet, SCOPY, and SFTP from our web interface from any platform and any browser that supports JAVA. The SSH function allows you connect to any SSH device we manage the passwords for, and connect without needing to view the credentials. This is provided at no extra cost to our customers. There are also a ton of new JAVA improvements we made to our SDK.

We also added support for RADIUS authentication, and you can now change the order of authentication providers on the E/RPM web site. You can also confirm if you are really sure you want to delete a password. There are other improvements in LDAP management and LDAP security as well.

We also added support for IPMI 2.0 and for all of the HP iLO cards (iLO 2 and iLO 3) as well as the ability to seed the list of IPMI passwords for these devices as well as most other platforms.

We have also beefed up our web services interface, and added more interfaces to support both private and public cloud environments with particular attention paid to adding support for bare metal deployment and the management of lights-out cards.

I have to say thanks to everyone on our team as well as to our customers for having the patience to wait for this release (quality takes time), and for giving us the chance to show you that we listen to your suggestions and take your challenges and problems seriously.

Thanks again for your loyalty and try out this latest release (upgrading is easy and free if you are on support). Let me know what you think! Also, let me know what we should be working on for the next release…

Email me at: phil@liebsoft.com. You can also follow me on Twitter: @liebsoft or connect with me via LinkedIn.

Tech Tip of the Month

Upgrade to ERPM 4.83.2 or RPM 4.83.2!

If you are an existing Enterprise Random Password Manager (ERPM) or Random Password Manager (RPM) customer, we STRONGLY recommend you upgrade to the new version. There is just so much more functionality and flexibility in this release. Download the new installer package, run it, upgrade the website.

To upgrade, please contact your account manager for the download link.

Events / Press / Analysts

Black Hat USA 2011. August 3-4, 2011. Las Vegas, NV. The Black Hat Briefings remains the biggest and the most important technical security conference series in the world. Come visit us in booth # 312!

ArcSight Protect 11 Conference. September 11-14, 2011. Gaylord National Hotel, National Harbor, MD. This is the HP enterprise software and cybersecurity event of the year. This year will be bigger, better and badder than ever! As the Diamond sponsor, Lieberman Software will have a major presence so please visit us if you plan on attending this event.

4 Simple Steps to Safeguard Your Voicemail. eSecurity Planet. The London press is in an uproar. And rightfully so. Employees of the now shuttered Rupert Murdoch-owned tabloid News of the World apparently hacked into the voicemail (VM) of many hundreds of targets, ranging from leading politicians, royals, and many tragic victims... Security experts offer nightmare scenarios where, for instance, every VM received by the CEO of a take-over target is overheard by the acquiring firm.

Can You Trust Your Cloud Data Center Security? Data Center Post. The fact that so many cloud providers – large and small – have no interest in managing privileged identities and segregating duties to limit access to sensitive data and systems should give customers pause before putting their most precious data and resources in the hands of many providers.

Generic accounts are your SIEM blind spot. Computerworld. Data breaches often involve the unauthorized use of highly privileged accounts, and when this happens most organizations are powerless to identify the individuals or processes responsible. The best that can be done is to change a few passwords and wait for the cycle to repeat itself. It's a Groundhog Day experience that's seen in far too many enterprises.

Comment: RSA SecurID Breach – Where Do We Go From Here? Infosecurity. The ripples of the recent RSA SecurID compromise event go far and wide and can cause us to question some of the fundamental beliefs we have in vendors and their business models.
The Five Golden Rules for Success in Outsourcing. The Datacenter Journal. Outsourcing has worked well for some companies, but it can also lead to business-damaging disasters. The problem is that if outsourcers fail, you're left holding the baby without the resources to care for it. There is little margin for error in choosing an outsourcer, as Lieberman Software found in our recent survey at InfoSecurity 2011. We discovered that 77% of IT professionals surveyed said their outsourcers had made up work to earn extra money... Here are my five golden rules to ensure your outsourcing lifeboat doesn’t sink mid-stream.

Five Tips for Not Getting Fired. British Computing Society. 2011 has indeed unleashed a wave of unprecedented security breaches that have left many people reeling: Epsilon, Sony, WikiLeaks, PBS.org, RSA Security and HBGary Federal to mention only some of the victims. So to put this all in context, and provide a cautionary tale of the challenges facing IT security professionals, I have drafted a fictitious scenario to illustrate the five best ways to get yourself fired, so that hopefully you never do! Happy reading.