Sunteți pe pagina 1din 79

Identity access

management
!"#$%&' )*+*,

-"./,&. 012& 3*,'%+/4,2

5"6/.& 1& #*,78.&,#&'
9,4:&.'4/8 1& ;4<2&
3=".28 1& #*%.'
>3?03 @.%''&+' 5","2&A&,/ B#=**+
-.*7&''&%. 4,:4/8
9,4:&.'4/8 1& ;*.."4,& C5&/DE
>B)B3F ?0 )G)&..&.F ?0 ;1@ C@.%H&++&'E
>,'/4/%/ I."J& 1&' 3=&7' 1K&,/.&L.4'&' CM%,4'E
>,'/4/%/ I7.4#"4, 1& 5","2&A&,/ CN%"2"1*%2*%E

2
Jacques.folon@ichec.be
https://www.facebook.com/folon.jacques
http://www.scoop.it/u/jacques-folon
http://www.linkedin.com/in/folon
http://jacquesfolon.tumblr.com/
http://fr.slideshare.net/FOLON
@jacquesfolon
8eLrouvez-mol en llgne
CeLLe presenLaLlon esL sur

www.slldeshare.neL/folon

elle esL a voLre dlsposlLlon
lAM
1. C'esL quol ?
2. Cuel esL le conLexLe acLuel?
3. lAM & cloud compuLlng
4. ourquol en avons nous
besoln?
3. 1o do llsL
6. lAM eL vle prlvee
7. lAM eL conLrle
8. e-dlscovery
9. Concluslon
1. lAM c'esL quol ?
-.*:4'4*,4,2
B4,2+& B42, N,
-O>
B
/.*
,
2

I
%
/=
&
,
/4#
"
/4*
,
)
&
1
&
.
"
/
4*
,
P
4.
&
#
/
*
.
4&
'
I%/=*.4D"/4*,
B&#%.& Q&A*/&
I##&''
-"''R*.1
5","2&A&,/
S&J B&.:4#&'
B&#%.4/T
I
%
1
4/
4,
2
U

Q
&
L
*
.
/
4,
2
Q*+& J"'&1
5
","2&A
&,/
PQ5
Source: ldenLlLy and Access ManagemenL: Cvervlew8afal Lukawleckl - SLraLeglc ConsulLanL, ro[ecL 8oLLlcelll LLd rafal[pro[ecLboLLlcelll.co.uk
5 Questions
to ask your CISO
Q: Whats posted on this
monitor?

a password to financial application
b phone messages
c to-dos
Q: What determines your
employees access?


a give Alice whatever Wally has
b roles, attributes, and requests
c whatever her manager says
Q: Who is the most privileged
user in your enterprise?


a security administrator
b CFO
c the summer intern who is now working
for your competitor
Q: How secure is your
identity data?


a It is in 18 different secured stores
b We protect the admin passwords
c Privacy? We dont hold credit card
numbers
Q: How much are manual
compliance controls costing
your organization?

a nothing, no new headcount
b dont ask
c dont know
Todays IT Challenges
More Agile Business
More accessibility for employees,
customers and partners
Higher level of B2B integrations
Faster reaction to changing requirements
More Secured Business
Organized crime
Identity theft
Intellectual property theft
Constant global threats
More Compliant Business
Increasing regulatory demands
Increasing privacy concerns
Business viability concerns
State Of Security In Enterprise
Incomplete
Multiple point solutions from many vendors
Disparate technologies that dont work together

Complex
Repeated point-to-point integrations
Mostly manual operations

Non-compliant
Difficult to enforce consistent set of policies
Difficult to measure compliance with those policies
Identity Management Values
Trusted and reliable security

Efficient regulatory compliance

Lower administrative and development costs

Enable online business networks

Better end-user experience
13
La gestion des identits consiste grer le
cycle de vie des personnes (embauche,
promotion, mutation, dpart, etc.) au sein de
la socit et les impacts induits sur le systme
dinformation (cration de Comptes
utilisateurs, attribution de Profils utilisateurs,
mise en uvre du contrle d'accs, etc.).
source cluslf
lAM n'esL pas unlquemenL une Lche
lnformaLlque !
Cette gestion des identits doit pouvoir tre
faite d'un point de vue fonctionnel par des
non-informaticiens (exemple : Ressources
Humaines, Matrise douvrage, lutilisateur
lui-mme)
et
d'un point de vue technique par des
informaticiens (exemple : administrateur,
Matrise duvre).
16
lAM n'esL pas unlquemenL une Lche
lnformaLlque !
source cluslf
17
La solution de gestion didentits doit tre une solution globale sur la
base dune infrastructure centralise avec une gestion fonctionnelle
distribue et qui intgre les fonctionnalits suivantes :

la gestion du rfrentiel central des utilisateurs (alimentation partir
de rfrentiels utilisateurs sources),
la gestion du rfrentiel central des ressources concernes par la
gestion des droits daccs,
la gestion des habilitations (gestion des Profils, Rles, gestion des
utilisateurs, workflow),
le provisioning (synchronisation des rfrentiels cibles de scurit),
ladministration dcentralise,
lauto-administration (gestion par les utilisateurs des mots de passe et
des donnes prives),
laudit et le reporting,
le contrle daccs (authentification, autorisation).
source cluslf
WhaL ls ldenLlLy ManagemenL ?
ldenLlLy managemenL ls Lhe seL
of buslness processes, and a
supporLlng lnfrasLrucLure, for Lhe
creaLlon, malnLenance, and use of
dlglLal ldenLlLles." 1be 8ottoo Ctoop
(a research flrm speclallzlng ln l1
lnfrasLrucLure for Lhe enLerprlse)
ldenLlLy ManagemenL ln Lhls
sense ls someLlmes called
ldenLlLy and Access
ManagemenL" (lAM)
ueflnlLlon
19
Identity and Access Management is the process for managing the
lifecycle of digital identities and access for people, systems and
services. This includes:
User Management management of large, changing user
populations along with delegated- and self-service
administration.
Access Management allows applications to authenticate
users and allow access to resources based upon policy.
Provisioning and De-Provisioning automates account
propagation across applications and systems.
Audit and Reporting review access privileges, validate
changes, and manage accountability.
CA
IAM : J. Tony Goulding CISSP, ITIL CA t ony.goulding@ca.com
lAM c'esL par exemple.
8on[our [e suls !ulle, une
eLudlanLe d'lnlCSAlL." (lJeotlt)
Cecl esL mon moL de passe."
(Aotbeotlflcotloo)
!e veux acceder a la plaLeforme"
(Aotbotlsotloo "##*.18&)
!e veux amellorer la noLe de mon
examen."
(Aototlsotloo .&7%'8&)
Mals c'esL aussl.
un nouveau professeur
uonc une adresse emall, a
donner des que posslble
un moL de passe sur lCPLC
Campus
un moL de passe lnLraneL
un moL de passe lL Campus
ueflnlr les auLres servlces
auxquel ll a acces
Cuelles sonL les quesLlons a se poser??
Les personnes sonL-elles ce
qu'elles dlsenL Lre?
SonL-elles des membres reels
de noLre communauLe ?
CnL-elles reu les
auLorlsaLlons necessalres ?
Le respecL de leurs donnees
personnelles esL-ll mls en
place?
Lxemples de quesLlons
Cuel moL Lype de moL de passe donner?
Cuelles sonL les acLlvlLes auLorlsees?
Cuelles sonL les acLlvlLes lnLerdlLes?
A quelle caLegorle de personne ceLLe nouvelle
ldenLlLe dolL-elle Lre aLLachee?
A quel momenL du processus d'enLree les
auLorlsaLlons dolvenL-elles Lre donnees?
Cuelles modallLes de conLrle sonL mlses en place?
euL-on prouver LouL cela a un audlLeur ?
24
Le Lrlple A de l'lAM
Authentication
WHO ARE YOU?
Authorization / Access Control
WHAT CAN YOU DO?
Audit
WHAT HAVE YOU DONE?
24
ComponenLs of lAM
AdmlnlsLraLlon
user ManagemenL
assword ManagemenL
Workflow
uelegaLlon
Access ManagemenL
AuLhenLlcaLlon
AuLhorlzaLlon
ldenLlLy ManagemenL
AccounL rovlslonlng
AccounL ueprovlslonlng
SynchronlsaLlon
Reliable Identity Data
A
d
m
i
n
i
s
t
r
a
t
i
o
n
A
u
t
h
o
r
i
z
a
t
i
o
n
A
u
t
h
e
n
t
i
c
a
t
i
o
n
Source: ldenLlLy and Access ManagemenL: Cvervlew8afal Lukawleckl - SLraLeglc ConsulLanL, ro[ecL 8oLLlcelll LLd rafal[pro[ecLboLLlcelll.co.uk
2. ConLexLe acLuel
Cuel esL le conLexLe acLuel
qul esL a la base du
developpemenL de l'lAM?
27
Les ldenLlLes mulLlples selon l Cavazza
28
Les ldenLlLes varlenL selon les plaLeformes
29
LnLre l'ldenLlLe vlrLuelle eL ...
Dans ce contexte, lamoncellement de parcelles laisses plus ou
moins labandon dessine un portrait par petites touches. Un peu
comme les tableaux pointillistes : de manire unitaire, aucune des
traces nest rellement significative. Mais le tableau gnral, lui,
reprsente le sujet dans son ensemble. la vue de tous et pas
forcment sous un angle souhait
hLLp://www.buschlnl.com/2009/12/04/ldenLlLe-LradlLlonnelle-versus-ldenLlLe-numerlque/
lnLerneL esL base sur des
communlcaLlons anonymes
Les enLreprlses parLlclpenL a de
nombreux reseaux generanL de
mulLlples ldenLlLes
Les sysLemes lnLernes onL parfols des
sysLemes d'ldenLlflanLs dlfferenLs
Les uLlllsaLeurs sonL les malllons falbles
de la securlLe
La crlmlnallLe lnformaLlque augmenLe
La mlse en place de conLrles lmpose
l'ldenLlflcaLlon
La gesLlon des Lraces esL lndlspensables
La proLecLlon de la vle prlvee lmpose
des conLrles
Welcome Lo a dlglLal world
Su[eL d'acLuallLe.
Lxploslon of lus
-.& VWXYK' VWXYK' VWWYK' ZYYYK'
# of
ulglLal lus
1lme
A
p
p
l
l
c
a
L
l
o
n
s
5"4,7."A&
3+4&,/ B&.:&.
>,/&.,&/
@%'4,&''
I%/*A"/4*,
3*AL",T
C@Z0E
-"./,&.'
C@Z@E
3%'/*A&.'
C@Z3E
5*J4+4/T
Source: ldenLlLy and Access ManagemenL: Cvervlew8afal Lukawleckl - SLraLeglc ConsulLanL, ro[ecL 8oLLlcelll LLd rafal[pro[ecLboLLlcelll.co.uk
1he ulsconnecLed 8eallLy

ldenLlLy Chaos"
nombreux uLlllsaLeurs eL appllcaLlons
nombreuses lu
lusleurs ldenLlLe par uLlllsaLeur
lusleurs log ln eL moLs de passe
MulLlple reposlLorles of ldenLlLy lnformaLlon
MulLlple user lus, mulLlple passwords
ManagemenL decenLrallse
ConfllLs buslness <-> l1
Enterprise Directory
HR
Infra
Application
Office
In-House
Application



External app

Finance
employee
Application
Authentication
Authorization
Identity Data
Authentication
Authorization
Identity Data
Authentication
Authorization
Identity Data
Authentication
Authorization
Identity Data
Authorization
Identity Data
Authentication
Authentication
Authorization
Identity Data
Authentication
Authorization
Identity Data
Source: ldenLlLy and Access ManagemenL: Cvervlew8afal Lukawleckl - SLraLeglc ConsulLanL, ro[ecL 8oLLlcelll LLd rafal[pro[ecLboLLlcelll.co.uk
?our 3N5-I[\ and
your 05-;N\00B
?our B9--;>0QB
?our -IQM[0QB ?our Q05NM0 and
]>QM9I; 05-;N\00B
?our 39BMN50QB
CusLomer saLlsfacLlon & cusLomer lnLlmacy
CosL compeLlLlveness
8each, personallzaLlon
CollaboraLlon
CuLsourclng
lasLer buslness cycles, process
auLomaLlon
value chaln
M&A
Moblle/global workforce
llexlble/Lemp workforce
MulLlple ConLexLs
Source: ldenLlLy and Access ManagemenL: Cvervlew8afal Lukawleckl - SLraLeglc ConsulLanL, ro[ecL 8oLLlcelll LLd rafal[pro[ecLboLLlcelll.co.uk
1rends lmpacLlng ldenLlLy
Increasing Threat Landscape
>1&,/4/T /=&7/ #*'/' J",^' ",1 #.&14/ #".1 4''%&.' _VGZ J4++4*, 4, V T.

$250 billion lost from exposure of confidential info


Maintenance Costs Dominate IT Budget
On average employees need access to 16 apps and systems

Companies spend $20-30 per user per year for PW resets


Deeper Line of Business Automation and Integration
One half of all enterprises have SOA under development

Web services spending growing 45%


Rising Tide of Regulation and Compliance
SOX, HIPAA, GLB, Basel II, 21 CFR Part 11,

$15.5 billion spend on compliance (analyst estimate)


P"/" B*%.#&'` a"./,&.F I5Q Q&'&".#=F >P3F &5".^&/&.F 9GBG P&L"./A&,/G *7 !%'/4#&
37
@%'4,&''
NR,&.
0,1 9'&. >M I1A4, P&:&+*L&. B&#%.4/Tb 3*AL+4",#&
M** &HL&,'4:&
/* .&"#= ,&R
L"./,&.'F
#=",,&+'
[&&1 7*.
#*,/.*+
M** A",T
L"''R*.1'
;*,2 R"4/' 7*.
"##&'' /* "LL'F
.&'*%.#&'
M** A",T %'&.
'/*.&' ",1
"##*%,/ "1A4,
.&$%&'/'
9,'"7& 'T,#
'#.4L/'
aln olnLs
Q&1%,1",/
#*1& 4, &"#=
"LL
Q&R*.^ #*1&
/** *7/&,
M** A",T
*.L=",&1
"##*%,/'
;4A4/&1
"%14/4,2 "J4+4/T
Source: ldenLlLy and Access ManagemenL: Cvervlew8afal Lukawleckl - SLraLeglc ConsulLanL, ro[ecL 8oLLlcelll LLd rafal[pro[ecLboLLlcelll.co.uk
3. lAM & Cloud compuLlng
Cloud CompuLlng: ueflnlLlon
no unlque ueflnlLlon or Ceneral Consensus abouL whaL Cloud
CompuLlng ls .
ulfferenL erspecLlves & locuses (laLform, SW, Servlce Levels.)

llavours:
CompuLlng and l1 8esources Accesslble Cnllne
uynamlcally Scalable CompuLlng ower
vlrLuallzaLlon of 8esources
Access Lo (poLenLlally) Composable & lnLerchangeable Servlces
AbsLracLlon of l1 lnfrasLrucLure
! no need Lo undersLand lLs lmplemenLaLlon: use Servlces & Lhelr Als
Some currenL players, aL Lhe lnfrasLrucLure & Servlce Level:
Salesfo8ce.com, Coogle Apps, Amazon, ?ahoo, MlcrosofL, l8M, P, eLc.


1he luLure of ldenLlLy ln Lhe Cloud: 8equlremenLs, 8lsks & CpporLunlLlesMarco Casassa Mont marco.casassa-mont@hp.com HP Labs Systems Security Lab Bristol, UK - LLMA e-ldenLlLy Conference, 2009

Cloud CompuLlng: lmpllcaLlons
Lnterpr|se:
aradlgm ShlfL from Close & ConLrolled" l1 lnfrasLrucLures and Servlces Lo
LxLernally rovlded Servlces and l1 lnfrasLrucLures

r|vate User:
aradlgm ShlfL from Accesslng SLaLlc SeL of Servlces Lo uynamlc & Composable
Servlces

Genera| Issues:
oLenLlal Loss of ConLrol (on uaLa, lnfrasLrucLure, rocesses, eLc.)
uaLa & ConfldenLlal lnformaLlon SLored ln 1he Clouds
ManagemenL of ldenLlLles and Access (lAM) ln Lhe Cloud
Compllance Lo SecurlLy racLlce and LeglslaLlon
rlvacy ManagemenL (ConLrol, ConsenL, 8evocaLlon, eLc.)
new 1hreaL LnvlronmenLs
8ellablllLy and LongevlLy of Cloud & Servlce rovlders


1he luLure of ldenLlLy ln Lhe Cloud: 8equlremenLs, 8lsks & CpporLunlLlesMarco Casassa Mont marco.casassa-mont@hp.com HP Labs Systems Security Lab Bristol, UK - LLMA e-ldenLlLy Conference, 2009

ldenLlLy ln Lhe Cloud: LnLerprlse Case
LnLerprlse
uaLa
SLorage
Servlce
Cfflce
Apps
Cn uemand
Cus
rlnLlng
Servlce
C|oud
rov|der #1
C|oud
rov|der #2
Interna| C|oud
C8M
Servlce
.
Servlce 3
8ackup
Servlce
lLM
Servlce
Servlce
Servlce
Servlce
8us|ness
Apps]Serv|ce
Lmployee
.
.
.
1he
Internet
Ident|ty &
Credent|a|s
Ident|ty &
Credent|a|s
Ident|ty &
Credent|a|s
Ident|ty &
Credent|a|s
Ident|ty &
Credent|a|s
Ident|ty &
Credent|a|s
Ident|ty &
Credent|a|s
AuLhenLlcaLlon
AuLhorlzaLlon
AudlL
AuLhenLlcaLlon
AuLhorlzaLlon
AudlL
AuLhenLlcaLlon
AuLhorlzaLlon
AudlL
AuLhenLlcaLlon
AuLhorlzaLlon
AudlL
user AccounL
rovlslonlng/
ue-provlslonlng
User Account
rov|s|on|ng]
De-prov|s|on|ng
User Account
rov|s|on|ng]
De-prov|s|on|ng
User Account
rov|s|on|ng]
De-prov|s|on|ng
uaLa
& ConfldenLlal
lnformaLlon
uaLa
& ConfldenLlal
lnformaLlon
uaLa
& ConfldenLlal
lnformaLlon
uaLa
& ConfldenLlal
lnformaLlon
lAM CapablllLles
and Servlces
Can be
CuLsourced ln
1he Cloud .


1he luLure of ldenLlLy ln Lhe Cloud: 8equlremenLs, 8lsks & CpporLunlLlesMarco Casassa Mont marco.casassa-mont@hp.com HP Labs Systems Security Lab Bristol, UK - LLMA e-ldenLlLy Conference, 2009

ldenLlLy ln Lhe Cloud: LnLerprlse Case
lssues and 8lsks [1/2]


- oLenLlal rollferaLlon of 8equlred ldenLlLles & CredenLlals Lo Access Servlces
! Mlsbehavlours when handllng credenLlals (wrlLlng down, reuslng, sharlng, eLc.)

- ComplexlLy ln correcLly enabllng" lnformaLlon llows across boundarles
! SecurlLy 1hreaLs
(LnLerprlse ! Cloud & Servlce rovlders, Servlce rovlder ! Servlce rovlder, ._

- ropagaLlon of ldenLlLy and ersonal lnformaLlon across MulLlple Clouds/Servlces
! rlvacy lssues (e.g. compllance Lo mulLlple LeglslaLlons, lmporLance of LocaLlon, eLc.)
! Lxposure of buslness senslLlve lnformaLlon
(employees' ldenLlLles, roles, organlsaLlonal sLrucLures, enLerprlse apps/servlces, eLc.)
! Pow Lo effecLlvely ConLrol Lhls uaLa?

- uelegaLlon of lAM and uaLa ManagemenL rocesses Lo Cloud and Servlce rovlders
! Pow Lo geL Assurance LhaL Lhese rocesses and SecurlLy racLlce are ConslsLenL wlLh
LnLerprlse ollcles?
- 8ecurrenL problem for all SLakeholders: LnLerprlse, Cloud and Servlce rovlders .
! ConslsLency and lnLegrlLy of user AccounLs & lnformaLlon across varlous Clouds/Servlces
! Pow Lo deal wlLh overall Compllance and Covernance lssues?



1he luLure of ldenLlLy ln Lhe Cloud: 8equlremenLs, 8lsks & CpporLunlLlesMarco Casassa Mont marco.casassa-mont@hp.com HP Labs Systems Security Lab Bristol, UK - LLMA e-ldenLlLy Conference, 2009

ldenLlLy ln Lhe Cloud: LnLerprlse Case
lssues and 8lsks [2/2]


- MlgraLlon of Servlces beLween Cloud and Servlce rovlders
! ManagemenL of uaLa Llfecycle

- 1hreaLs and ALLacks ln Lhe Clouds and Cloud Servlces
! Cloud and Servlce rovlders can be Lhe weakesL llnks" ln SecurlLy & rlvacy
! 8ellance on good securlLy pracLlce of 1hlrd arLles


1he luLure of ldenLlLy ln Lhe Cloud: 8equlremenLs, 8lsks & CpporLunlLlesMarco Casassa Mont marco.casassa-mont@hp.com HP Labs Systems Security Lab Bristol, UK - LLMA e-ldenLlLy Conference, 2009

4.ourquol en avons nous besoln?
Scur|t
Comp||ance
kduct|on des cots
Support pour |'aud|t
Contr|e d'accs
Source: fLp://fLp.boulder.lbm.com/sofLware/uk/producLnews/Lv/vh_-_access_and_ldenLlLy_managemenL.pdf
Lconomles posslbles
ulrecLory SynchronlzaLlon
lmptoveJ opJotloq of oset Joto. 5185 pet oset/yeot
lmptoveJ llst moooqemeot. 5800 pet llst
- Clga lnformaLlon Croup
assword ManagemenL
losswotJ teset costs tooqe ftom 551 (best cose) to 5147 (wotst cose) fot
lobot olooe. - CarLner
user rovlslonlng
lmptoveJ l1 efflcleocy. 570,000 pet yeot pet 1,000 moooqeJ osets
keJoceJ belp Jesk costs. 575 pet oset pet yeot
- Clga lnformaLlon Croup
Can We !usL lgnore lL All?
1oday, average corporaLe user
spends 16 mlnuLes a day logglng on
A Lyplcal home user malnLalns 12-18
ldenLlLles
number of phlshlng slLes grew over
1600 over Lhe pasL year
CorporaLe l1 Cps manage an average
of 73 appllcaLlons and 46 suppllers,
ofLen wlLh lndlvldual dlrecLorles
8egulaLors are becomlng sLrlcLer
abouL compllance and audlLlng
Crphaned accounLs and ldenLlLles
lead Lo securlLy problems
Source: MlcrosofL's lnLernal research and AnLl-phlshlng Worklng Croup
lAM 8eneflLs
Benefits to take you
forward
(Strategic)
Benefits today
(Tactical)
Save money and improve operational
efficiency
Improved time to deliver applications and
service
Enhance Security
Regulatory Compliance and Audit
New ways of working
Improved time to market
Closer Supplier, Customer,
Partner and Employee relationships
Source: ldenLlLy and Access ManagemenL: Cvervlew8afal Lukawleckl - SLraLeglc ConsulLanL, ro[ecL 8oLLlcelll LLd rafal[pro[ecLboLLlcelll.co.uk
3. lAM Lo do llsL
CreaLlon eL suppresslon
auLomaLlque de compLes
CesLlon des Lraces
Archlvage (duree??)
vle prlvee
Compllance
SecurlLe <> rlsques
ue plus en plus d'uLlllsaLeurs
L-buslness
32
Les Lrols elemenLs
6. La proLecLlon des donnees personnelles
Source : https:]]www.br|testream.com]d|fference.htm|.
Les |nformat|ons c|rcu|ent
u| vr|f|e?
Cul dolL avolr acces a quol?
LlmlLaLlons legales !
8esponsablllLes de l'organlsaLlon
1LLL1kAVAIL
lnformaLlons senslbles
60
7. lAM eL ConLrle
Le malllon falble.
uonnees reues eL Lransferees
Cue peuL-on
conLrler?
LlmlLes?
Correspondance
prlvee
Salsles sur salalre
SancLlons reelles
Communlquer les
sancLlons?

SecurlLe organlsaLlonnelle

ueparLemenL securlLe

ConsulLanL en securlLe

rocedure de securlLe

ulsasLer recovery

SecurlLe Lechnlque
8lsk analysls
8ack-up
rocedure conLre lncendle, vol, eLc.
SecurlsaLlon de l'acces au reseau l1
SysLeme d'auLhenLlflcaLlon (ldenLlLy managemenL)
Loggln and password efflcaces

SecurlLe [urldlque
ConLraLs d'emplols eL
lnformaLlon
ConLraLs avec les sous-
conLracLanLs
Code de condulLe
ConLrle des employes
8especL compleL de la
reglemenLaLlon
u| contr|e quo| ?
8. L-dlscovery
ueflnlLlon of e-dlscovery
LlecLronlc dlscovery (or e-dlscovery) refers Lo dlscovery ln clvll
llLlgaLlon whlch deals wlLh lnformaLlon ln elecLronlc formaL
also referred Lo as LlecLronlcally SLored lnformaLlon (LSl).
lL means Lhe collecLlon, preparaLlon, revlew and producLlon of
elecLronlc documenLs ln llLlgaLlon dlscovery.
Any process ln whlch elecLronlc daLa ls soughL, locaLed,
secured, and searched wlLh Lhe lnLenL of uslng lL as evldence
ln a clvll or crlmlnal legal case
1hls lncludes e-mall, aLLachmenLs, and oLher daLa sLored on a
compuLer, neLwork, backup or oLher sLorage medla. e-
ulscovery lncludes meLadaLa.
8ecommandaLlons
CrganlzaLlons should updaLe and/or creaLe lnformaLlon
managemenL pollcles and procedures LhaL lnclude:
e-ma|| retent|on po||c|es, Cn an |nd|v|dua| |eve|, emp|oyees tend to
keep |nformat|on on the|r hard dr|ves "[ust |n case" they m|ght need
|t.
!"#$ &'() *+,#+ (" #-('".-/'0, (),'# +("#-1, #,2*'#,3,.(+ -.4
4,5#,-+, (),'# +("#-1, 6*41,(7
off-||ne and off-s|te data storage retent|on po||c|es,
contro|s def|n|ng wh|ch users have access to wh|ch systems andunder
what c|rcumstances,
|nstruct|ons for how and where users can store data, and - backup
and recovery procedures.
Assessments or surveys shou|d be done to |dent|fy bus|ness funct|ons,
data repos|tor|es, and the systems that support them.
Lega| must be consu|ted. Crgan|zat|ons and the|r |ega| teams shou|d
work together to create and]or update the|r data retent|on po||c|es
and procedures for manag|ng ||t|gat|on ho|ds.
9. Concluslon
lAM n'esL pas unlquemenL une
quesLlon lnformaLlque les aspecLs
[urldlques eL de gesLlon sonL
essenLlels
ALLenLlon aux aspecLs compllance
lus de securlLe necessalre
Cloud compuLlng
vlrLuallsaLlon
uaLa prlvacy
archlvage
1ransparence
L-dlscovery
L'lAM esL aussl une opporLunlLe
8epenser la securlLe
LlmlLer les rlsques
8edulre les coLs
8epreclser les rles eL
responsablllLes
Apprehender les rlsques fuLurs
76
LL demaln?
hLLp://www.novell.com/docrep/2013/09/1he_lorresLer_Wave_lAM_9_4_13.pdf
77
hLLp://Ls.fu[lLsu.com/rl/lu[lLsu_lorum_2013/documenLaLlon/8CS8110a_20131030_v3_flnal_SecurlLy.pdf
Je suis prt rpondre vos questions
Jacques Folon
Jacques.folon@ichec.be

S-ar putea să vă placă și