In today’s digital age information is power and all critical information is currently stored on protected servers operated by companies themselves or by 3rd party operators. If a company cannot protect its data from access by unauthorized individuals, the result can be devastating for the company itself as well as all vendors and stakeholders involved with the company. Such critical data which are usually protected using leading information security services can be used by unauthorized individuals to commit crimes such as insider trading, tender fixing etc. Countries all over the world have laws to prevent such unauthorized data access and non-compliance with the guidelines is cognizable offence with the companies paying hefty fines to the government, if the data security measures are breached. However, a common question that arises is how to companies ensure that their data stays protected from access by unauthorized individuals. Some of the security solutions designed to ensure proper data protection are:

Open Authentication Mechanisms

Open authentication mechanisms are commonly applied to limit the accessibility of web-based enterprise solutions, especially in cases, where the commonly used User ID and Password-based authentication procedures are deemed to be inadequate. Commonly used open authentication procedures include OpenID, Security Assertion Markup Language (SAML) and X.509 Certificate.

OpenID

OpenID is a leading open standard, which mentions procedures by which, enterprise users may be authenticated using a decentralized system. The main benefits of OpenID are elimination of the necessity for services to provide their own systems as well as the power provided to users for consolidating their own digital identities. Users are allowed to create their own OpenID account and use the same account information to log on to any website or web-based solution, which accepts OpenID authentication.

SAML (Security Assertion Markup Language)

SAML, an intellectual property the OASIS Security Services Technical Committee, is an open standard based on the XML platform. SAML supports the exchange of data required for authorization and authentication between two separate security domains such as between a service provider and an identity provider. The current SAML specifications either recommend or mandate the use of TLS 1.0 or SSL 3.0 for providing transport level security, while, XML Encryption and XML Signature are required to provide message-level security.

X.509 Certificate

X.509 Certificate is an ITU-T (International Telecom Union-Telecommunication) standard for Privilege Management Infrastructure (PMI) and public key infrastructure (PKI). Key specifications included in the X.509 Certificate include standard formats with respect to certification path validation algorithm, attribute certificates, certificate revocation lists and public key certificates. Version 3.0 of the X.509 is highly versatile and capable of supporting meshes and bridges apart from the strict hierarchy-based system of certificate authorities supported by the X.500 standard, which was mostly used by countries to fulfill treaty requirements related to state identity information sharing. In the X.509 system, a certification authority is allowed to issue a certificate binding key to an alternative name (such as a DNS entry/email address) or to a specific distinguished name (similar to the X.500 system). By using the X.509 certification a company can distribute its trusted root certificate to its employees to enable enterprise-wide access to the company’s PKI system using any web-browser.

Digital Signature

This is one of the most common techniques to ensure the authenticity of digital documents. A digital signature is comprised of a mathematical scheme, and a valid digital signature in effect implies that the transmitted message was received in its original form and was not altered during the transit period. The use of digital signature is most common in case of financial transactions and software distribution, as both cases require superior security to detect tampering or forgery. Digital signature is often used interchangeably with electronic signature, but, electronic signature is a much broader term, which is used in reference to any data, with the option of carrying a signature. In most cases, the mathematics schemes of Digital Signatures are cryptography based, which on correct implementation, are more difficult to forge as compared to handwritten signatures. Apart from financial transactions and software distribution, Digital Signatures are also found in messages, contracts and emails transmitted using a cryptographic protocol. Superior security can also be provided by saving the private key generated for use on a key card.

Encryption

Security of data whether stored on a server or transmitted to others is always a major concern for enterprises all over the world. One of the commonly used techniques to ensure superior security is the use of SSL (Secure Socket Layer), which prevents the unauthorized access of data to some extent. However, SSL is incapable of securing the data if multiple intermediaries are involves during transfer. Encryption is closely related to cryptography and it ensures that the data is rendered unreadable unless the user has the correct key to decrypt the message. Encryption is one of the leading techniques to ensure continued protection of sensitive information for data stored on mobility devices and servers.

Identity Provisioning

Identity provisioning refers to creating, maintaining and deactivating identification attributes and objects, which exist in multiple applications, directories or systems in case of various interactive or automated business functions. The process of identity provision often includes the following processes- federated change control, delegated user administration, consolidated user administration, self service workflow as well as change propagation. User objects are commonly used to identify various recipients such as partners, vendors, customers, employees etc. Key services included in identity provisioning include access to enterprise computing resources, authorized access to protected database items, inclusion within a restricted user directory, access to encrypted enterprise email etc.

These are only a few of the common techniques used by enterprises to ensure data security, as new technologies and threats emerge, enterprises are expected to introduce new security measures designed to protect corporate data according to the continuously changing circumstances.

For more information about security solutions, information security services, open authentication mechanisms, web based enterprise solutions or ensure data security, please visit us at www.extendcode.com