New Content-Aware Identity and Access Management (IAM) technologies promise to help enterprises rapidly embrace cloud-- and new business models-- without increasing risk.

Some security managers have a reputation for always trying to put the kibosh on new projects and new ways to use IT. In many organizations, the CSO and team have become known as “Dr. No” when it comes to certain device use, social networking tools or even cloud computing. (See related blog here.)

It's not necessarily their fault. The job of a security chief is to protect enterprise assets, after all. And the reality is that security applications — identity and access management, data-leak prevention tools, user activity reporting, among others — alone don't provide the necessary insight into users and the information and resources they want to use at the moment of the transaction. That is, they don't provide the context needed to measure real-world risk.

But this is changing.

At CA Technologies, we believe a new twist on identity and access management and data protection technologies — what we call Content-Aware IAM — will help to move this conversation forward by adding the necessary intelligence around content and data to reduce risk while maintaining productivity, whether working in a traditional or a cloud environment or both.

For instance, the more tightly coupled the identity information — such as who the users are, their job role, etc. — is with the actual data accessed, the more secure the migration to cloud services can be. With Content-Aware IAM, enterprises can more granularly control not just what applications and data users are attempting to access, but also what they can do with that information.

Risk-based Decisions

With that user and data information at hand – and even information about the device the user is operating from — organizations can put the information to use at the time of transaction and create a risk-based judgment about individual transactions. Think of this risk-based judgment as being similar to that of a credit or FICO score. Instead of checking credit history and opening a new credit card or car loan, Content-Aware IAM will evaluate the user and look at who she is, what devices she is using and what data she wants to access. Then, based on a set of predetermined criteria and policies — just like a FICO score — the advanced authentication portion of Content-Aware IAM (specifically, our CA Arcot RiskFort technology) can assign a risk score that determines whether or not a transaction can proceed.

For instance, if a user is accessing data daily from her desk PC during normal business hours, we'd assume a low-risk data transaction and can assume most actions would be allowed without further authentication. However, should this user suddenly start attempting to access that same data from an iPad after business hours from across the country, we'd have an entirely different risk score for the transaction. To proceed, even more advanced authentication can be required to verify her identity, such as a one-time-password sent to her cell phone number on file, or even delivered by a phone call.

Content-Aware IAM with advanced authentication allows security executives to control users, their access and what they can do with information. This helps organizations embrace the benefits of cloud computing and consumer technologies, such as tablets or smartphones, without bringing too much risk into the organization. That’s the path to saying “yes” to new IT projects and technologies.

Read the related article in Smart Enterprise magazine here.