Computer Associates has unveiled its eTrust Identity and Access Management Toolkit (eTrust IAM Toolkit), a solution that enables developers to build strong, consistent and more manageable identity-based security into their business applications. According to the company, the eTrust IAM Toolkit eliminates the problems associated with managing multiple application-level security "silos"... |
Computer Associates has unveiled its eTrust Identity and Access Management Toolkit (eTrust IAM Toolkit), a solution that enables developers to build strong, consistent and more manageable identity-based security into their business applications. According to the company, the eTrust IAM Toolkit eliminates the problems associated with managing multiple application-level security "silos" - thereby easing security management, simplifying compliance processes, unifying auditing tasks, and improving IT responsiveness to business changes.
The eTrust IAM Toolkit provides a software development kit (SDK) and additional technologies that enable developers to embed a common set of fine-grained, identity-based security controls within applications. It can be implemented with a full range of third-party provisioning and identity management tools, as well as with CA's eTrust security solutions - including eTrust Access Control, eTrust SiteMinder, eTrust Admin and eTrust Security Command Center - to create a comprehensive enterprise security management environment as set forth in CA's eTrust Security Management Architecture.
"Enterprises require a consistent framework for developing and managing identity and access management needs at the individual application level," said Roberta J. Witty, research vice president at Gartner, Inc. "The time has come to take an enterprise view of identities and roles instead of the siloed application development group view that represents reality in most IT shops today. By using a standardized approach to building in application authentication and authorization, and by centralizing the management of identities and application access policies, enterprises can achieve a higher degree of security and flexibility. This can also reduce the costs of development and operations associated with maintaining unique approaches to security for each application."
Because the eTrust IAM Toolkit allows developers to leverage existing security infrastructure, they can implement and enforce rules based on business logic - using resource and user attributes defined in centralized user stores and other enterprise systems, such as HR and ERP - rather than writing application-specific code. "IT organizations have historically struggled to consolidate the management, control and auditing of user access across their diverse enterprise applications," said Hee Keen Keong, technology strategist -
Office of the CTO at CA. "With CA's eTrust IAM Toolkit, developers of these applications can easily take advantage of standardized security policies to improve application security and reduce development and maintenance costs."
CA's eTrust IAM Toolkit allows fine-grained access policies to be defined in a structured language format. Access policies can include time-based criteria like standard working hours and/or dynamic criteria such as customer spending limits. Policies can execute specific actions immediately following an authorization check, allowing business and/or security management workflows to be driven based on authentication/authorization results.
The eTrust IAM Toolkit also optimizes performance by evaluating policies locally, thereby minimizing external authorization calls, and allowing authorization checks measured at the rate of thousands per second. The eTrust IAM Toolkit can be used with CA's eTrust Admin and with popular directory systems including Microsoft Active Directory, Novell eDirectory, and Sun ONE Directory.
To meet different auditing requirements, the eTrust IAM Toolkit gives customers total flexibility to define what events to capture. It thus enables them to apply a consistent audit format across all of their applications, which enhances both the inherent quality of the audit and the optimal use of enterprise security analysis and reporting tools. |
