CIOs are waking up to the reality that they've lost control over access to data stored in software-as-a-service applications purchased by other departments.
"By the time an organization buys its sixth or eighth SaaS application, it's in trouble," says Jackie Gilbert, vice president and cofounder of SailPoint, which sells software for bringing these applications back into compliance with company policy. "We're poised to see more auditor attention and more security directed at this problem."
[ In the data center today, the action is in the private cloud. InfoWorld's experts take you through what you need to know to do it right in our "Private Cloud Deep Dive" PDF special report. | Also check out our "Cloud Security Deep Dive," our "Cloud Storage Deep Dive," and our "Cloud Services Deep Dive." ]
Gilbert says that IT departments are discovering that they can't manage or control access to popular cloud applications such as Salesforce, GoogleApps, Concur, ADP, Workday, Taleo, or Box if provisioning and de-provisioning is handled by the department that purchased the application.
"Because it's being done outside of IT, the kind of discipline and access control best practices do not normally get done," Gilbert says. "The more SaaS applications that an organization starts to adopt, the more they start to see security weaknesses crop up."
Here are a few of the most common signs that your identity and access management (IAM) solution isn't working when it comes to your growing portfolio of cloud applications:
1. End users start sticking Post-It notes all over their computers listing user names and passwords for cloud-based applications. One solution to this problem: a single sign-on system that supports your portfolio of hosted applications as well as your directory system.
2. Employees leave the company, but their access to cloud-based applications isn't removed, resulting in a proliferation of so-called "orphan accounts.'' To solve this problem, you need to have an automated de-provisioning system that eliminates access to cloud applications at the same time as traditional software applications.
3. Managers are no longer approving data access for new employees. Most large organizations have access control systems that automatically generate email to managers for them to approve user privileges, but these access control systems don't always include hosted applications.