New IBM Security Software Helps Smaller Companies Thwart Insider Attacks and Automate Compliance

Software Identifies “Orphan Accounts” to stop unauthorized access to company data

ARMONK, NY – (February 17, 2006) – IBM today announced new security software to help small and medium sized businesses – from local credit unions to health clinics – deal with security threats such as insider attacks and automate compliance efforts. The software – Tivoli Identity Manager Express – will bring big-business identity management capabilities to smaller companies, but in a more affordable version that non-IT experts can install and manage.

Small businesses are prone to the same security threats as larger companies, but they lack the IT budgets or trained technical staff to set up identity management systems that control who can access company information.  Their entire security safety net may consist of antivirus software or a network firewall, which leaves the "digital back door" open to fired employees or dishonest contractors to access confidential financial or customer information. According to IBM studies, insider attacks are expected be a top security threat for 2006, because criminals are shifting away from hacking at the "front door," to taking advantage of unclosed user accounts from business changes such as employee layoffs, mergers and acquisitions.

IBM's new software helps thwart insider attacks by blocking people from using usernames and accounts that the company neglected to cancel.  More than 60% of user accounts consist of these so-called "orphan accounts," according to IBM studies.  With Tivoli Identity Manager Express, smaller businesses can eliminate orphan accounts by enabling managers to control who has access to information and continuously matching their pool of user accounts with current employee information.

The software also simplifies compliance efforts for smaller businesses by cutting down the time it takes to compile information and prepare reports from days to hours. It can automatically collect and format information so it's ready to be submitted to the compliance auditor.  The software can even detect potential attempts to steal customers by indicating who has accessed sensitive sales information and who approved their access for a valid business reason.

The new IBM software can help make it easier to meet compliance mandate requirements, such as maintaining appropriate internal controls, by automating the way companies can verify employee access to information. Someone who has moved to a new department should no longer be able to access financial reporting reports without special permission, since it's no longer part of their job.  The software can manage who has access to which accounts so that companies can even show auditors that they verify employee access to financial reporting applications during a set time period, such as every 90-days.

Tivoli Identity Manager Express also helps companies cut down the cost of managing passwords.  When employees forget or lose passwords, they often waste time "on hold" with a help desk which industry research says is costing businesses about $20 for each password reset request. IBM's new software enables employees to automatically secure a new password on their own, in minutes.  It also enables new employees or contractors to request and receive a new user account in minutes, a process that can take up to 12 days, especially for smaller businesses.  

IBM worked directly with small and mid-size companies and used their direct feedback to develop the software features, such as customized "dashboard" views of the software from a manager or help desk's perspective. Growing mid-size companies can use the software as the first step toward a more advanced identity management solution by taking advantage of the quick deployment capabilities.

Nearly 70% of C-level executives at small and mid-sized companies who responded to an IBM survey said data security was at the top of their list of compliance concerns.  

“An effective security strategy extends beyond a perimeter defense method, such as firewall protection that helps keeps intruders away from the outside,” said Stuart McIrvine, director of corporate security for IBM. “Criminals are finding ways around this outside layer of defense and businesses of any size need identity management processes in place to help ward off attacks from within."

Tivoli Identity Manager Express will be available on February 28, 2006.