With so much going on in both your world and ours, we rarely have the opportunity to say thank you to our clients as well as to those on our staff that provide great service and amazing products all year. Thank You!

What’s New in 2013?

Over the last quarter of 2012 we started some very interesting development projects to extend the functionality of our privileged identity management products. In this month’s Top of Mind column, I would like to share some of the exciting new features coming out in the next version of E/RPM. We are expecting this version to be released in the March/April 2013 timeframe.

Double Safekeeping / Four Eyes Release

As part of BASEL II, many organizations are now being required to store and retrieve secrets in multiple parts so that no single person maintains certain key secrets alone. The idea is that to unlock something or gain access to something, two (or more) parties must be physically present to provide their part of a secret such as a password. Double safekeeping is similar to the “two-man rule” used for missile launches.

In our new implementation, you can break up both static (you upload them) and dynamic (random and automatically generated) passwords in as many different parts as you wish. Each part or segment is assigned to a group (or user) that is given access to that part for uploading/downloading/retrieving their part at the appropriate time. The idea is that no normal individual would belong to a group that would give them more than one part of the password. In practice, a manager may own one part of the password and an IT staff member may be able to obtain their part; together both parties have the whole password and neither discloses their part to the other.

The nice thing about our implementation is that all of the delegation and splitting/assembly of passwords is automatic and can be configured on an account-by-account basis for all types of passwords. The other great part is that you can decide which credentials you want to split in this fashion, into as many parts as you wish. All of the recovery steps by each participant are fully audited automatically.

Password Check-Out to a Group

Normally, credentials are checked-out to one and only one user so that you have attribution of usage to a specific person. In the case where another person needs to check out a password that is already checked-out, the first person must first check-in the password.

One of our customers had the situation where groups of persons needed access to not one, but a set of credentials at the same time without the requirement to change the password every time the password was disclosed to another person.

To support simultaneous access of passwords, we have implemented a new feature that allows a user to optionally delegate access to their checked-out password to any group they are a member of at the time of password check-out (password disclosure point). When a user of a just delegated group tries to check-out a credential that was previously checked-out, they receive the same password previously disclosed to the original requester without the need to change the password. If any user or group delegated access to the password checks-in that password, it checks it in for everyone and it gets changed automatically (or after a time-out of disclosure, it gets changed automatically).

Other Great New Features

The next version of E/RPM has integrations for some new and existing partners. For those using McAfee ePO, we have completed a new integration that allows you to check-out credentials for systems you see in the ePO interface. We are currently waiting for the completion of official certification by McAfee for this integration.

For those using the Qualys QualysGuard product line, we are in the process of completing an integration with Qualys that allows their appliances to retrieve access credentials for systems and databases needing administrative access. We have completed our part of the integration and are awaiting the release of the next version of the Qualys software which incorporates support for our product.

If you are using ServiceNow as your trouble ticket system, we have completed a comprehensive integration with their service. The integration not only allows trouble ticket verification of state, owner and ID number, but also annotates tickets with credential check-outs. As is typical of our third-party integrations, adding support for ServiceNow will take less than 5 minutes to complete, and you can do it yourself; as you have come to expect, it is fully documented and non-proprietary.

When Are These Available?

All of the above features and enhancements are available today for beta testing (except Qualys, since they need to release a new version to support our software; and McAfee does not allow uncertified solutions to be touched by customers). If you want to try these new features out in your environment or via one of our hosted test environments, contact our support department (support@liebsoft.com) and they can arrange to get you a beta copy of the next version of E/RPM.

Is There More?

The above is just a tiny subset of the new features for the next version of E/RPM. Our development team has been working non-stop since the last release to produce a new version that will amaze you and further confirm what you have heard from us: your purchase is not an expense, but an investment in the future.