Having a compliance policy is fine, but how do you show or even prove that you are really in control? By having the ability to enforce the policy is the answer to that question.
One of the main areas of concern with such a policy is access control. Access control comprises measures to selectively limit access to and use of corporate assets, including data/information, to authorized entities only.
Protection against information theft or tampering with company assets/data, and thus its value chain, by outsiders is of the utmost priority, the insiders come next. In order to grant just the right amount of access privileges, the access control mechanisms need to know whom they are dealing with by introducing user authentication/identification.As proof of identity your credentials are requested by the authenticator. Take note that if outsiders can still snoop around your credentials, they can also impersonate you (identity theft!).
In a heterogeneous IT environment various back office platforms and applications use proprietary forms of authentication. The effort to show/prove that you are in control of each individual mechanism is staggering. Striving for uniformity brings large rewards.
What is also required is the ability to provide and revoke access credentials for the back office in a timely and affordable fashion (as part of the hiring & firing life cycle). Issuing certificates of meaningful trust levels and maintaining control over a revocation process and related systems in a fully-fledged "classic" PKI, comes at a high price in terms of cost and effort, not to mention showing/proving compliance.
With our solution, not only do you assert compliance for managing access control, but you enforce it by providing secure communication, secure primary authentication and uniformed authentication for back office systems. We do this through the use of automated issuance of X.509 certificates that comply with your validity/expiry policy requirements, thus eliminating the time-consuming revocation tasks for back office systems.
