6.0. Data Governance Edition. Data Governance Quick Start Guide

Transcription

1 6.0 Data Governance Edition Data Governance Quick Start Guide

2 2012 Quest Software, Inc. ALL RIGHTS RESERVED. This guide contains proprietary information protected by copyright. The software described in this guide is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser s personal use without the written permission of Quest Software, Inc. The information in this document is provided in connection with Quest products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Quest products. EXCEPT AS SET FORTH IN QUEST'S TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, QUEST ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL QUEST BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF QUEST HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Quest makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Quest does not make any commitment to update the information contained in this document. If you have any questions regarding your potential use of this material, contact: Quest Software World Headquarters LEGAL Dept 5 Polaris Way Aliso Viejo, CA legal@quest.com Refer to our Web site ( for regional and international office information. Trademarks Quest, Quest Software, the Quest Software logo, and Simplicity at Work are trademarks of Quest Software and its subsidiaries. See for a complete list of Quest Software s trademarks. Other trademarks are property of their respective owners. Quest One Identity Manager Data Governance Edition - Data Governance Quick Start Guide Updated - August 2012 Software Version Third Party Contributions Quest One Identity Manager contains some third party components (listed below). Copies of their licenses may be found at COMPONENT LICENSE OR ACKNOWLEDGEMENT Boost Boost Software License - Version August 17th, 2003.NET logging library 1.0 Copyright , The Regents of the University of California. All rights reserved. BSD 4.4 License.

3 COMPONENT Dojo Toolkit 1.6 Google Open Sans 1.0 JQuery JQuery UI Mono.Security Novell.Directory.LDAP SharpZipLib spin.js Windows Installer XML toolset (aka WIX) ZLib.NET zlib LICENSE OR ACKNOWLEDGEMENT Copyright , The Dojo Foundation All Rights Reserved. BSD Simple License. Copyright January 2004 ( Apache 2.0 License. Copyright 2011, John Resig. MIT License. Copyright 2011, John Resig. MIT License. Copyright 2004 Novell, Inc. ( MIT License. Copyright 2003 Novell, Inc. ( MIT License. Copyright Mike Krueger, John Reilly. SharpZipLib License. Copyright 2011 Felix Gnass [fgnass at neteye dot de]. MIT License. Common Public License 1.0 Copyright 2006, ComponentAce ( All rights reserved. Copyright (C) Jean-loup Gailly and Mark Adler ZLib.NET License notice Copyright (c) 2006, ComponentAce All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. Neither the name of ComponentAce nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDEN- TAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PRO- CUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

4

5 CONTENTS CHAPTER 1 INTRODUCTION ABOUT THIS GUIDE SYSTEM REQUIREMENTS DEPLOYMENT OVERVIEW READY SERVICE ACCOUNTS AND MANAGED DOMAINS FOR DEPLOYMENT CONFIGURE MANAGED HOSTS LOCAL AND REMOTE AGENTS CONFIGURATION OPTIONS ADDING MANAGED HOSTS ADDING SHAREPOINT MANAGED HOSTS ADDING NETAPP ATTACHED STORAGE DEVICE, EMC CELERRA STORAGE DEVICE, OR CLUSTER MANAGED HOSTS VERIFY MANAGED HOSTS SYSTEM STATUS DATA GOVERNANCE OVERVIEW QUEST ONE IDENTITY MANAGER TOOLS USED TO GOVERN DATA IDENTIFYING DATA TO BE GOVERNED CHAPTER 2 STEP-BY-STEP WALKTHROUGHS PERSONAS COMPARE ACCOUNT ACCESS AND PERFORM GROUP MEMBERSHIP SIMULATIONS ESTABLISH DATA OWNERSHIP GOVERN DATA CREATE AN ACCESS POLICY WORK WITH GOVERNED DATA THROUGH DASHBOARDS AND VIEWS REQUEST DATA ACCESS THROUGH THE IT SHOP PERFORM AN ATTESTATION REVIEW OF DATA OWNERSHIP AND SECURITY SUBSCRIBE TO ACTIVITY AND ACCESS REPORTS CHAPTER 3 ABOUT QUEST SOFTWARE ABOUT QUEST SOFTWARE CONTACTING QUEST SOFTWARE, INC CONTACTING QUEST SUPPORT GLOSSARY INDEX

6 Quest One Identity Manager Data Governance Edition 6

7 1 Introduction About this Guide System Requirements Deployment Overview Data Governance Overview

8 Quest One Identity Manager Data Governance Edition About this Guide This document has been prepared to assist you in becoming familiar with Data Governance, an integral component of Quest One Identity Manager Data Governance Edition. This document is for network administrators, consultants, analysts, IT professionals responsible for deploying Data Governance in their organization, and Web Portal users. It provides typical use cases and step-by-step instructions to help you understand how to use Data Governance to secure the unstructured data in your organization. The Data Governance Edition Quick Start Guide is supplemented with the Data Governance Edition User Guide, which provides more detailed information about the Data Governance features, and includes instructions to help administrators perform day-to-day administrative activities. 8

9 Data Governance Quick Start Guide System Requirements Review the following section to ensure that your system meets the following minimum requirements. For complete Quest One Identity Manager system requirements (including those required for the client and the Web Portal), see the Quest One Identity Manager Release Notes. Data Governance Server To configure a Data Governance server, the user must belong to the Administrators group of the computer hosting the server. System Requirements: Windows Server 2003, Windows Server 2003 (R2), Windows Server 2008, Windows Server 2008 (R2), Windows SQL Server 2008 (R2) (64 bit non-itanium) quad core CPU 1024x 768 screen resolution with 16-bit color 100 GB free disk space 16 GB RAM Software Requirements:.Net 3.5 Service Pack 1 or later Microsoft SQL Server Enterprise Edition 2008 Service Pack 3 or later, Microsoft SQL Server Enterprise Edition 2008 R2 Service Pack 1 or later (compatibility level: 10) Oracle database 11g r2 Enterprise Edition version 11.2 and higher (patch level will vary with operating system platform). Quest only provides a 64-bit server for Data Governance. Ensure that the server installed on a given computer uses the correct architecture to match the installed operating system. Account Requirements: You must be an administrator of the computer on which you are installing the Data Governance Server. You must have the credentials of an account that can be used to create a database on the SQL server being used by the Data Governance Server. You must have the credentials of an account that can be used as a Service Account for your managed domains. For both the Web Portal and the Data Governance front ends, users must be logged in with an Active Directory user account from an Active Directory domain that's in the Identity Manager database. 9

10 Quest One Identity Manager Data Governance Edition Data Governance Activity Database System Requirements: quad core CPU 100 GB free disk space 16 GB RAM Agent Requirements System Requirements Update Rollup 1 for Windows Server 2000 with Service Pack 4, Windows Server 2003, Windows Server 2003 (R2), Windows Server 2008, or Windows Server 2008 (R2) (32 bit or non-itanium 64 bit) 500 MHz+ Processor 1024 MB RAM 100 MB free disk space for every 1,000,000 files / folders scanned Real-time file system updates and resource activity tracking are not supported on versions of ONTAP NetApp filers earlier than 7.3. Additionally, the following Network Attached Storage Devices are supported as managed hosts, but must be scanned remotely: NetApp 7.2 and 8.x(Data ONTAP)*, EMC Celerra 5.6 with Server Message Block 1.0. Windows 2008 and Windows 2008 (R2) failover clusters are supported as remote managed hosts types. Resource activity tracking is not supported for clusters. Report Requirements For Data Governance reports to function, proper authentication checks must be performed. This is accomplished by configuring the job server service to logon as an Active Directory account associated with an Employee who has been assigned the Data Governance Administrator application role. This job server must be configured with the SMTP Host server mask to ensure it is the job server that runs the reports. SharePoint Requirements\Recommendations Scanning SharePoint Server 2010 is supported. Standalone farms are not supported. Farms configured with only Local Users/Groups are not supported. Recommend installing the agent on a dedicated SharePoint 2010 Application Server in the farm and not on a Web Front server (to reduce processing load on the web front end server). Recommend 100 GB disk space on the SharePoint agent computer for data storage and scan post-processing activities. The space required is dependent on the number of sites, lists, and document libraries and the number of unique permissions gathered from the farm. Recommend 8 GB RAM for the SharePoint agent computer. Ensure that the service account configured for the SharePoint managed host is a SharePoint Farm Account (same account that is used to run the SharePoint timer service). 10

11 Data Governance Quick Start Guide Web Portal Requirements To access Quest One Identity Manager Data Governance Edition functionality in the Web Portal, you must configure IIS to use Integrated Authentication. If the web server hosting the Quest One Identity Manager Web Portal is running on the same computer as the Data Governance server you must set the ImpersonateWcfCalls IIS application setting to TRUE. If the web server hosting the Quest One Identity Manager Web Portal is running on a different computer than the Data Governance server you must include entries in the ExplicitlyAllowed- Identities.txt file for the IIS host computers ActiveDirectory account. Deployment Overview The following activities must be performed to have a fully functional Data Governance deployment: Install Quest One Identity Manager and Data Governance Configure the Identity Manager and Data Governance Activity database Synchronize your target environments (Active Directory and SharePoint) Install the Web Portal Map employees with the required Data Governance application roles Deploy managed hosts Recommended Deployment: Install Quest One Identity Manager Administrative and System Configuration tools on Windows workstation. Install Quest One Identity Manager Server Service on Windows Server with good connectivity to a database server. Install Quest One Identity Manager database on a dedicated Windows SQL Server. Install Quest One Identity Manager Web Portal on a dedicated Windows IIS Server. For detailed installation and configuration procedures, please see: Installing the Identity Manager on page 21 in the Quest One Identity Manager Getting Started Guide. Setting Up Active Directory Synchronization on page 236 in the Quest One Identity Management Guide. Setting Up SharePoint Farm Synchronization on page 354 in the Quest One Identity Management Guide. Quest One Identity Manager Web Portal Installation Guide and Quest One Identity Manager Web Portal User Guide. The Identity Manager Roles Model on page 87 in the Quest One Identity Manager Getting Started Guide. Configuring Data Governance on page 13 and Working with Managed Hosts on page 15 in the Quest One Identity Manager Data Governance Edition User Guide. 11

12 Quest One Identity Manager Data Governance Edition Ready Service Accounts and Managed Domains for Deployment Before you can gather information on the data in your enterprise, you must: Add and assign the credentials (service accounts) used to access resources on the computers within the domain. Select the domains that contain the computers and data that you want to manage. The operations within the Data Governance use different credentials. The following table details when the accounts are being used. Account Usage ACTIONS Manage Trustee Access, Report on Trustee Access Manage a domain Read a Trustees Group Membership Information Deploy an Agent Remove an Agent Synchronize Agent Service Accounts Restart an Agent Modify Resource Security Remotely Index Security Information MANAGED DOMAIN SERVICE ACCOUNT Group membership and trust read rights. Create container and service connection point objects in the target domain's System container. Service Account must have the right to log on to the Data Governance Server computer interactively. Group membership and trust read rights. Administrative rights on the target managed host (only during deployment). Administrative rights on the target managed host (only during removal). Administrator or Server Operators rights on the target managed host. Administrator or Server Operators rights on the target managed host. Modify the security of the object natively. AGENT SERVICE ACCOUNT Read security and list children rights for all roots and root children selected for scanning. 12

13 Data Governance Quick Start Guide To add a service account 1. In the Data Governance Navigation view, right-click Service accounts, and select New. 2. In the Change master data form, select the Active Directory account, and enter the password and comments. 3. Save your changes. To assign a service account 1. Select Data Governance in the Quest One Identity Manager Navigation view. 2. In the Navigation view, select Service accounts, double-click the required service account, and select Assign domains in the Tasks view. Available domains are shown in the bottom and can be added, and currently assigned domains are shown in the top and can be removed. 3. Right-click a domain and select to assign or remove domains as required. 4. Save the changes. Configure Managed Hosts A managed host is any network object that can host resources and can be assigned an agent to monitor security and resource activity. Currently supported hosts include Windows computers, Windows clusters, NetApp Attached Storage Devices, EMC Celerra Storage Devices, and SharePoint farms. Local and Remote Agents Local agents reside on the same computer as the managed host. When you deploy a local agent, it immediately scans all fixed volumes on the host computer. You can only use a single agent on a locally managed host; however, local agents provide the best performance and the most functionality. Windows computers use local agents. Remote agents reside on a remote computer other than the managed host, and require a service account with adequate credentials to read the security information. To improve performance, you can have multiple agents scanning a single host. You can use remote agents on Windows computers, and you must use them on Windows clusters, NAS and EMC devices. SharePoint agents are remotely managed and require a service account for the agents. They must be installed on a SharePoint server. Ensure that the service account configured for the SharePoint managed host is a SharePoint Farm Account (same account that is used to run the SharePoint timer service). Configuration Options Managed hosts must be properly configured for security indexing (and resource activity tracking, if applicable) to begin. An agent must be configured to communicate with the server and gather resource information. Until this is done, no security information will be stored or indexed for this computer. Agents are configured when you add or edit a managed host. The available configuration options vary on the type of managed host. Resource Scanning Resource activity tracking is available for locally managed Windows servers, SharePoint farms, and supported NetApp and EMC remotely managed hosts. It is used to collect data on identities, reads, writes, creates, deletes, renames and security changes on securable objects. 13

14 Quest One Identity Manager Data Governance Edition Security Index Roots Security index roots determine the unstructured data for which a security index is maintained. A security index root is the root of an NTFS directory tree to be scanned by an agent, or a point in your Share- Point farm hierarchy below which everything is scanned. The agent monitors the specified roots for changes to security settings. The agent by default will do a full scan of the computer for local managed hosts and SharePoint hosts. The security index roots available for scanning differ for local and remote agents. Scanning Schedule Through the Scan Schedule tab on the managed host master data, you can set the time and frequency with which the agent scans the target computer. For remote agents, you must enable the Immediately scan on agent restart option if you want the agent to scan immediately when it is added or if you want the agent to rescan the security index roots when the service is restarted. Real-time File System Security Index Updates The Real time file system security index updating option causes the agent to watch for change on the file system of the target managed host (create, delete, and rename operations, as well as DACL,SACL, and Owner changes). This results in a more up to date security index. Adding Managed Hosts To add a managed host with a local agent 1. In the Navigation view, select Managed hosts. 2. In the Tasks view, select Add managed host. 3. Select Locally Managed Windows Computer and click Add. 4. In the General tab, select the computer to scan from the Server list. When you install a locally managed host, you have the option of automatically installing the agent with the host, or manually installing the agent at a later date. Although it is recommended that you install the agent with the host, so you can properly configure it, if you are unable to do so due to a firewall or other security issues, you can manually install it after you set up the managed host. On the Agent Details page, choose External for the deployment method, and then run the Agent.msi file located in the Data Governance installation folder on the locally managed host. You must now decide if you want to enable resource activity tracking for the agent. 5. Select the Resource Activity tab, and configure the resource activity tracking. 6. Select the Aggregation period. As resource activity is continuously tracked, this period is used to group together the results over a period of time. 7. To limit network traffic, select Enable activity synchronization window. 8. To excluded accounts and objects from tracking, click the Manage Exclusions button and select the objects to exclude. a) Select to add or remove users or groups, file extensions or folders to be monitored for resource activity. b) Use the Export and Import buttons on their respective tabs to export and import a list of SIDs, file types, or folders to exclude. For file extensions, you can enter a Category name to group any extensions you add to the exclusions list. c) Select OK to save the changes. 14

15 Data Governance Quick Start Guide 9. To selectively scan a host, select the Security Index Roots tab, and select Add security index roots from the Tasks view. For a local host, you need to add and save your changes before you can add a security index root. For a remote host, you need to add and save your changes, then add an agent and save your changes before you can add a security index root. 10. Choose the directory to be scanned and the required agent, and click OK. Local agents by default scan all local fixed volumes on their host computer. 11. Save your changes. To add a managed host with a remote agent 1. In the Navigation view, select Managed hosts. 2. In the Tasks view, select Add managed host. 3. Select the Remotely Managed Windows Computer option, and click Add. For remotely managed hosts, the first remote agent should be added during the host s initial deployment. You can manually add more remote agents later, if needed. 4. In the General tab, select the computer to scan from the Server drop down list. Real-time file system security index updating and Rescan on error are checked by default. 5. Save your changes. 6. Select the Agents tab, and click Add agent in the Tasks view. 7. Select the agent host computer from the Server location list, and select a service account with sufficient permissions to access both the target computer and the agent host. Save the agent data. An agent requires a service account that has the right to read security information on the remote host. This account is configured separately, and then selected when you deploy the agent. 8. Select the newly created managed host in the Result list, and select the Scanning Schedule tab to set the time and frequency with which the agent scans the target computer. 9. Select the Security Index Roots tab to select the roots to scan. More than one remote agent may be configured to scan a managed host provided each agent scans different security index roots. A given security index root can be scanned by only one agent. 10. Select Add security index roots in the Tasks view, select the required roots, and click OK. 11. Save your changes. The Data Governance server will add the managed host (after it has been added and saved) and deploy the agents (once it has been configured and saved) to scan for information. Adding SharePoint Managed Hosts SharePoint farms are similar to remotely managed hosts in that they require an associated service account, even though they are installed locally on a SharePoint server. Like a locally managed host, you have the option of selectively including and excluding objects to be scanned by its agent. Please see Appendix B: EMC Celerra, NetApp Filer, and SharePoint Configuration Details on page 79 in the Quest One Identity Manager Data Governance Edition User Guide before adding this type of managed host. The following procedure requires a SharePoint synchronization to have been performed. For details, see Setting Up SharePoint Farm Synchronization on page 354 in the Quest One Identity Manager Identity Management Guide. 15

16 Quest One Identity Manager Data Governance Edition To add a SharePoint managed host 1. In the Navigation view, select Managed hosts. 2. In the Tasks view, select Add managed host. 3. Select SharePoint Farm, and click Add. 4. In the General tab, select the SharePoint farm to scan from the drop-down list. 5. Select the Agent Details tab, and select the required service account. 6. Select Scanning Schedule tab to set the time and frequency with which the agent scans the target computer. You must now decide if you want to enable resource activity tracking for the agent. 7. Select the Resource Activity tab, and configure the resource activity tracking. 8. Select the Aggregation period. As resource activity is continuously tracked, this period is used to group together the results over a period of time. 9. To limit network traffic, select Synchronize only between these times and set the start and end time. 10. To exclude accounts, click the Manage exclusions button and select the accounts to exclude. 11. The default for SharePoint managed hosts is to scan all data roots if no roots are specified. To selectively scan a managed host, select the Security Index Roots tab, and Configure security index roots in the Tasks view. 12. Select the directory and objects that you want included and excluded from the scan, and the required agent, and click OK. 13. Save your changes. Adding NetApp Attached Storage Device, EMC Celerra Storage Device, or Cluster Managed Hosts Cluster are supported for Windows 2008 and 2008 R2 failover configurations only. You can add these as managed hosts, with remote agents. Please see Appendix B: EMC Celerra, NetApp Filer, and SharePoint Configuration Details on page 79 in the Data Governance Edition User Guide before adding this type of managed host. To add a NetApp or EMC device or cluster as a managed host 1. In the Navigation view, select Managed hosts. 2. In the Tasks view, select Add managed host. 3. Select Windows Cluster, NetApp Storage Device, or EMC Celerra Storage Device, and click Add. 4. Select a computer from the Server drop down list and save your changes. Real-time file system security index updating and Rescan on error are checked by default. 5. Select the Agents tab and Add agent in the Tasks view, and select a service account with sufficient permissions to access the target computer. 6. Select Scanning Schedule to set the time and frequency with which the agent scans the target computer. These settings will apply to all agents on this host. 7. For EMC Celerra and Net App, select the Resource Activity tab, and configure the resource activity tracking. 16

17 Data Governance Quick Start Guide 8. Select the Aggregation period. As resource activity is continuously tracked, this period is used to group together the results over a period of time. 9. To limit network traffic, click the Enable activity synchronization window and set the start and end time. 10. To exclude accounts, click the Manage exclusions button and select the accounts to exclude. The EMC CEPA interface allows only one vendor or vendor's product to subscribe to CEPA Auditing events for a given computer. To overcome this limitation, you can use the Quest Common Event Enabler (QCEE) service. Select the required QCEE server to use for auditing activity and real time file system security index updating. 11. Save your changes. The Data Governance server will add the managed host (after it has been added and saved) and deploy the agents (once it has been configured and saved) to scan for information. Security index roots cannot be configured until the agent has been configured and saved. The exception to this rule, is if you are deploying managed hosts through the Add Multiple Managed Hosts task. From here you can configure the security index roots before deploying remote agents. 12. Select the Security Index Roots tab to select the roots to scan. 13. Select Add security index roots in the Tasks view, select the required roots, and click OK. 14. Save your changes. Verify Managed Hosts System Status When you first deploy a managed host it takes a few minutes for the agent to start collecting data. As the state changes, a regular refresh will allow you to see the changes. To check the state of all managed hosts in your environment In the Navigation view, select Managed hosts. The status column contains the current state of the your managed host. 17

18 Quest One Identity Manager Data Governance Edition Data Governance Overview Control over your organization s data is vital to eliminate issues such as security breaches, loss of sensitive information, or non compliance with external and internal guidelines. There is a need to govern access to unstructured data available to employees through file servers, SharePoint sites, and NAS devices. Business owners and IT administrators can collaborate to align IT infrastructure and security goals with the overall company strategy by providing: Activity details both from an identity (user) and resource (data) perspective. Visibility and control over who has access and the type of access to resources within your environment. Access to self-service access request workflows and services. Ability to define access control policies and pro-actively triage any compliance violations. Ability to enable business owners to approve who can gain access to the data they own. Ability to periodically attest to resource access to meet compliance objectives. Key processes in securing and controlling access to your data. 18

19 Data Governance Quick Start Guide Quest One Identity Manager Tools Used to Govern Data Governing unstructured data enables data access management, preserves data integrity, and provides content owners with the tools and workflows to manage their own data. The workflows required to manage data cross the Manager/Identity Manager and the Web Portal. Administrator and Web Portal user tasks The Manager/Identity Manager is the tool administrators use to perform their daily work. The Web Portal is the interface that makes Quest One Identity Manager Data Governance Edition visible to end users. An essential component is the web-based employee self-service request portal, which is realized through the IT Shop. Using simple, standardized forms, each employee is able to request access for the resources they need to perform their day-to-day duties. The Web Portal also includes dashboards, views, and reports that provide a breadth of information to provide auditors, compliance/security officers, manager, and business owners with the information they need to ensure compliance to internal and external guidelines. It is through the Web Portal as well, that resource access and ownership can be attested to and compliance policy violation will be addressed. IT administrators are focused on maintaining an optimal and secure storage/access infrastructure. They will use the Manager/Identity Manager to: Provide visibility on who can and is accessing what resources, where are the stale groups and stale data through a detailed security view. Manage access and edit security settings on the resources. Create a bridge to the business by helping identify and assign the business owner for resources. Secure unstructured data through placing them under governance and publishing to the IT Shop, thereby enabling self service requests that provide compliance checks. 19

20 Quest One Identity Manager Data Governance Edition Security Admins use the Manager/Identity Manager to: Identify and manage: User access to enterprise resources such as files, folders, share across NTFS, NAS Devices and SharePoint. Service accounts and their enterprise activities All users/groups that have access to a specific enterprise resource Unresolved SIDs Child resource access that deviate from the parent Top active resources and users Probable business owner of a resource Perform What If access modeling including: Comparing two user accounts/groups to identify the impact of adding/removing users to/from groups. Identifying why two employees in the same department have different access rights. The business has a need to empower the workforce to access to the resources they need while ensuring continuous compliance and accountability of the stakeholders. Through the Web Portal, users have access to: Self-service requests that streamline how people obtain access to the data they need. Access certification processes that ensure proper allocations of resources. Policy enforcement system that guides stakeholders including compliance officer (who provide the governance on how things should be done and how goals are met); Managers (who provide the tactical execution on how access is provided, how compliance is achieved, and how least privilege principles are fulfilled); and Auditors (who complete traceability of processes in place, how things are done, and who is are accountable). Views, dashboards and reports that enable the business owner to see the access employees have to all the resources they own and the resource activity on those resources. The compliance/security officer also uses the dashboards and views to access information on governed data, attestations, and policies. Identifying Data to be Governed The process of identifying data to be governed is continuously adaptive in nature. Those responsible for identifying the data may include the business owner, the administrator, the compliance officer, and managers. Consider the following when selecting the data that should be governed: Monitor Top Active Content and Top Active Users reports and views in the Web Portal to identify content that is potentially valuable to the organization. Identify enterprise applications that can export data to flat files and highlight them as potentially needing to be governed. These files may contain sensitive data. Identify content with several access points. For example, if a content is available to Everyone, All Sales, or All Employees you would assume that it is meant for public consumption. However, sensitive file may be placed in the public area either in error or through malicious intent. It is important to assign a high risk index to content with wide access points and bring them under control. Identify groups with a large number of members and investigate their resource access. Sensitive information could be inadvertently available to people through their memberships. Talk to business owners. They are stakeholders in making the data governance process suc- 20