Oracle Magazine - September/October 2007 - Marcelo Machado

“Our authentication portal has multiple levels of trust associated with different levels of
authentication. We think that this is really important.”
—William Barnes, Manager of Identity Services, Pfizer
cate. Alternatively, a mobile user accessing the system
from a kiosk might use a secure ID one-time passwordtype
device such as RSA’s SecurID or the standardized,
open source Open Authentication (OATH) secure token.
“The hope is that by allowing users to select
what they want to use, it gives them the greatest
control over the experience they intend
to have,” explains Barnes. “One of the
major business benefits of this approach is
allowing people to use a credential they
may already have.”
According to Burton Group’s Henry,
having a centralized facility to enforce
and support access management policies
throughout multiple applications is a fairly
popular approach. “The idea is that no
matter what application a user is accessing,
the organization can rely on the same types
of authentication framework,” says Henry. “That
reduces the management burdens and helps to eliminate
potential mistakes that might occur.”
CENTRALIZING AUTHENTICATION
With its centralized authentication service, Pfizer has
taken the authentication process out of each application
and put it in the hands of the end user. And in the
future, Pfizer can immediately take advantage of any new
authentication methods that it wants to deploy, such as
biometric or fingerprint-type authentication options.
“Authentication is probably one of the hottest areas
in technology today, so we’re not prescriptive on exactly
what forms we will leverage,” says Pfizer’s Barnes. “But as
new ones emerge, we see this as the single place where
we can make them available.”
Of course, another important aspect of access
management for Pfizer is being able to manage
risk better by ensuring that the proper level
of authentication is required for specific
applications. For example, some applications
might have a low risk associated with access
to their data, while others might require
very high data integrity.
“Our authentication portal has multiple
levels of trust associated with different levels
of authentication,” Barnes says. “We think that
this is really important. Going forward, it will
allow application developers either to lower or
raise the bar required to get access to information and
protect the integrity of the data.”
Eventually, using this framework, Pfizer expects that
it could leverage the use of national IDs, which might
be issued through the European Union or by individual
countries. “As national and international identity providers
emerge, we see this framework as giving us the ability to
link directly to them,” adds Barnes. “And we will continue
to work with Oracle to enhance the native capabilities of
Oracle Audit Vault and Oracle Database Vault
In addition to providing authentication
and identity management, organizations
must provide data security that addresses
growing privacy and regulatory considerations.
For example, compliance and auditing
requirements have become a fact of
life for most organizations. Beyond ensuring
that the proper regulatory or industry
requirements are followed, organizations
also need to collect and analyze audit
data to keep track of the activities within
their systems. And because audit data can
be distributed across many systems and
stored in many databases, securing it and
ensuring that it hasn’t been tampered with
can be difficult.
“Oracle Audit Vault provides the ability to
consolidate audit data from different database
sources into one secure and scalable
repository, and then view all the audit trail
data, from all those sources, in one report,”
explains Tammy Bednar, senior principal
product manager, database security, Oracle.
“Oracle Audit Vault provides a consolidated
view of all audit operations, making it easier
to see the activities of your privileged users
across all your databases and raise alerts
on any suspicious activities.”
Securing the data in the database from
highly privileged users, Oracle Database
Vault helps to ensure database security
by protecting against insider threats and
addressing regulatory compliance needs.
It can also transparently enforce specific
operational policies or fine-grained security
requirements as specified by the auditors.
“Oracle Database Vault helps companies
implement separation of duties—managers
might not want even powerful administrators
to be able to look at important financial
data, for example,” says Vipin Samar, vice
president, database security, Oracle. “With
Oracle Database Vault, organizations can
increase the security level of an existing
application without changing the application,
which improves security throughout
the enterprise and helps reduce risks posed
by insider threats.”
ORACLE MAGAZINE SEPTEMBER/OCTOBER 2007 55