At the SailPoint user conference this week, I heard from many people who run large retail banking establishments. One thing they have in common is too many places that store their user’s identities. In some cases, they have to first filter their Active Directory data into a spreadsheet to make sense of who has what rights to which particular datasets. That is just insanity. It may be time to start to clean up your identity data.

SailPoint’s customers should know about these sorts of problems. They sell identity governance and management software and to some pretty big companies. SailPoint is installed in the world’s largest bank, the world’s largest insurance company, the world’s largest packaged goods company, the world’s largest oil company, and the world’s largest food services company. Do you detect a trend here?

Many of these large corporations have had a hard time getting a handle on where they store their identity information. For example, one customer has more than 65,000 employees and another 20,000 or so contract workers. For the employees, they have minimal information in Active Directory, and most of the personal data is stored in their ERP system. That is fine, but the opposite is the case for the contractors: their personal data is mostly in AD, with just the barest of details in the ERP system. And just when you get your head around that, they also have several spreadsheets that sit on various managers’ desktops that are manually maintained. That is a disaster waiting to happen.

One way to deal with this is what Gartner identity analyst Earl Perkins says to lose the mindset: “Stop talking about identity management as an IT problem and start talking about it as a business problem.” Make identity issues more visible to business-unit managers, so they can see the value of having a good identity governance process that can benefit their own bottom lines.

But given that the average identity management tool is a six-figure sale, you also need top-down support too: getting your board and upper management in on the deal is absolutely essential.

Certainly, figuring out how many HR and other databases you really have can be tedious, especially if you are a large multinational company with dozens of business units scattered all over the planet. At one large bank, they have spent the past decade acquiring lots of smaller banks on every continent, with the result that what started in North America with an predominantly English-speaking staff they now have almost as many Spanish-speakers in other pockets around the world.

Retailers have large influx of temporary workers towards the end of the year, when they hire up for the holiday shopping season. But the time to clean this up is now. Don’t wait until yearend when it is too late to start on a project like this. As one of the conference presenters said, “The drama among IT, info security and the business units can be overwhelming if you don’t have good identity management in place.” Truer words were never spoken.

At the SailPoint user conference this month, I heard that one common problem they have is too many places that store their user’s identities. In some cases, they have to first filter their Active Directory data into a spreadsheet to make sense of who has what rights to particular datasets. That is just insanity.

It may just be time to start to clean up your retailers’ identity data. You can read more about what I have to say and what I heard at the conference on my post for the Solution Providers for Retail blog here.

In the past, if you had a problem on your network, you had to look through mountains of log data with lots of patience and skill. If you wanted to figure out if your clients were spending too much time checking their Facebook accounts, or if they have sufficient network bandwidth to handle video conferencing, or why certain business apps were slowing down recently, it was an effort. Today’s retail business is more online and uses more connected applications, and that means finding a better firewall and knowing how to use it. And if you can develop this particular practice, you can become a trusted advisor and add value to your consulting services that you offer your clients.

The firewalls of yesteryear were relatively simple devices: you specified a series of firewall rules that listed particular ports and protocols, and whether you wanted to block or allow network traffic through them. That worked fine when applications were well behaved and used predictable ports, such as file transfer on ports 20 and 21 and email on ports 25 and 110. Those days seem like a fond memory now. With the rise of Web-based applications, ports and protocols don’t work any longer. Everyone is running their apps across ports 80 and 443, and it is hard to distinguish between apps that are mission-critical and someone who is running a rogue peer-to-peer file service that needs to be shut down.

The newer firewalls from Cisco, Intel/McAfee and Palo Alto Networks can gather deeper insights because they are applications-aware. They understand the way applications interact with the network and the Internet, and can report back to you in near real time with easy to view graphical representations of your network traffic.

Here is an example from Cisco’s ASA CX firewall configuration screen. You can see that there is a lot of granularity when it comes to monitoring and controlling how your users interact with Facebook, just one of thousands of applications that it can handle.

Palo Alto Networks has its “applipedia” reference of more than 1500 applications behaviors catalogued. You can look up whether the app is prone to misuse, can evade standard firewall ports, and is employed by malware.

 Another aspect of advanced firewalls is being able to look at changes to the network and see what were the root causes, or time-series effects as your traffic patterns differ from when things were working yesterday and are broken today. Finally, you want to drill down to particular users, or particular aspects of an application, such as allowing all users to read their Facebook wall posts but not necessarily send out any Facebook messages during working hours. (Not to keep picking on them, but they are a nice illustration.)

The goal is to quickly learn about your client’s traffic patterns and translate them into implemented and useful policies. Most of the newer firewall products offer this ability, but you will want to check out how easy it is to create and modify a policy from the automated start-up wizards that they provide. In some cases, you will need to use command-line parameters to fine-tune the policies that are created by the wizards.

Another good place to start is to read up on these products from OWASP here. This is a consortium of vendors and leading Web security developers who have tried to put down in one place what you need to know to build the best possible Web applications and protect them from harm. They have a comprehensive vendor list, a collection of best practices, sample “top-ten” attacks that you can use to harden your own applications and an evaluation guide.

Finally, when you are ready to spec out a unit for your client, look closely at how much inbound and outbound capacity you need. Firewall vendors offer different-sized models to match your bandwidth and throughput requirements. What will these firewalls cost? Most of them start somewhere north of $20,000. While this seems steep, given the consequences of an exploit raging through your client’s network, it could be money well spent.