What’s New in ActiveRoles Server 6.7

• The ActiveRoles Market -Improvements to policy extensions and workflow extensibility allow for more efficient tools for creating and deploying custom policy types that will be posted to the ActiveRoles Market
• Improved Import/Export -For some time, ActiveRoles has come with a tool to import and export configuration settings and this tool has been improved and will continue to evolve from importing and exporting roles and policies to much more. The next version will provide the ability to import and export entire new solution scenarios including scripts, policies, workflow activities and web interface customizations.
• Entitlement Profile – All-in-one view of each user’s entitlements to IT resources, which provides detailed
  information about the applications, services and data locations the user is entitled to access, use or manage
• Microsoft Outlook Approve/Reject buttons – Approval management tools integrated in Microsoft Office Outlook
• Reply to approve a request – Approval management using e-mail clients directly from desktop or mobile devices
• Workflow activity extensions – facilitates the creation, deployment and use of custom script-based activities
• Simplified Self-Service UI – Improvements to self-service pages, to make it easier for self-service users to locate, select
  and join groups and distribution lists
• Simplified Workflow Notifications - Improvments to make approval notifications easier to both read and action.
• New granular workflow triggers for Group Membership Requests – New workflow start options to distinguish between the “add to group” and “remove from group” requests
• Improved Workflow GUI Editor – New workflow options for configuring approval rules, notification recipients and notification messages
• See all parts of AD, not just the parts you own – Unmanaged account domains to reduce ActiveRoles Server licensing costs for areas of Active Directory not being managed by ActiveRoles Server
• MMC Tabs for OCS – Ability to configure domain user accounts for Microsoft Office Communications Server 2007 or 2007 R2, by using the ActiveRoles Server console
• Attestation for all AD Objects- Extended attestation capabilities, including the ability to review and certify almost any aspect of directory data, including data specific to user log-on accounts, service log-on accounts, group memberships, computers, contacts, and other types of directory objects.

 To download this new version please go to: http://www.quest.com/common/registration.aspx?requestdefid=7910 

• Access Accountability
• Authorizing groups today using roles and attribute access control (ABAC) to resources
• Authorizing groups in the future with emerging technologies
• Moving from Group Management to Access Governance and the keys to success

Presented by:
Robert Bobel, Platform Director of Product Management, Quest Software
Jason Barnett, Partner and Information Security Practice Manager, Ingenuity Associates,

View Archived Webcast

What is our secret? Simple, customer driven development, strong expertise and a team that is passionate about their work.

 http://windowsitpro.com/Windows/Articles/ArticleID/103318/pg/4/4.html

(Note to self, never set an RTM for Friday the 13th.)

Dimitry asked me how if we did provide approve/reject in Outlook workflow how would we prevent mailbox delegates clicking approve or reject before the mailbox owner saw the request – I had absolutely no answer. Because the activities of a delegate are not tracked, there is really no way to know what a delegated user is doing in the mailbox and so you would not know either what messages have been read or what approvals would have been processed. My fears about approving/rejecting requests had always been more around Spoofing, this conversation gives me even more concerns. Unless our brilliant developers could find some way around the way Outlook/Exchange work – I doubt this feature would ever make it through a compliance audit.

You would think this would have been obvious from the start, but after reading the actual compliance equipments themselves it is easy to see why this causes so many people trouble. For example, the Sarbanes-Oxley Act of 2002 (SOX) was created to protect shareholders of public companies from financial miss-doings that could impact their investment. I will spare you the joy of reading section 404 of the SOX requirements which deals with the IT aspect of compliance and simply tell you, you would be underwhelmed by the lack of detail and direction it contains.

 What is clearly spelled out in SOX is that the owner of an application or data should be responsible for controlling access to that owner’s resource and further there needs to be a set of controls to make sure this happens. The reasoning is simple, the application or data owner is in the best position to know and understand the business justifications for granting access to their resource. SOX doesn’t recommend what type of controls are needed only that they must exist.  

The lack of detail around IT controls – leaves everything open to interpretation as to what is required on the part of IT to comply with the regulation. Because experience and competence varies by auditor and IT team, recommendations can be anything from a paper-based procedures to implementing a new compliance layer of audit software or worse. The directory owners I see who are able to achieve sustained compliance implement software based process controls. These software based controls should always automate and enforce governance be self-document and should support real-world demonstration that the controls are in place and effective. Once these controls are in place audit preparation time drops to hours rather than the weeks or months a first audit typically would require.

SharePoint Attestation: For customers who own ActiveRoles Server and ActiveRoles Self-Service manager, this new addition will allow you to extend access certification reviews (a.k.a. Attestation) to your SharePoint Site owners through the easy-to-use self-service interface. The goal of attestation it to have the owner of the site’s data periodically review the individuals that have been granted access. The owner of the data is the logical choice for this type of review because he/she is typically the person who understands the business reasons why a particular user was granted access the data. Period certification reviews also provide a great way to determine which groups in AD are being properly managed – meaning if a group owner fails to perform the review their group is added to a list of suspect groups. If you want to understand more about Attestation, see my recent posts http://www.bobbobel.com/what-is-attestation/.

SharePoint Access Remediation: (Warning-teaser) In the next major release of ActiveRoles Server we will include a new set of optional policies that can be used to what essentially amounts to the ability to disable a group that is granting security access. We also link this new capability to our Attestation Policy so that when the resource owner fails to perform a required attestation review within a given review timeframe access can be withheld in a non-destructive way. This is of course optional and the disablement of the group can be reversed with a single click so that if a group is super critical it can be brought back almost instantly.

In August we will provide a new component of Quick Connect for Base Systems named Quick Connect for Base Systems: SharePoint Integration.  This integration pack will install into the ActiveRoles Server console directly rather than appearing as a traditional connector in Quick Connect so as to simplify deployment.

SharePoint Provisioning: The primary purpose of the beta will be to provide automated provisioning and maybe more importantly automated Deprovisioning of user access to specific SharePoint sites. This is accomplished through the existing ActiveRoles Server provisioning and Deprovisioning policies so you control access in the exact same way you do other Microsoft applications even if you have not used followed Microsoft best practice by using AD groups to control SharePoint access.

(Part 2 http://www.bobbobel.com/provisioning-and-attestation-for-sharepoint-part-2/)