How does identity monitoring fit into an overall core security program. Is it necessary?

Identity monitoring combines the user- and role-management capabilities of an identity management system with the activity monitoring and correlation capabilities of a SIEM or similar technology. Ideally, you gain the ability to understand who is on your network, what information they are seeing, what they are doing with that information, and whether that is allowed. At an advanced level, an identity monitoring solution includes activity profiling, to better understand the types of user activity to watch.

From a security perspective, identity monitoring is a big win. You can't arrest an IP address, so securing the network requires a user-focused picture. By piecing together a user's activity, a security department can find problems early, even if they are subtle.

However, identity monitoring is also useful from a compliance perspective. Many regulations require that controls be in place for access to sensitive information, whether it is internal financial data (e.g., SOX), or customer data (e.g., PCI DSS). Identity monitoring can help demonstrate that these controls are in place and functioning effectively.

Activity profiling helps in both cases by sifting through historical activity to create specific user profiles. For example, a profiling engine might look at all the activity of the last 50 people to quit an organization to determine which patterns might identify these folks. For example, does their web surfing rise, do they start using external webmail more often, do they stay late and print documents, save files to USB keys more frequently, and so on? Once you have these profiles, you can then apply rules to track such activities in the future, either to keep an employee from leaving or to make sure that an employee doesn't take confidential information with him on the way out.

This type of profiling seems a bit ominous, but many organizations are using or considering it today. On the other hand, the same analysis can also be used for business optimization. For example, a firm might build a profile of its best employees and use this to coach others. Or it might use activity correlation and tracking to create de facto business process models it can use to improve efficiency.