IBM to Acquire Consul Risk Management Solution

IBM this week announced an agreement to acquire Consul Risk Management, a provider of identity access monitoring software that works across mainframe and distributed environments. When the acquisition closes sometime during Q1 2007, the software will be part of IBM’s Tivoli software unit, complementing other access and control management offerings.

Responding to Audit Requests

IBM acquired this technology partly in response to CIO complaints of spending a great deal of IT resources complying with government regulations, such asSarbanes-Oxley and other privacy initiatives.

These regulations, among other tasks, require detailed disclosure about access privileges. “CIOs are spending a huge amount of time responding to these audit requests,” Steven Adler, program director for IBM Data Governance Solutions, told the E-Commerce Times. Consul automates many of these activities, he added.

The software provides business compliance processes for potential breaches, automatically providing alerts when data is accessed inappropriately. Breaches, according to some surveys, can be perpetuated by privileged and technical users, such as IT administrators, vendors and consultants.

Examples include, say, a technology company that spots an unauthorized person accessing a system that contains future product design concepts, or an online retailer that is notified when an unusually high number of customer records have been opened.

The product uses “W7” methodology — who did what, when, where, where from, where to and on what — to analyze such activity via nativesecuritylogs, Consul explained.

“With today’s high volume of compliance activity, auditors typically want to know that organizations have control of privileged user activities,” said Joe Sander, CEO of Consul. “Beyond knowing who has the right to access specific data, companies need to ensure that only appropriate individuals are doing so without hindering business productivity.”

An Integrated Offering

Consul also allows firms to integrate the datainfrastructure environment with other identity access controls, Adler said.

The ideal scenario is a system that provisions users to different accounts, synchronizes the policy for such provisioning, and then audits the policy. Management receives one set of reports to ensure that compliance is in order.

Related security functions in IBM’s Service Management initiative and related product line includes the Tivoli Access Manager and its Security Operations Manager — an audit log, aggregation andanalysis tool that IBM acquired from Micromuse in February.

Consul’s more than 350 customers includes Ford, Kroger,Office Depot, Hanes and Fidelity Bank.