1 Hitachi ID Suite. 2 Agenda. Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications

Size: px

Start display at page:

Download "1 Hitachi ID Suite. 2 Agenda. Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications"

Felicia Ellis
5 years ago
Views:

1 Hitachi ID Suite Managing the User Lifecycle Across On-Premises and

entitlements and credentials. 2 Agenda Introductions.

1 1 Hitachi ID Suite Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications Administration and governance of Identities, entitlements and credentials. 2 Agenda Introductions. Hitachi ID corporate overview. Hitachi ID Suite overview. The user management lifecycle. Addressing identity management system deployment challenges. Advantages of the Hitachi ID solution Hitachi ID Systems, Inc. All rights reserved. 1

2 3 Hitachi ID corporate overview Hitachi ID delivers access governance and identity administration solutions to organizations globally. Hitachi ID IAM solutions are used by Fortune 500 companies to secure access to systems in the enterprise and in the cloud. Founded as M-Tech in A division of Hitachi, Ltd. since Over 1200 customers. More than 14M+ licensed users. Offices in North America, Europe and APAC. Global partner network Hitachi ID Systems, Inc. All rights reserved. 2

6 IAM challenges in the user lifecycle More IT more users to manage. There are challenges throughout the user lifecycle. Support cost. User service. Security.

Complete: deactivation of all IDs. Role changes: add/remove rights. Policies: enforced? Audit: are privileges appropriate? Org. relationships: track and maintain.

5 6 IAM challenges in the user lifecycle More IT more users to manage. There are challenges throughout the user lifecycle. Support cost. User service. Security. Slow: too much paper, too many people. Expensive: too many administrators doing redundant work. Reliable: notification of terminations. tions. Fast: response by sysadmins. Complete: deactivation of all IDs. Role changes: add/remove rights. Policies: enforced? Audit: are privileges appropriate? Org. relationships: track and maintain. Passwords: too many, too weak, often forgotten. Access: Why can t I access that application / folder / etc. 7 IAM in silos In most organizations, many processes affect many applications. This many-to-many relationship creates complexity: 2018 Hitachi ID Systems, Inc. All rights reserved. 5

8 Distributed IAM is complex Managing each system and

Complexity is bad: Expensive: redundant updates to every system

Unfriendly: users have lots of different IDs and passwords,

Insecure: mistakes are made and users get or retain excess

Every system and application added makes things worse.

Retire Resign Finish contract New application Retire application

Identity and Access Management System Operating systems

6 8 Distributed IAM is complex Managing each system and application separately is complex. Complexity is bad: Expensive: redundant updates to every system when hiring, moving or terminating users. Unfriendly: users have lots of different IDs and passwords, which they don t know how to manage. Insecure: mistakes are made and users get or retain excess entitlements. Orphan and dormant accounts. Stale privileges. Every system and application added makes things worse. 9 Integrated IAM processes Business processes IT processes Hire Retire Resign Finish contract New application Retire application Transfer Fire Start contract Password expiry Password reset Identity and Access Management System Operating systems Directory Application Database system ERP Legacy app Mainframe Systems and applications with users, passwords, groups, attributes 2018 Hitachi ID Systems, Inc. All rights reserved. 6

10 Hitachi ID Suite 11 Onboarding new users Hitachi ID Identity Manager can accelerate the

hires in HR and automatically create access on managed systems, such as AD, SAP and the

Self-service workflow: Managers can request and approve access electronically, for example

7 10 Hitachi ID Suite 11 Onboarding new users Hitachi ID Identity Manager can accelerate the onboarding process and reduce the security administration burden: Automation: Detect new hires in HR and automatically create access on managed systems, such as AD, SAP and the mainframe. Self-service workflow: Managers can request and approve access electronically, for example for contractors. Consolidated administration: Security administrators save time by using one tool to manage users across every system Hitachi ID Systems, Inc. All rights reserved. 7

12 Change management Hitachi ID Identity Manager manages changes to user profiles: Self-service updates to phone numbers, department codes, etc.

8 12 Change management Hitachi ID Identity Manager manages changes to user profiles: Self-service updates to phone numbers, department codes, etc. Identity Manager, Hitachi ID Group Manager and Hitachi ID Org Manager manage changes to user roles and responsibilities: Self-service requests for new entitlements. Distributed audit of user rights by managers and app owners. Distributed update of organizational relationships by managers Hitachi ID Systems, Inc. All rights reserved. 8

13 IT support Hitachi ID Password Manager for "I forgot/locked my password" calls: Synchronization: Users with fewer passwords have fewer problems.

9 13 IT support Hitachi ID Password Manager for "I forgot/locked my password" calls: Synchronization: Users with fewer passwords have fewer problems. Reset: Users can resolve their own problems without calling the help desk. Assistance: A help desk interface reduces the duration and cost of remaining calls. Hitachi ID Group Manager for "access denied" calls: Self-service: Users browse for resources and request access. Authorization workflow: Group owners are asked to review and approve change requests Hitachi ID Systems, Inc. All rights reserved. 9

14 Deactivating access Retirement, resignation, end-of-contract: Hitachi ID Identity Manager detects changes in systems of record, such as HR, and deactivates all access.

10 14 Deactivating access Retirement, resignation, end-of-contract: Hitachi ID Identity Manager detects changes in systems of record, such as HR, and deactivates all access. Managers can schedule deactivation with a workflow form. Dismissals: Security administrators use an Identity Manager form to terminate all of a user s accounts immediately. Asset retrieval Identity Manager inventory tracking assists in retrieval of PCs, cell phones, building access badges, etc Hitachi ID Systems, Inc. All rights reserved. 10

11 Slide Presentation 15 Closed loop IAM Integrated Systems of Record List people Manual request Invitations Approve, reject, delegate Detected changes Automatic request List accounts Updates - Validate requests - Route for approval - Invite authorizers - Send reminders - Escalate - Delegate Autofulfillment Manual fulfillment Updates Create, delete, update accounts Integrated Target Systems Non-integrated Systems Create, delete, update accounts Invitations Invitations Review, certify, correct Accept, confirm 2018 Hitachi ID Systems, Inc. All rights reserved. 11

12 16 Active-active architecture Native password change Password synch trigger systems SaaS apps AD, Unix, z/os, LDAP, iseries Validate pw z/os - local agent Mobile UI Mobile proxy Manage Cloud IVR server TCP/IP + AES VPN server Various protocols Secure native protocol HTTPS Reverse web proxy system Load balancers MS SQL databases Notifications and invitations Ticketing system Hitachi ID servers Tickets HR Hitachi ID servers Replication System of record Firewalls Managed endpoints with remote agent: AD, SQL, SAP, Notes, etc Data center A Data center B Remote data center Proxy server (if needed) Managed endpoints 2018 Hitachi ID Systems, Inc. All rights reserved. 12

13 17 Included connectors Directories: Databases: Server OS X86/IA64: Server OS Unix: Server OS Mainframe: Active Directory and Azure AD; any LDAP; NIS/NIS+ and edirectory. Oracle; SAP ASE and HANA; SQL Server; DB2/UDB; Hyperion; Caché; MySQL; OLAP and ODBC. Windows: NT thru 2016; Linux and *BSD. Solaris, AIX and HP-UX. RAC/F, ACF/2 and TopSecret. Server OS Midrange: ERP, CRM and other apps: Messaging & collaboration: Smart cards and 2FA: Access managers / SSO: iseries (OS400); OpenVMS and HPE/Tandem NonStop. Oracle EBS; SAP ECC and R/3; JD Edwards; PeopleSoft; Salesforce.com; Concur; Business Objects and Epic. Microsoft Exchange, Lync and Office 365; Lotus Notes/Domino; Google Apps; Cisco WebEx, Call Manager and Unity. Any RADIUS service or SAML IdP; Duo Security; RSA SecurID; SafeWord; Vasco; ActivIdentity and Schlumberger. CA SiteMinder; IBM Security Access Manager; Oracle AM; RSA Access Manager and Imprivata OneSign. Help desk / ITSM: PC filesystem encryption: Server health monitoring: HR / HCM: Extensible / scriptable: ServiceNow; BMC Remedy, RemedyForce and Footprints; JIRA; HPE Service Manager; CA Service Desk; Axios Assyst; Ivanti HEAT; Symantec Altiris; Track-It!; MS SCS Manager and Cherwell. Microsoft BitLocker; McAfee; Symantec Endpoint Encryption and PGP; CheckPoint and Sophos SafeGuard. HP ilo, Dell DRAC and IBM RSA. WorkDay; PeopleSoft HR; SAP HCM and SuccessFactors. Hypervisors and IaaS: Mobile management: Network devices: Filesystems and content: SIEM: AWS; vsphere and ESXi. Management & inventory: Qualys; McAfee epo and MVM; Cisco ACS; ServiceNow ITAM; HP UCMDB; Hitachi HiTrack. BlackBerry Enterprise Server and MobileIron. Cisco IOS PIX and ASA; Juniper JunOS and ScreenOS; F5 BigIP; HP Procurve; Brocade Fabric OS and CheckPoint SecurePlatform. Windows/CIFS/DFS; SharePoint; Samba; Hitachi Content Platform and HCP Anywhere; Box.com and Twitter. CSV files; SCIM; SSH; Telnet/TN3270/TN5250; HTTP(S); SQL; LDAP; PowerShell and Python. Splunk; ArcSight; RSA Envision and QRadar. Any SIEM supporting SYSLOG or Windows events. 18 Integration with custom apps Hitachi ID Suite easily integrates with custom, vertical and hosted applications using flexible agents. Each flexible agent connects to a class of applications: API bindings (C, C++, Java, COM, ActiveX, MQ Series). Telnet / TN3270 / TN5250 / sessions with TLS or SSL. SSH sessions. HTTP(S) administrative interfaces. Web services. Win32 and Unix command-line administration programs. SQL scripts. Custom LDAP attributes. Integration takes a few hours to a few days. Fixed cost service available from Hitachi ID Hitachi ID Systems, Inc. All rights reserved. 13

14 19 IAM project risk management IAM projects often take too long and cost too much. Why? Data quality: Risk management Combine automation and self-service for clean up. Nonstandard, disconnected IDs Incorrect, old identity data. Never-ending role engineering: Start deployment with just a few roles. Add roles gradually, based on demand. Role based access control is a good objective, but... It can be slow and costly to develop and maintain roles. Some users just don t fit. Too many workflows: Defining too many forms, processes takes too long. One form, one process per change type? Per system? Implement a generic change management system. Custom forms for just the most popular requests. 20 Hitachi ID technology advantages Industry-leading technology at the lowest TCO: More features and functionality for less money: Lower initial and ongoing investment (License scheme) Lower on-going administration costs Technology (not services) drives down deployment costs: Reference implementations. All features, connectors included. Auto-discovery of systems, accounts, entitlements. Automated and self-service ID mapping. Policy-driven workflow easier to manage. No need to engage in costly role engineering Hitachi ID Systems, Inc. All rights reserved. 14

15 21 Hitachi ID Suite summary Three integrated IAM products, licensed to over 14M users, that can: Discover and connect identities across systems and applications. Securely and efficiently manage identities, groups, entitlements and credentials. Secure and monitor access to privileged accounts. Provide strong authentication and federated sign-on. Improve security to comply with regulations. Reduce IT support cost and improve user productivity. Consolidate management of on-premises and SaaS apps. 500, Street SE, Calgary AB Canada T2G 2J3 Tel: hitachi-id.com Date: File: PRCS:pres

1 Hitachi ID Privileged Access Manager. 2 Agenda. Temporary, secure and accountable privilege elevation.

1 Hitachi ID Privileged Access Manager Temporary, secure and accountable privilege elevation. 2 Agenda Hitachi ID corporate overview. Hitachi ID Suite overview. Securing administrative passwords with Hitachi