1 Hitachi ID Suite. 2 Agenda. Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications

Transcription

1 1 Hitachi ID Suite Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications Administration and governance of Identities, entitlements and credentials. 2 Agenda Introductions. Hitachi ID corporate overview. Hitachi ID Suite overview. Why identity management? The Hitachi ID solution Hitachi ID identity management technology Competitive advantage 2019 Hitachi ID Systems, Inc. All rights reserved. 1

2 3 Hitachi ID corporate overview Hitachi ID delivers access governance and identity administration solutions to organizations globally. Hitachi ID IAM solutions are used by Fortune 500 companies to secure access to systems in the enterprise and in the cloud. Founded as M-Tech in A division of Hitachi, Ltd. since Over 1200 customers. More than 14M+ licensed users. Offices in North America, Europe and APAC. Global partner network Hitachi ID Systems, Inc. All rights reserved. 2

3 4 Representative customers 2019 Hitachi ID Systems, Inc. All rights reserved. 3

4 5 Integration with other IAM products Automation Password Manager E/SSO CORE INFRASTRUCTURE Self-service requests Authorization workflow Consolidated reporting Auto-discovery Reliable updates Target connectors Help desk integrations Login Manager Phone PW Manager Privileged Access Manager Identity Manager Group Manager Access Certifier WebSSO/WebAM Directory Meta Directory Virtual Directory System of Record Database replication Org Manager 6 Why IAM? Managing user identity information separately on multiple systems creates business problems: Access termination across multiple systems is both slow and unreliable. As a result, terminated employees and contractors retain access. Users accumulate excess entitlements, violating SoD policies and regulations such as SOX and HIPAA. Users lose productivity waiting for needed entitlements. Administrative changes spanning systems are redundant and expensive. Forgotten passwords create costly help desk call volume. Weak audit trails lack of accountability, failed audits Hitachi ID Systems, Inc. All rights reserved. 4

5 7 Shared IAM infrastructure Managing users separately on each system is too hard. Simplify: manage users and groups with a shared, global infrastructure. Continue to map groups to privileges inside each system. 8 Defining enterprise IAM Enterprise Identity and Access Management (IAM) is process and technology to manage identities, entitlements and credentials for modest numbers of users (<1,000,000). Password Management User Provisioning Virtual, Meta Directories Many integrations (5 to 5,000) No single system of record. Pre-existing users, dirty data. ID mapping across systems. Access Reporting 2019 Hitachi ID Systems, Inc. All rights reserved. 5

6 9 Hitachi ID Suite in the user lifecycle Lifecycle stage Onboarding Automation Self-service / request workflow From HR (employees). Web UI (contractors). Policy enforcement Role-based setup. Standardized IDs, OU, mail store, etc. Management Identity synchronization. Automatic role changes. Applications. Group membership. Profile updates. Privileged access SoD enforcement. Authorize changes. ID mapping. Support Password reset. Resolve access denied errors. Password strength. Password expiry. Deactivation Autotermination. Access certification. Scheduled terminations. Archive mailboxes, home dirs, etc Hitachi ID Systems, Inc. All rights reserved. 6

7 10 HiPM features Password synch: Reduce the number of passwords per user. Self-service: Password change, reset and unlock. Token or smart card PIN reset. Unlock encrypted drive with forgotten pre-boot password. Value-add: 2FA built-in for all users, including via mobile app. Federated access replace other apps login screens. Password vault users can store unmanaged passwords. Access from: PC browser or login screen. At the office or off-site. Smart phone app or self-service phone call. Assisted service: Password, token PIN, intruder lockout. Policy enforcement: Two-factor authentication for all users. Password complexity, expiry, history. Non-password authentication. Managed enrollment: Security questions. Login IDs. Mobile phone numbers Hitachi ID Systems, Inc. All rights reserved. 7

8 11 HiIM features Automation: Monitor one or more systems of record (SoR). Generate requests to grant, revoke access. Integrations: 120+ bidirectional connectors, included. Manage resources including mail boxes, home directories and badges. Incident management, SIEM, , 2FA. Manage building access, physical assets. Request portal: Users can request for themselves or others. Access control model limits visibility, requestability. Accounts and groups: Create, manage and delete accounts & groups across systems. Update attributes and assign/revoke group memberships. Workflow: Invite authorizers, implementers, certifiers to act. Built-in reminders, escalation, delegation and more. Selects participants via policy, not flow-charts. Policies, controls: RBAC, SoD. Risk scores, analytics. Approvals, recertification. Certification: Initiated by the system (event, schedule). Stake-holders review identities, entitlements. Generates deprovisioning requests Hitachi ID Systems, Inc. All rights reserved. 8

9 12 HiGM features Hitachi ID Group Manager enables self-service administration of groups and access to resources like shares and folders: Group lifecycle: Create new groups and manage existing ones. Navigate: Intercept "Access Denied" error messages and help users navigate to requests for an appropriate group. Request: Group create, modify and delete. Changes to metadata such as ownership and description. Add/remove members. Authorize: Changes by a workflow request is created dynamically and sent to the group s owner plus anyone else specified by policy. Provision: Upon approval, create/modify a group or add/revoke members Hitachi ID Systems, Inc. All rights reserved. 9

10 13 HiAC features Hitachi ID Access Certifier automates periodic review and cleanup of user entitlements: Capture: Auto-discovery creates a clear picture of the actual state of user entitlements across the enterprise. Leverage org-chart: Management relationships can be used to structure a certification round. Allows delegation of access review, cleanup and certification to managers. Notify: Automated reminders to managers, app owners and other stake-holders. Certify: Entitlements are either certified or flagged for removal. Sign off: Stake-holders must sign off on completed reviews. Action: Upon approval (if required), the offending entitlements are automatically removed and the user is brought back into compliance. Report: Full reports to satisfy audit requests are available Hitachi ID Systems, Inc. All rights reserved. 10

11 14 Cost savings Cost Item Before After Savings Help desk cost of password resets: 10,000 x 3 x $25 = $750,000 / year 10,000 x.6 x $13 = $78,000 / year = $672,000 / year New hire lost productivity 10,000 x 10% x 10 x $400 x 50% = $2M / year 10,000 x 10% x 1 x $400 x 50% = $200,000 / year = $1.8M / year Access change lost productivity 10,000 x 2 x 2 x $400 x 10% = $1.6M / year 10,000 x 2 x 1 x $400 x 10% = $800,000 / year = $800,000 / year 15 IAM strengthens security Reliable, prompt and complete access deactivation. Robust authentication prior to changes to credentials, access. Policy around: Audit: Password complexity / reuse / expiry. Non-password authentication. Access request approval routing. Segregation of duties. Access review/certification. Shared account password changes. New-user and per-role entitlements. Who has what? Access request/approval/grant history? Regulatory compliance: governance- and privacy-related rules Hitachi ID Systems, Inc. All rights reserved. 11

12 16 Scalability and fault-tolerance Multiple, load-balanced Hitachi ID Suite servers: Active/active architecture. Data replication between nodes: Built-in, easy to configure. WAN-friendly (high latency, low bandwidth, insecure channels). Reliable (multiple retry queues). Native code and SQL stored procedures run faster than Java and object persistence frameworks. Proxy servers resolve connection problems: Across firewalls. Over slow, insecure network routes. Large production deployments: 5M users. 130,000 managed systems. 12 load balanced IAM servers. 10,000 completed transactions/hour. 17 The Hitachi ID solution is flexible Customize: Integrate with: Enforce: Every aspect of the user interface Input validation Attribute mapping to target systems 120+ target system types Call tracking systems HR systems Authentication hardware Meta directories IVR servers Password policy Authentication rules Change authorization rules User naming standards 2019 Hitachi ID Systems, Inc. All rights reserved. 12

13 18 Rapid deployment and low TCO Optimized to minimize effort: Hitachi ID Identity Manager: Initial deployment: 2 4 months. Ongoing maintenance: FTE. Hitachi ID Password Manager: Initial deployment: 1 2 months. Ongoing maintenance: FTE. Using Hitachi ID Suite technology: Hitachi ID Identity Express typical use cases preconfigured. Built-in discovery, mapping of IDs, entitlements. Managed user enrollment (e.g., Q&A). Client software optional. Policy driven workflow, included. Implementer process for small apps. RBAC (can be costly) is optional. 120 connectors out of the box (more easy to add). 19 Active-active architecture Native password change Password synch trigger systems SaaS apps AD, Unix, z/os, LDAP, iseries Validate pw z/os - local agent Mobile UI Mobile proxy Manage Cloud IVR server TCP/IP + AES VPN server Various protocols Secure native protocol HTTPS Reverse web proxy system Load balancers MS SQL databases Notifications and invitations Ticketing system Hitachi ID servers Tickets HR Hitachi ID servers Replication System of record Firewalls Managed endpoints with remote agent: AD, SQL, SAP, Notes, etc Data center A Data center B Remote data center Proxy server (if needed) Managed endpoints 2019 Hitachi ID Systems, Inc. All rights reserved. 13

14 20 Included connectors Directories: Databases: Server OS X86/IA64: Server OS Unix: Server OS Mainframe: Active Directory and Azure AD; any LDAP; NIS/NIS+ and edirectory. Oracle; SAP ASE and HANA; SQL Server; DB2/UDB; Hyperion; Caché; MySQL; OLAP and ODBC. Windows: NT thru 2016; Linux and *BSD. Solaris, AIX and HP-UX. RAC/F, ACF/2 and TopSecret. Server OS Midrange: ERP, CRM and other apps: Messaging & collaboration: Smart cards and 2FA: Access managers / SSO: iseries (OS400); OpenVMS and HPE/Tandem NonStop. Oracle EBS; SAP ECC and R/3; JD Edwards; PeopleSoft; Salesforce.com; Concur; Business Objects and Epic. Microsoft Exchange, Lync and Office 365; Lotus Notes/Domino; Google Apps; Cisco WebEx, Call Manager and Unity. Any RADIUS service or SAML IdP; Duo Security; RSA SecurID; SafeWord; Vasco; ActivIdentity and Schlumberger. CA SiteMinder; IBM Security Access Manager; Oracle AM; RSA Access Manager and Imprivata OneSign. Help desk / ITSM: PC filesystem encryption: Server health monitoring: HR / HCM: Extensible / scriptable: ServiceNow; BMC Remedy, RemedyForce and Footprints; JIRA; HPE Service Manager; CA Service Desk; Axios Assyst; Ivanti HEAT; Symantec Altiris; Track-It!; MS SCS Manager and Cherwell. Microsoft BitLocker; McAfee; Symantec Endpoint Encryption and PGP; CheckPoint and Sophos SafeGuard. HP ilo, Dell DRAC and IBM RSA. WorkDay; PeopleSoft HR; SAP HCM and SuccessFactors. Hypervisors and IaaS: Mobile management: Network devices: Filesystems and content: SIEM: AWS; vsphere and ESXi. Management & inventory: Qualys; McAfee epo and MVM; Cisco ACS; ServiceNow ITAM; HP UCMDB; Hitachi HiTrack. BlackBerry Enterprise Server and MobileIron. Cisco IOS PIX and ASA; Juniper JunOS and ScreenOS; F5 BigIP; HP Procurve; Brocade Fabric OS and CheckPoint SecurePlatform. Windows/CIFS/DFS; SharePoint; Samba; Hitachi Content Platform and HCP Anywhere; Box.com and Twitter. CSV files; SCIM; SSH; Telnet/TN3270/TN5250; HTTP(S); SQL; LDAP; PowerShell and Python. Splunk; ArcSight; RSA Envision and QRadar. Any SIEM supporting SYSLOG or Windows events. 21 Integration with custom apps Hitachi ID Suite easily integrates with custom, vertical and hosted applications using flexible agents. Each flexible agent connects to a class of applications: API bindings (C, C++, Java, COM, ActiveX, MQ Series). Telnet / TN3270 / TN5250 / sessions with TLS or SSL. SSH sessions. HTTP(S) administrative interfaces. Web services. Win32 and Unix command-line administration programs. SQL scripts. Custom LDAP attributes. Integration takes a few hours to a few days. Fixed cost service available from Hitachi ID Hitachi ID Systems, Inc. All rights reserved. 14

15 22 IM technology advantages Unique features Group lifecycle management. Requester usability: intercept "Access Denied" errors, compare users, recommend entitlements. Rapid approvals, including from BYOD. Access rights based on relationships. Combine auto- and manual fulfillment. SoD engine actually works. Scalable platform Real-time data replication. Multi-master, active-active. Proxy server to cross firewalls. Native code + stored procedures. Rapid deployment Hitachi ID Identity Express accelerates deployment. Key features built-in: Request forms. Authorization workflow. Access certification. Customers actually automate processes, don t get stuck in "clean up" of legacy data. Integrations 120+ included connectors. Flexible/scriptable connectors. Incident management/ticketing. SIEM. 23 Hitachi ID Suite summary Three integrated IAM products, licensed to over 14M users, that can: Discover and connect identities across systems and applications. Securely and efficiently manage identities, groups, entitlements and credentials. Secure and monitor access to privileged accounts. Provide strong authentication and federated sign-on. Improve security to comply with regulations. Reduce IT support cost and improve user productivity. Consolidate management of on-premises and SaaS apps. 500, Street SE, Calgary AB Canada T2G 2J3 Tel: sales@hitachi-id.com hitachi-id.com Date: File: PRCS:pres