1 Hitachi ID Suite. 2 Overview. 3 Hitachi ID Direction. Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications

Size: px

Start display at page:

Download "1 Hitachi ID Suite. 2 Overview. 3 Hitachi ID Direction. Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications"

Prosper Allison
6 years ago
Views:

1 Hitachi ID Suite Managing the User Lifecycle Across On-Premises and

2 Overview Corporate direction Hitachi ID view of market evolution.

0 for customers on older versions. Hitachi ID Suite 10.

1 1 Hitachi ID Suite Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications Hitachi ID Suite 10.0 Features and Technology. 2 Overview Corporate direction Hitachi ID view of market evolution. Hitachi ID Suite 9.0 was a major release. Review of 9.0 for customers on older versions. Hitachi ID Suite 10.0 was released on May 2, 2016: Largest release yet. Overview of enhancements. 3 Hitachi ID Direction 2018 Hitachi ID Systems, Inc. All rights reserved. 1

2 3.1 IAM responds to IT trends IAM systems consolidate and automate the management of the lifecycles of identities, entitlements and credentials. How do IT trends impact this? Mobility Cloud Big data Access to IAM from BYOD. Leverage BYOD to offer new services, improve SLA and as 2FA. Manage identities, entitlements credentials on SaaS platforms. Privileged access to IaaS and SaaS. SSO to SaaS. Deliver IAM as SaaS. Entitlement analytics role mining, risk scores. Enrich log data with identity correlation. Pattern and risk analysis of filesystem ACLs. Security and governance are the core outcome of IM, PM and PAM. 3.2 High level roadmap (all products) Three industry-leading products. Significant new features and integrations: Hitachi ID Identity Manager Hitachi ID Password Manager Hitachi ID Privileged Access Manager Hitachi ID Mobile Access Entitlement analytics. Expanded access certification. Lifecycle management for folders, shares. Filesystem ACL analytics. Federated SSO (SAMLv2 IdP). Password wallet (secure, personal storage). Access dashboard. Incremental auto-discovery. Launch sessions from BYOD, off-site, non-ie browsers. Dynamic risk scoring. 2FA for all apps. Push notifications to mobile. One-click request approval. Corporate white pages / people search. 4 Hitachi ID Suite Hitachi ID Systems, Inc. All rights reserved. 2

3 4.1 Enhancements in 9.0 General HiPAM HiIM Move platform to 64-bit. Stronger default crypto (AES-256, SHA-512). Support new MSSQL, Oracle back ends. Mobile: skin, ios and Android apps. Usability improvements: JS in UI, clickable objects, sortable report output,... Analytics: report output request input. Many new reports, some with graphical dashboards. Account-set check-out. Run commands across managed systems. LWS improved scalability. Hitachi ID Identity Express - Privileged Access. Certification via arbitrary relationships. Hierarchical attributes. Usability improvements to PDRs. Photo upload. VCARD links on user profiles. Deployability: componentize reference implementations. 5 Hitachi ID Suite Enhancements in 10.0 General HiPAM HiIM, HiPM Single-system, event-driven auto-discovery. Suite can act as a federated IdP. Mobile app adds 2FA. Push notifications to mobile. Updated 95 search engines across 200+ screens. Landing page customizable ("pin" links, dashboards, reports). Search in nav (menu entries, reports). Drill-down in graphs/dashboards. New dashboard (requests, checkouts). New SSO mechanisms: HTML5 session proxy, non-activex clients. Simplified config for Windows service account password management. Strong auth in emergencies. New reference implementation to significantly reduce TCO. Schema overhaul - performance enhancements. Recertify role definitions, SoD rules. Direct support for managing nested groups. Manage cross-target group memberships. Improved UI in requester, certifier screens. Workflow to create folders+groups on Windows/AD. Personal password vaults. Updated reference implementation to significantly reduce TCO Hitachi ID Systems, Inc. All rights reserved. 3

4 Updated search screens There are 95 search engines embedded in over 200 pages in Hitachi ID Suite. All of them have been updated.

4 5.2 Updated navigation New style of navigation. 100% mobile friendly. Search lets you quickly find items regardless of where they are buried in the navigational hierarchy. 5.3 New navigation structure 5.4 Updated search screens There are 95 search engines embedded in over 200 pages in Hitachi ID Suite. All of them have been updated. Many of them are faster. All have new search terms. Control over what columns to display, sort order. Quick search and boolean advanced search terms Hitachi ID Systems, Inc. All rights reserved. 4

5.5 PIN items to landing page Hitachi ID Suite displays a landing page when a user signs on. New ability to PIN items to this page: Shortcuts to screens deeply nested in the navigation.

5 5.5 PIN items to landing page Hitachi ID Suite displays a landing page when a user signs on. New ability to PIN items to this page: Shortcuts to screens deeply nested in the navigation. Dashboards (graphs) and reports (tables). Request types and privileged access check-outs. Personalize the UI. 5.6 Pin reports, dashboards, requests to main menu 2018 Hitachi ID Systems, Inc. All rights reserved. 5

5.7 Component framework and reference implementations A component framework eliminates the need to manually configure every element of a feature or scenario: Simplify implementation.

6 5.7 Component framework and reference implementations A component framework eliminates the need to manually configure every element of a feature or scenario: Simplify implementation. Eliminate custom coding. Ease migration (dev to prod,...) and upgrades. Components consist of: Configuration objects, such as attributes, forms, roles or access rights. UI elements, including language tags. Policy logic, such as authorizer selection. Scripts, for example to process scheduled events. Components have dependencies and a hierarchy: Functional components: introduce policy tables. Scenarios: automate specific business cases. Reference implementations: complete IAM implementations. There are fully featured corporate and B2B reference implementations. A new UI in 10.0 is used to manage installed components. 5.8 Component management app 2018 Hitachi ID Systems, Inc. All rights reserved. 6

6 New in HiIM 10.0 6.1 New app for request tracking and approvals There is an entirely new UI for accessing requests. Used by: Requesters track status, cancel open requests.

7 6 New in HiIM New app for request tracking and approvals There is an entirely new UI for accessing requests. Used by: Requesters track status, cancel open requests. Authorizers approve, reject, delegate. Implementers accept, decline, complete. Responsive design, optimized for mobile. Accessible 24x7 via smart phone app and cloud proxy. 6.2 New requests app 6.3 Recertify roles, SoD policies New type of certification round: configuration object. Initially to support roles, SoD rules. Invite a business user to review, possibly update the definition of a role: What entitlements does it include? What are its resource attributes, such as default expiration date or risk profile? Who owns it? To whom is it automatically assigned? Who must approve requests for it? Same type of review for other configuration objects. Track change history Hitachi ID Systems, Inc. All rights reserved. 7

6.8 Manage nested groups Nested groups are no longer "flattened" on auto-discovery. Hitachi ID tracks detailed group nesting structure in its schema.

10 6.8 Manage nested groups Nested groups are no longer "flattened" on auto-discovery. Hitachi ID tracks detailed group nesting structure in its schema. Requesters can start by asking for one group but then specify a parent or child. Certifiers can see parent groups and detach child groups. Policies evaluate both direct and indirect group memberships. Over 100 scenarios impacted by nested groups. 6.9 Discovered groups have parent and child info 2018 Hitachi ID Systems, Inc. All rights reserved. 10

6.12 SoD violations include nested groups 6.13 New requests to create folders and groups Users wish to create a new folder and grant access to others.

12 6.12 SoD violations include nested groups 6.13 New requests to create folders and groups Users wish to create a new folder and grant access to others. A single request can capture this and encapsulate: Folder path. Meta data such as description, owner, etc. List of people with read-only access. List of people with read-write access. Single approval follows by multiple setup steps Hitachi ID Systems, Inc. All rights reserved. 12

14 6.16 Entitlement analytics Analysis Cluster/frequency analysis. Overlapping roles, user classes. Roles, entitlements with too few users. Roles, entitlements with too many users. Users with too many roles or entitlements. Users with too few entitlements. Entitlements embedded in many roles. Entitlements not in any role. Users with no roles. Roles where users have many out-of-role entitlements. Purpose Find new roles, user classes. Opportunities to merge, simplify. Retire? Too coarse grained? Business risk? Compatibility problems? Need higher-level roles? Deactivate entirely? Nest into sub-role? Should they be? Truly unique? Incomplete role definitions? Poor fit? 6.17 Entitlement cluster discovery: search 2018 Hitachi ID Systems, Inc. All rights reserved. 14

7.1 SAMLv2 Federated IdP Externalize login process from third party web apps. Cloud: Google Apps, Office 365, Salesforce.com, WebEx, Concur, etc. On-premise: SharePoint (via ADFS), HCP Anywhere, etc.

16 7.1 SAMLv2 Federated IdP Externalize login process from third party web apps. Cloud: Google Apps, Office 365, Salesforce.com, WebEx, Concur, etc. On-premise: SharePoint (via ADFS), HCP Anywhere, etc. Basically respond to SAMLv2 requests with assertions. Leverage user classes for authorization control, authentication chains for 2FA/MFA. 7.2 Hitachi ID Mobile Access authentication factor Leverage Hitachi ID Mobile Access on user phones as a soft token. Zero extra cost: organizations have no excuse to revert to just Q&A or just a password on Extranet logins. More secure password reset. 2FA for all Hitachi ID Privileged Access Manager logins, even if the network is down, AD or RADIUS unreachable Hitachi ID Systems, Inc. All rights reserved. 16

The user s employer should not be able to access/decrypt this data this is just a friendly service offered by IT, but not a compromise of PII.

17 7.3 Personal vaults Users want secure, convenient access to all their credentials, not just those related to work. Access should work on all devices (PC, phone, etc.). The user s employer should not be able to access/decrypt this data this is just a friendly service offered by IT, but not a compromise of PII. Similar to FastPass, LastPass, LogMeIn, etc. but no extra cost for employees Built into Hitachi ID Password Manager starting with Personal password vault (setup) 7.5 Personal password vault (use) 2018 Hitachi ID Systems, Inc. All rights reserved. 17

8 New in HiPAM 10.0 8.1 New ways to launch privileged sessions Method Details When to use 8.x+: ActiveX Launch RDP or command-line tools. Connection from user s PC to managed endpoint.

19 8 New in HiPAM New ways to launch privileged sessions Method Details When to use 8.x+: ActiveX Launch RDP or command-line tools. Connection from user s PC to managed endpoint. Fast, efficient, flexible. On-premise or remote user with VPN. Windows/IE client. Most likely employee or contractor with corporate PC. 10.x: HTML5 Proxy 10.x: Non-IE Browsers Proxy SSH, RDP through Linux/Tomcat server. UI renders as pure HTML5. Same as IE/ActiveX but for FF, Chrome, Opera. Launch any admin UI. Direct connect to target. Works with any modern browser. Best for vendor access, sign-on to isolated network segments. Works with any modern browser on Windows. For users who prefer to avoid IE. 8.2 Direct login session from IE/ActiveX 2018 Hitachi ID Systems, Inc. All rights reserved. 19

time. Set different discovery schedules per endpoint or category.

21 8.5 SSH or RDP session via HTML5 proxy 8.6 Event-driven, incremental discovery Pull account, entitlement data from one system at a time. Set different discovery schedules per endpoint or category. Event-triggered discovery from endpoints (e.g., newly onboarded). Significantly more scalable and manageable Hitachi ID Systems, Inc. All rights reserved. 21

8.7 Privileged request/session dashboard 2018

8.8 Session search/playback dashboard 8.9 Expanded PAM reference implementation Risk analysis at check-out time: Has this user checked out this account before?

23 8.8 Session search/playback dashboard 8.9 Expanded PAM reference implementation Risk analysis at check-out time: Has this user checked out this account before?... or at least something on the same system?... or perhaps on the same platform?... what about other users that resemble this user? Is it 3AM where the user lives? Is the user connecting from a new IP address or device type? Risk scores inform authorization and session capture decisions: Weird session ask for extra approvals. High risk capture video, keylog, etc. Odd time light up the user s webcam. Lots of other new policy engines: filters for managed system/ account search results, session parameters and more Hitachi ID Systems, Inc. All rights reserved. 23

24 9 Discussion 500, Street SE, Calgary AB Canada T2G 2J3 Tel: Fax: hitachi-id.com Date: File: PRCS:pres

1 Hitachi ID Privileged Access Manager. 2 Overview. 3 HiPAM 9.0. Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications

1 Hitachi ID Privileged Access Manager Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications Privileged Access Manager 10.0 Features and Technology. 2 Overview Hitachi ID Suite 9.0