1 Hitachi ID Suite. 2 Agenda. 3 Corporate. Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications

Transcription

1 1 Hitachi ID Suite Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications Administration and governance of Identities, entitlements and credentials. 2 Agenda Corporate. IAM problems / Hitachi ID solutions. Technology. Privileged Access Example deployments. Discussion. 3 Corporate 2018 Hitachi ID Systems, Inc. All rights reserved. 1

2 3.1 Hitachi ID corporate overview Hitachi ID delivers access governance and identity administration solutions to organizations globally. Hitachi ID IAM solutions are used by Fortune 500 companies to secure access to systems in the enterprise and in the cloud. Founded as M-Tech in A division of Hitachi, Ltd. since Over 1200 customers. More than 14M+ licensed users. Offices in North America, Europe and APAC. Global partner network. 3.2 Representative customers 2018 Hitachi ID Systems, Inc. All rights reserved. 2

3 4 Managing credentials and entitlements 4.1 Hitachi ID Suite 2018 Hitachi ID Systems, Inc. All rights reserved. 3

4 4.2 HiIM features Accounts and groups: Create, manage and delete accounts & groups across systems. Update attributes and assign/revoke group memberships. Automation: Monitor one or more systems of record (SoR). Generate requests to grant, revoke access. Request portal: Users can request for themselves or others. Access control model limits visibility, requestability. Certification: Initiated by the system (event, schedule). Stake-holders review identities, entitlements. Generates deprovisioning requests. Workflow: Invite authorizers, implementers, certifiers to act. Built-in reminders, escalation, delegation and more. Selects participants via policy, not flow-charts. Policies, controls: RBAC, SoD. Risk scores, analytics. Approvals, recertification. Integrations: 120+ bidirectional connectors, included. Manage resources including mail boxes, home directories and badges. Incident management, SIEM, , 2FA. Manage building access, physical assets Hitachi ID Systems, Inc. All rights reserved. 4

5 4.3 HiPM features Password synch: Reduce the number of passwords per user. Self-service: Password change, reset and unlock. Token or smart card PIN reset. Unlock encrypted drive with forgotten pre-boot password. Value-add: 2FA built-in for all users, including via mobile app. Federated access replace other apps login screens. Password vault users can store unmanaged passwords. Access from: PC browser or login screen. At the office or off-site. Smart phone app or self-service phone call. Assisted service: Password, token PIN, intruder lockout. Policy enforcement: Two-factor authentication for all users. Password complexity, expiry, history. Non-password authentication. Managed enrollment: Security questions. Login IDs. Mobile phone numbers. 5 Technology 2018 Hitachi ID Systems, Inc. All rights reserved. 5

6 5.1 Active-active architecture Native password change Password synch trigger systems SaaS apps AD, Unix, z/os, LDAP, iseries Validate pw z/os - local agent Mobile UI Mobile proxy Manage Cloud IVR server TCP/IP + AES VPN server Various protocols Secure native protocol HTTPS Reverse web proxy system Load balancers MS SQL databases Notifications and invitations Ticketing system Hitachi ID servers Tickets HR Hitachi ID servers Replication System of record Firewalls Managed endpoints with remote agent: AD, SQL, SAP, Notes, etc Data center A Data center B Remote data center Proxy server (if needed) Managed endpoints 2018 Hitachi ID Systems, Inc. All rights reserved. 6

7 5.2 Key architectural features BYOD enabled On premises and SaaS SaaS apps Cloud Replicated across data centers Horizontal scaling Load balanced TCP/IP + AES Various protocols Secure native protocol Reach across firewalls Data center A Data center B Remote data center HTTPS 5.3 Multi-master replication Avoid data loss and service interruption: Multiple copies of the vault in different cities. Real-time data replication. Fault-tolerant. Bandwidth efficient, latency tolerant. Best practice: multiple servers in multiple data centers. Active/active Load balanced Hitachi ID Systems, Inc. All rights reserved. 7

8 5.4 Included connectors Directories: Databases: Server OS X86/IA64: Server OS Unix: Server OS Mainframe: Active Directory and Azure AD; any LDAP; NIS/NIS+ and edirectory. Oracle; SAP ASE and HANA; SQL Server; DB2/UDB; Hyperion; Caché; MySQL; OLAP and ODBC. Windows: NT thru 2016; Linux and *BSD. Solaris, AIX and HP-UX. RAC/F, ACF/2 and TopSecret. Server OS Midrange: ERP, CRM and other apps: Messaging & collaboration: Smart cards and 2FA: Access managers / SSO: iseries (OS400); OpenVMS and HPE/Tandem NonStop. Oracle EBS; SAP ECC and R/3; JD Edwards; PeopleSoft; Salesforce.com; Concur; Business Objects and Epic. Microsoft Exchange, Lync and Office 365; Lotus Notes/Domino; Google Apps; Cisco WebEx, Call Manager and Unity. Any RADIUS service or SAML IdP; Duo Security; RSA SecurID; SafeWord; Vasco; ActivIdentity and Schlumberger. CA SiteMinder; IBM Security Access Manager; Oracle AM; RSA Access Manager and Imprivata OneSign. Help desk / ITSM: PC filesystem encryption: Server health monitoring: HR / HCM: Extensible / scriptable: ServiceNow; BMC Remedy, RemedyForce and Footprints; JIRA; HPE Service Manager; CA Service Desk; Axios Assyst; Ivanti HEAT; Symantec Altiris; Track-It!; MS SCS Manager and Cherwell. Microsoft BitLocker; McAfee; Symantec Endpoint Encryption and PGP; CheckPoint and Sophos SafeGuard. HP ilo, Dell DRAC and IBM RSA. WorkDay; PeopleSoft HR; SAP HCM and SuccessFactors. Hypervisors and IaaS: Mobile management: Network devices: Filesystems and content: SIEM: AWS; vsphere and ESXi. Management & inventory: Qualys; McAfee epo and MVM; Cisco ACS; ServiceNow ITAM; HP UCMDB; Hitachi HiTrack. BlackBerry Enterprise Server and MobileIron. 5.5 Integration with custom apps Cisco IOS PIX and ASA; Juniper JunOS and ScreenOS; F5 BigIP; HP Procurve; Brocade Fabric OS and CheckPoint SecurePlatform. Windows/CIFS/DFS; SharePoint; Samba; Hitachi Content Platform and HCP Anywhere; Box.com and Twitter. CSV files; SCIM; SSH; Telnet/TN3270/TN5250; HTTP(S); SQL; LDAP; PowerShell and Python. Splunk; ArcSight; RSA Envision and QRadar. Any SIEM supporting SYSLOG or Windows events. Hitachi ID Suite easily integrates with custom, vertical and hosted applications using flexible agents. Each flexible agent connects to a class of applications: API bindings (C, C++, Java, COM, ActiveX, MQ Series). Telnet / TN3270 / TN5250 / sessions with TLS or SSL. SSH sessions. HTTP(S) administrative interfaces. Web services. Win32 and Unix command-line administration programs. SQL scripts. Custom LDAP attributes. Integration takes a few hours to a few days. Fixed cost service available from Hitachi ID. 6 Privileged Access 2018 Hitachi ID Systems, Inc. All rights reserved. 8

9 6.1 Types of privileged accounts Definition: Shared Administrative Embedded Service Interactive logins used by humans. Client tools: PuTTY, RDP, SQL Studio, etc. May be used at a physical console. One application connects to another. DB logins, web services, etc. Run service programs with admin or limited rights. Windows requires a password. Scheduled tasks, IIS, DCOM, SCM, etc. Challenges: Access control. Audit/accountability. Single sign-on. Session capture. Authenticating apps prior to password disclosure. Caching, key management. Avoiding service interruption. Restart service if req d Hitachi ID Systems, Inc. All rights reserved. 9

10 6.2 HiPAM features Auto-discovery: Find systems, accounts. Automatically attach policies via rules. Passwords: Randomize on a schedule and after use. Store in an encrypted, replicated, distributed vault. Authorization: Policy-driven rules. Pre-authorized and request/approval workflow if not routine. Grant access: Single sign-on (login once, launch many). Request multiple accounts, run commands across them. Launch SSH, RDP, vsphere, SQL, etc. Direct connection, VDI proxy or HTML5 proxy. Password display and copy buffer integration. Temporary group membership or SSH trust. Application passwords: Notify SCM, IIS, Scheduler, DCOM of new passwords. API replaces embedded passwords. Logging: Requests, approvals, logins to privileged accounts. Session monitoring: Screen, keyboard, webcam, process ID, window title, etc. Keylog censorship protects passwords, SSN, CC numbers, etc. Request/approval workflow protects staff privacy. 7 Example Deployments 2018 Hitachi ID Systems, Inc. All rights reserved. 10

11 7.1 Case Study: Industrial conglomerate Customer description: Product: Industry: Target systems: Functionality: Main business driver: Business impact: Global industrial conglomerate with energy utility subsidiaries. Hitachi ID Identity Manager Industrials, energy utilities Windows/AD, Oracle EBS, mainframe, databases. Onboard, deactivate, manage access of over 10,000 employees and contractors. Automation, self-service, policy enforcement. Lower IT support cost and improve SLA. Retired home-grown IAM and access reporting system. Lower IT security management workload. 7.2 Case Study: Energy company Customer description: Product: Number of users: 100,000+ Functionality: Main business driver: Business impact: 7.3 Case Study: US bank Customer description: Product: Industry: Global energy company Hitachi ID Group Manager Self-service requests to access network shares, folders. Reduce IT support call volume. Replace "access denied" help desk calls with self-service infrastructure. US bank Hitachi ID Password Manager Banking Number of users: 150,000 Functionality: Main business driver: Business impact: Password reset via telephone, web browser Reduce IT support cost, improve authentication security when users call for help. Eliminated 33,000 help desk calls/month. Saved at least US$ 4,000,000/year Hitachi ID Systems, Inc. All rights reserved. 11

12 7.4 Case Study: Investment bank Customer description: Product: Top-10 global investment bank. Industry: Target systems: Functionality: Main business driver: Finance Windows, Unix/Linux, MSSQL. Randomize passwords weekly on 122,000 systems around the world. Deployed 12 servers in 4 data centers globally for super-high availability and fault tolerance. Eliminate static, shared, administrative passwords to comply with audit, regulatory requirements. Business impact: Control, audit administrator logins to privileged accounts on 122,000 systems globally. Pass audits. 8 Differentiation 8.1 HiIM advantages Hitachi ID Identity Express Built-in features: User friendly requests: Robust policy enforcement: Architecture: HiIM Pre-configured with most common scenarios. Group lifecycle management. Request portal. Access certification. Approval workflow Windows Shell extension. SharePoint integration. Compare users. Recommended entitlements SoD with deep inspection. Policy-driven approvals. Privacy protection. Scalable: multi-master, load-balanced. Fault tolerant: active-active. Others Every deployment is custom, new. Custom forms. Custom workflows. Users must know what entitlements to request. SoD easily bypassed. Hard-coded approvals. No privacy protection. DB is choke point, single point of failure. Only hot standby Hitachi ID Systems, Inc. All rights reserved. 12

13 8.2 HiPM advantages HiPM 2FA, Federation included for all users. Access from smart phones (BYOD). Unlock encrypted drive - pre-boot password prompt. Access from Windows login screen, even when off-site. Access from domain-member MacOSX login screen. All connectors included in base price. Web browser, smart-phone, PC login screen, telephony all included. Managed enrollment, max. adoption. Active-active replication: scalable and reliable. Others Extra products required. Only with a public URL. Call the help desk. Come back to the office or ship laptop to dept Call the help desk. Some charge per-connector. Extra features, extra cost. Write scripts extra cost, lower ROI. Hot standby at best. May cost extra Hitachi ID Systems, Inc. All rights reserved. 13

14 8.3 HiPAM advantages Multi-factor authentication Access disclosure options User convenience Other access mechanisms High availability HiPAM Included 2FA app. Leverage any 3rd party MFA. Display/copy password. Single signon (SSO) - direct connect, HTML5 proxy, VDI proxy. Can launch any admin tool. SSO: login once, launch many. Request multiple accounts at once. Temporary group membership. Temporary SSH trust membership. Active-active architecture. Geographically distributed. Built-in data replication. Others Limited 3rd party MFA. Nothing built-in. Display/copy password. Jump server only for SSH, RDP. Login again for every session. One account at a time. None Hot standby only Roll-your-own replication. 9 Discussion 500, Street SE, Calgary AB Canada T2G 2J3 Tel: Fax: sales@hitachi-id.com hitachi-id.com Date: File: PRCS:pres