1 Hitachi ID Password Manager. 2 Agenda. 3 Corporate. Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications

Transcription

1 1 Hitachi ID Password Manager Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications Integrated credential management: Passwords, security questions, certificates, tokens, smart cards and biometrics. 2 Agenda Corporate Hitachi ID Password Manager Recorded Demos Technology Implementation Differentiation 3 Corporate 2018 Hitachi ID Systems, Inc. All rights reserved. 1

2 3.1 Hitachi ID corporate overview Hitachi ID delivers access governance and identity administration solutions to organizations globally. Hitachi ID IAM solutions are used by Fortune 500 companies to secure access to systems in the enterprise and in the cloud. Founded as M-Tech in A division of Hitachi, Ltd. since Over 1200 customers. More than 14M+ licensed users. Offices in North America, Europe and APAC. Global partner network. 3.2 Representative customers 2018 Hitachi ID Systems, Inc. All rights reserved. 2

3 3.3 Hitachi ID Suite 4 Hitachi ID Password Manager 4.1 Too many passwords Challenges Users have too many passwords. Write them on sticky notes. Forget and call the help desk. Pick trivial, insecure values. Solutions Synchronize passwords. Reduce to 1 or a few. Easier to remember. Less likely to write down. Opportunity to mandate stronger passwords Hitachi ID Systems, Inc. All rights reserved. 3

4 4.2 Help desk call volume Challenges Users forget their passwords. Lock themselves out. Highest volume incident type. Peak volume at start of week. Solutions Self-service password reset. Clear intruder lockouts. PIN resets and emergency pass-codes for tokens. 4.3 Automated user enrollment Challenges Self service depends on non-password credentials: Security questions. Mobile phone number. Personal address. App on smart phone. This data rarely exists prior to deployment. New hires must enroll too. ROI depends on user adoption: Users tend to ignore invitations. Solutions Identify users with incomplete profiles. Invite them to sign up. Send reminders with increasing urgency: . Open browser at login time. Forced enrollment (full screen, locked browser.) Throttle invitations: Per user (e.g., once a week). Overall (e.g., 500/day) Hitachi ID Systems, Inc. All rights reserved. 4

5 4.4 Password reset from difficult contexts Challenges Users have trouble logging in: Forget their password. Trigger an intruder lockout. User context can complicate assistance: Pre-boot? No OS yet! Login screen? How to navigate to self-service? Off-site? Locally cached password. Solutions Pre-boot: Smart phone app or voice call to access service. Encrypted drive unlock. Windows login screen: Credential Provider extends the Windows login UI. Smart phone app or voice call. Secure kiosk account if client software is a problem. VPN integration: Update locally cached password for off-site users. 4.5 Consistently strong authentication Challenges Few apps natively support multi-factor logins. Mandate strong authentication before self-service password reset. Solutions Offer 2FA to all users: PIN to phone/ . Smart phone app. Existing OTP. Browser fingerprint (reduces the nuisance of 2FA). Built into Hitachi ID Password Manager Leverage existing 2FA if available. Introduce zero-cost 2FA otherwise. Extend 2FA to other apps via federation: Password Manager includes a built-in SAML IdP 2018 Hitachi ID Systems, Inc. All rights reserved. 5

6 4.6 SaaS apps demand stronger security Challenges Solutions SaaS apps expose a public URL. Unlike on-premises, they can be attacked by anyone with an Internet connection. Offload login screens to a federated access manager. Require 2FA at the consolidated login screen. Fingerprint browsers to reduce the nuisance of a two-step login. 4.7 Users have personal passwords Challenges Solutions Users sign into a variety of non-corporate services. Insurance, banking, , social network, e-commerce,... They sometimes ask IT for help managing these too. Offer them a secure alternative. Improves customer satisfaction with IT. Acts as an inducement to installing a 2FA mobile app Hitachi ID Systems, Inc. All rights reserved. 6

7 5 Recorded Demos 5.1 Password reset with WiFi, VPN and 2FA Animation:../../pics/camtasia/v10/hipm-ssa-windows-10.mp4 5.2 Federated access launchpad Animation:../../pics/camtasia/v10.1/federated-launchpad.mp4 5.3 Activate Mobile Access app Animation:../../pics/camtasia/suite11/enable-mobile-device-1.mp4 5.4 Unlock pre-boot password Animation:../../pics/camtasia/v10/mcafee-drive-encryption.mp4 5.5 Add contact to phone Animation:../../pics/camtasia/v9/add-contact-to-phone-1/add-contact-to-phone-1.mp4 6 Technology 2018 Hitachi ID Systems, Inc. All rights reserved. 7

8 6.1 Active-active architecture Native password change Password synch trigger systems SaaS apps AD, Unix, z/os, LDAP, iseries Validate pw z/os - local agent Mobile UI Mobile proxy Manage Cloud IVR server TCP/IP + AES VPN server Various protocols Secure native protocol HTTPS Reverse web proxy system Load balancers MS SQL databases Notifications and invitations Ticketing system Hitachi ID servers Tickets HR Hitachi ID servers Replication System of record Firewalls Managed endpoints with remote agent: AD, SQL, SAP, Notes, etc Data center A Data center B Remote data center Proxy server (if needed) Managed endpoints 2018 Hitachi ID Systems, Inc. All rights reserved. 8

9 6.2 Key architectural features BYOD enabled On premises and SaaS SaaS apps Cloud Replicated across data centers Horizontal scaling Load balanced TCP/IP + AES Various protocols Secure native protocol Reach across firewalls Data center A Data center B Remote data center HTTPS 2018 Hitachi ID Systems, Inc. All rights reserved. 9

10 6.3 Delivery options On-premises Hosted / SaaS What/where Conventional software; or Virtual appliance. Managed by customer IT; or managed by Hitachi ID remotely; or managed by a partner. Dedicated instance per customer. Minimum two servers, locations. Proxy server on-premises. Managed by Hitachi ID. Regular upgrades. Charges Software: License, annual maintenance. Virtual appliance: add OS, DB licenses. Managed service: add annual fee. Monthly per-user fee. Commitment for minimum quantity, duration. 6.4 Internal architecture Multi-master, active-active out of the box. Built-in data replication between app nodes: Fault tolerant. Secure - encrypted. Reliable - queue and retry. App nodes need and should not be co-located. Native, 64-bit code: 2x faster than.net. 10x faster than Java. Stored procedures: For all data lookups, inserts. Fast, efficient. Eliminates client/server chatter. Modern crypto: AES-256, SSHA Hitachi ID Systems, Inc. All rights reserved. 10

11 (! ' &!% $ #! "!, + & * ( )!! $ (! ' &. - )! % ( & & 0 /. - ) 3 ) 2 ) 1, & ( )! % 4 2 )! Slide Presentation 6.5 Authentication chains An authentication chain is a defined series of steps. Special type: interactively choose a chain. Special type: programmatically limit available chains. Risk-analysis: VPN? admin user? 6.6 User classes User classes define sets of individual users or types of relationships between users: Sets of users: By group membership In an OU Having certain attributes Types of relationships: Shared attributes (e.g., department, location). Group membership of participants (e.g., security team). Direct or indirect manager. User classes are a natural way to define security policy: Route requests (requester+recipient/authorizer). Invite reviewers (user/certifier). Escalate requests (old/new participants). Limit visibility (viewer/user profile). Define what is requestable (requester/recipient) Hitachi ID Systems, Inc. All rights reserved. 11

12 6.7 BYOD access to on-premises IAM system The challenge Users want access on their phones. Phone on the Internet, IAM on-prem. Don t want attackers probing IAM from Internet. Hitachi ID Mobile Access Install + activate ios, Android app. Proxy service on DMZ or cloud. IAM, phone both call the proxy - no firewall changes. IAM not visible on Internet. Internet Personal device Firewall Firewall IAM server (2) HTTPS request: Includes userid, deviceid Outbound connections only DMZ (1) Worker thread: Give me an HTTP request Private corporate network Cloud proxy (3) Message passing system 2018 Hitachi ID Systems, Inc. All rights reserved. 12

13 6.8 Included connectors Directories: Databases: Server OS X86/IA64: Server OS Unix: Server OS Mainframe: Active Directory and Azure AD; any LDAP; NIS/NIS+ and edirectory. Oracle; SAP ASE and HANA; SQL Server; DB2/UDB; Hyperion; Caché; MySQL; OLAP and ODBC. Windows: NT thru 2016; Linux and *BSD. Solaris, AIX and HP-UX. RAC/F, ACF/2 and TopSecret. Server OS Midrange: ERP, CRM and other apps: Messaging & collaboration: Smart cards and 2FA: Access managers / SSO: iseries (OS400); OpenVMS and HPE/Tandem NonStop. Oracle EBS; SAP ECC and R/3; JD Edwards; PeopleSoft; Salesforce.com; Concur; Business Objects and Epic. Microsoft Exchange, Lync and Office 365; Lotus Notes/Domino; Google Apps; Cisco WebEx, Call Manager and Unity. Any RADIUS service or SAML IdP; Duo Security; RSA SecurID; SafeWord; Vasco; ActivIdentity and Schlumberger. CA SiteMinder; IBM Security Access Manager; Oracle AM; RSA Access Manager and Imprivata OneSign. Help desk / ITSM: PC filesystem encryption: Server health monitoring: HR / HCM: Extensible / scriptable: ServiceNow; BMC Remedy, RemedyForce and Footprints; JIRA; HPE Service Manager; CA Service Desk; Axios Assyst; Ivanti HEAT; Symantec Altiris; Track-It!; MS SCS Manager and Cherwell. Microsoft BitLocker; McAfee; Symantec Endpoint Encryption and PGP; CheckPoint and Sophos SafeGuard. HP ilo, Dell DRAC and IBM RSA. WorkDay; PeopleSoft HR; SAP HCM and SuccessFactors. Hypervisors and IaaS: Mobile management: Network devices: Filesystems and content: SIEM: AWS; vsphere and ESXi. Management & inventory: Qualys; McAfee epo and MVM; Cisco ACS; ServiceNow ITAM; HP UCMDB; Hitachi HiTrack. BlackBerry Enterprise Server and MobileIron. 6.9 Integration with custom apps Cisco IOS PIX and ASA; Juniper JunOS and ScreenOS; F5 BigIP; HP Procurve; Brocade Fabric OS and CheckPoint SecurePlatform. Windows/CIFS/DFS; SharePoint; Samba; Hitachi Content Platform and HCP Anywhere; Box.com and Twitter. CSV files; SCIM; SSH; Telnet/TN3270/TN5250; HTTP(S); SQL; LDAP; PowerShell and Python. Splunk; ArcSight; RSA Envision and QRadar. Any SIEM supporting SYSLOG or Windows events. Hitachi ID Password Manager easily integrates with custom, vertical and hosted applications using flexible agents. Each flexible agent connects to a class of applications: API bindings (C, C++, Java, COM, ActiveX, MQ Series). Telnet / TN3270 / TN5250 / sessions with TLS or SSL. SSH sessions. HTTP(S) administrative interfaces. Web services. Win32 and Unix command-line administration programs. SQL scripts. Custom LDAP attributes. Integration takes a few hours to a few days. Fixed cost service available from Hitachi ID Hitachi ID Systems, Inc. All rights reserved. 13

14 6.10 SAMLv2 Federated IdP Externalize login process from third party web apps. Cloud: Google Apps, Office 365, Salesforce.com, WebEx, Concur, etc. On-premise: SharePoint (via ADFS), HCP Anywhere, etc. Basically respond to SAMLv2 requests with assertions. Leverage user classes for authorization control, authentication chains for 2FA/MFA Hitachi ID Mobile Access authentication factor Leverage Hitachi ID Mobile Access on user phones as a soft token. Zero extra cost: organizations have no excuse to revert to just Q&A or just a password on Extranet logins. More secure password reset. 2FA for all Hitachi ID Privileged Access Manager logins, even if the network is down, AD or RADIUS unreachable Hitachi ID Systems, Inc. All rights reserved. 14

15 6.12 HiTPM: self-service via phone call Self-contained: Hitachi ID Hitachi ID Phone Password Manager runs on a Windows server with a Dialogic phone card or with HMP software Dialogic solution. No IVR software is required. Integrated with Hitachi ID Password Manager: Manage user enrollment. Map network login ID to digits. Password Manager ties to target systems. Flexible: Fully scriptable and can implement any call logic. Multi-lingual: just record more voice prompts. The default call logic is powerful and easy to customize. Scalable: Multiple load balanced Hitachi ID Phone Password Manager servers. Multiple load balanced Password Manager servers Language support The Hitachi ID Password Manager UI can be rendered in many languages: Languages are easy to add. Hitachi ID will do it for a nominal fee and customers can do it themselves. 7 Implementation 2018 Hitachi ID Systems, Inc. All rights reserved. 15

16 7.1 Hitachi ID professional services Hitachi ID offers a complete range of services relating to Hitachi ID Password Manager, including: Needs analysis and solution design. Fixed price system deployment. Project planning. Roll-out management, including maximizing user adoption. Ongoing system monitoring. Training. Services are based on extensive experience with the Hitachi ID solution delivery process. The Hitachi ID professional services team is highly technical and have years of experience deploying IAM solutions. Hitachi ID partners with integrators that also offer business process and system design services to mutual customers. All implementation services are fixed price: Solution design. Statement of work. 8 Differentiation 2018 Hitachi ID Systems, Inc. All rights reserved. 16

17 8.1 HiPM differentiation The most features Always available Manage all credentials: Passwords on directories, servers, apps, DBs. On-premises and SaaS. Pre-boot passwords. Smart cards and tokens. 2FA for all users. Personal password vault. Federated single sign-on (SAML IdP) connectors included. Corporate PCs: Pre-boot unlock screen. Windows/MacOSX login screen. Desktop browser. Smart phone app. Voice call to IVR. At work and off-site. Scalable The best ROI Multi-master, active-active. Load balanced, replicated. Geographically distributed. Multi-lingual. Reduce problem frequency Address root cause. Don t just download problem resolution to users. Managed enrollment to maximize adoption. Rapid deployment, minimal maintenance. 8.2 The leading PM vendor Innovation Ongoing support Low cost Self-Service, Anywhere. Drive unlock via smart phone app or call to IVR. Integrated password wallet. Integrated federated access and SSO. 2FA for everyone. Responsive and skilled customer support. Unattended operation: Auto-discovery. Managed enrollment. Metrics and trend analysis. SIEM, help desk integration. Fixed-price implementation. Minimal need for ongoing maintenance Hitachi ID Systems, Inc. All rights reserved. 17

18 9 Summary An integrated solution for managing credentials: Immediate security benefit: password policy, help desk caller authentication. Low deployment cost, minimal ongoing investment, significant IT support savings. Always accessible: Web browser on PC, phone or tablet. Windows login prompt. Pre-boot encryption password prompt. Apps on ios, Android. Phone call / IVR. Available at work and while off-site connectors included. Learn more at Hitachi-ID.com/Password-Manager 500, Street SE, Calgary AB Canada T2G 2J3 Tel: Fax: sales@hitachi-id.com hitachi-id.com Date: File: PRCS:pres