Identity-Powered Security

Size: px

Start display at page:

Download "Identity-Powered Security"

Piers Allison
6 years ago
Views:

1 Identity-Powered Security

2 Innovation created a very complex environment. z / OS PL / I Public Cloud Private Cloud Internet of Things (IoT) COBOL CICS IMS

Data Breach Are we doing enough to control access to sensitive information? Do we understand our threat landscape?

3 Cloud How is leveraging cloud impacting risk and how can I manage it? Mobile Is our use of mobile devices secure? Compliance Are we complying with all applicable mandates? How do we reduce the cost of compliance? Data Breach Are we doing enough to control access to sensitive information? Do we understand our threat landscape? IoT How do we securely take advantage of IoT? Service Delivery Are we doing enough to ensure availability and data security? Network Are we ensuring the security of the network? Third Party Risk Are we doing enough to manage partner, contractor, and customer access?

4 Identity is More Important Than Ever DEVICES Mobile Browser Desktop ID SOURCES Social Internal Directory WAM Cloud USERS Partners Customers Consumers Employees APLICATIONS ebusiness SaaS Legacy/Custom API

5 Identity Manager

6 Evolution of Identity Manager. Auditory and reporting Compliance Roles and resources Roles based Workflows and web forms Rights User self service Correct rights Policies Policy based Synchronization Identity integration 1998 DirXML IDM IDM IDM IDM IDM IDM IDM 4.6

7 Philosophy of Identity Manager.

Identity Manager Real time user provisioning. Delegated administration and user self service. Reduce the complexity with their provisioning based in roles.

8 Identity Manager Real time user provisioning. Delegated administration and user self service. Reduce the complexity with their provisioning based in roles. Out of the box enterprise connectors for local solutions and cloud applications. User life cycle auditory system. User friendly web interface and graphical configuration tools. Design to be interoperable and flexible to integrate easily with standard protocols.

9 Administrator interface.

10 Connectors included with the base license. - Identity Manager Standard. o Windows Microsoft Active Directory o GroupWise, Microsoft Exchange, and Lotus Notes o Directory NetIQ edirectory and other LDAP v3 directories o Engine Services Manual Task Services (M-Task), Loopback, Null o Others Privileged Identity Management - Identity Manager Advance Edition. o Windows-Microsoft Active Directory o -GroupWise, Microsoft Exchange, and Lotus Notes o Directory-NetIQ edirectory and other LDAP v3 directories o Engine Services-Manual Task Services (M-Task), Loopback, Null o Others-Privileged Identity Management o Database JDBC driver (IBM DB2, Informix, Microsoft SQL Server, MySQL, Oracle and Sybase) o Message System JMS o Driver for Salesforce.com o Tools (Delimited Text, SOAP, and REST drivers) Complete list of connector for Identity Manager:

11 Out of the box enterprise connectors. Applications HP Service Desk Microsoft Sharepoint Oracle E-Business Suite BMC Remedy PeopleSoft RSA ACE SAP Enterprise SAP GRC SAP HR & Portal SAP R/3 4.6 SAP Web Application Server Ellucian Banner SugarCRM Blackboard Data bases Microsoft SQL Server Oracle Database IBM DB2 Universal Database Informix Dynamic Server Sybase Adaptive Server PostgreSQL MySQL JDBC Midrange IBM i (i5/os and OS/400) Directories IBM Directory Server (SecureWay) iplanet Directory Server Microsoft Active Directory Microsoft Windows NT Domain Netscape Directory Server Sun Microsystems NIS+ Sun ONE Directory Server NetIQ edirectory LDAP v.3.0 Operative Systems Microsoft Windows 7, 8 y 10, Microsoft Windows Server 2008 y 2012 SUSE Linux Enterprise Server Debian Linux FreeBSD HP-UX IBM AIX Red Hat AS y ES Red Hat Linux Oracle Solaris UNIX servers Microsoft Exchange Novell GroupWise Lotus Notes PBX PBX de Avaya Asterisk VoiceRD Mainframes-z/OS RACF ACF2 Other SOAP DSML SPML Cloud Ready GoogleApps Salesforce.com Microsoft Office 365 Complete list of connector for Identity Manager:

12 Self-Service Password Reset. Allows users to change and reset passwords according to the security and complexity policies. Provides self service web interface and it is integrated with the Windows Login Gina. Set and respond to challenge questions for forgotten passwords rather than resetting / changing passwords. Protected by secure Tokens OTP, SMS or Google Authenticator, to prevent social engineering attacks. Support help desk panel, to attend the user call safety and compliance.

13 Integrated with the Windows login. Interfaz web en HTML5 con Responsive Web Design. 13

14 Helpdesk interface. 14

15 Initial Login - End User

16 Request Form

17 Compare Users

18 User Catalog Card View

19 User Catalog

20 Settings - Branding

21 Graphical design of workflows.

22 Identity Manager Approvals App. NetIQ Identity Manager Approvals - Apple Store: NetIQ Identity Manager Approvals - Google Play:

23 User life cycle auditory and reporting.

24 Access Review

25 You now know who has access to what, but should they?

26 Compliance requirements and penalties. Governance Privacy Mandates HIPAA / HITECH NERC CIP Audits! European Data Protection Regulation SOX User demands! Right to be forgotten ISO 27001/2 PCI DSS European Data Protection Regulation

27 Certification process based in the users.

28 Certification process based in applications.

29 Policies of segregation of duties.

30 Compliance dashboard to have full visibility.

31 Manual or automatically remediation.

32 Proactive detection of orphans accounts.

33 Identity risk management.

34 Simple and clear for business approver

35 Access Manager

36 Work is an Activity, Not a Place The who, where, and what of access has changed dramatically Delivering convenience without putting the business at risk.

37 63% of confirmed data breaches involved weak, default or stolen passwords. Source: Verizon Data Breach Investigation Report, 2016

38 Ensuring the Right Access Employees and Contractors Internal Applications & Services Partners Access Management Customers / Citizens Cloud-Based Services

Access Manager Mobile Applications Web Applications Cloud Applications

Advance access controls to the corporative web resources.

39 Access Manager Mobile Applications Web Applications Cloud Applications Access Manager Internal users External users Simplifies access and give more productivity with Single Sign-On. Authentication with advance authentication methods. Advance access controls to the corporative web resources. Full auditory in the access to the web applications and cloud solutions. Create an identity federation relationships with other companies.

40 Web resources management.

Authentication methods. Authentication with LDAP Login. Active Directory, edirectory y LDAP v.3. Certificates with support of CRL and OCSP (X.509).

Authentication with Active Directory Federation Services Authentication with OAuth & Social Authentication. Authentication with OpenID & SAML v.2.0.

41 Authentication methods. Authentication with LDAP Login. Active Directory, edirectory y LDAP v.3. Certificates with support of CRL and OCSP (X.509). Authentication with Radius (802.11x). Authentication with Kerberos. Authentication with Identity Federation. Authentication with Active Directory Federation Services Authentication with OAuth & Social Authentication. Authentication with OpenID & SAML v.2.0. Authentication with SmartCard. Authentication with Google Authenticator. Authentication with FreeOTP. Authentication with SMS OTP. Api to integrate third party authentication methods. 41

42 Easy customization.

43 User access.

44 User web authentication.

45 User application dashboard.

46 User application administration.

47 User interface in multiple languages.

48 Google recaptcha

49 Integrated with Google recaptcha.

50 Mobile Access

51 Delivering Secure Mobile Access Backend Systems Access Management

52 Access For Various Form Factors

53 Secure access to corporate applications.

54 Secure access to corporate applications.

55 Mobile Access administration.

56 Mobile Access applications management.

57 Simplified SSO Apps.

58 Application Connectors Out of the Box. Micro Focus Application Connector Catalog:

59 Application Connectors Catalog.

60 Easy application configuration.

61 Adaptive Authentication.

62 Security based in the user context Who is attempting access? Where are they located right now? Where are they normally located? What are they trying to access? What is the associated risk? When should I allow access? What else have they accessed lately? Does this reflect past behavior?

Step-up Authentication When Warranted Risk Score 132 PARAMETERS Username, Password HTTP Header IP Address & History Geo Location Known Cookie Device Fingerprint Last Login Cookie User

63 Step-up Authentication When Warranted Risk Score 132 PARAMETERS Username, Password HTTP Header IP Address & History Geo Location Known Cookie Device Fingerprint Last Login Cookie User Attributes CURRENT PATTERN ern Entered Inline with Configuration Within Valid Range Standard location Valid Cookie Valid Device Fingerprint Login from last used device present Valid user attributes

Risk Too High for the Business Risk Score 321 PARAMETERS Username, Password HTTP Header IP Address & History Geo Location Known Cookie Device Fingerprint Last Login Cookie User Attributes

64 Risk Too High for the Business Risk Score 321 PARAMETERS Username, Password HTTP Header IP Address & History Geo Location Known Cookie Device Fingerprint Last Login Cookie User Attributes CURRENT PATTERN Entered Request contains different values in header field Different IP address with no history Suspect location Not sure Not determined No cookie present Valid user attributes

65 Risk-Based Authentication Contextual information Managing risk to information IP Address Geolocation User Profile External Parameters Risk Engine HTTP Headers User Cookies Device ID Assurance levels Low risk Medium Risk High Risk Allow Access Step-up Authentication Regulated (finance, healthcare, retail) Customer data Financial (internal, customer, partner) Intellectual property Internal s Partner collaboration, supply chain Classified data User History Deny Access

66 Definition of risk policy

67 Advanced Authentication FIDO U2F PIN Code Live Ensure Voice Bio Soft Token Emergency HSM Challenge NFC Face Biometric Hard Token LDAP Password SMS Fingerprint RFID OTP Smartphone Voice Call LDAP PKI

68 Social Identity

Social Networks Will Become Identity Brokers /

customer identities will be based on social

Today identity is delivered by the enterprise.

identities may come from somewhere else.

the social media environment and our ability to

69 Social Networks Will Become Identity Brokers / Providers By end of % of all new retail customer identities will be based on social network identities. Today identity is delivered by the enterprise. If you look at business partners and customers, identities may come from somewhere else. In a decade or so depending on the mobility of the social media environment and our ability to build an enterprise-class shell around that identity, they could become the dominant identity providers.

70 Social identity out of the box.

71 Analytics Dashboard

72 Analytics Dashboard.

73 Analytics Dashboard.

74 Analytics Dashboard.

75 Analytics Dashboard.

76 Analytics Server and Reporting.

77 Analytics Server and Reporting.

78 Analytics Server and Reporting.

79 Report User Login Contract Summary.

80 Advanced Authentication

81 Long-term theft and damage the incidents that take the longest to discover were these inside jobs... (these took) months or longer to discover... Time to discover Over 80 % took weeks or more to discover Time to compromise Over 90 % happened in seconds or minutes Source: Verizon Data Breach Investigation Report, 2016

82 'One billion' affected by Yahoo hack.

83 Have i been pwned?

84 The Numbers are Staggering 84

Preventive and Detection Controls are Needed Identity and Access are preventative controls; they always have vulnerabilities Also, people with legitimate access

85 Preventive and Detection Controls are Needed Identity and Access are preventative controls; they always have vulnerabilities Also, people with legitimate access misbehave Insider Threat can t be avoided with preventative controls only Our customers need monitoring to ensure Identity and Access are functioning correctly.

86 The three pillars of Authentication.

Authentication chains with multiple factors.

Designed for high availability environments.

87 Advanced Authentication. Solution with multiple authentication methods. Authentication chains with multiple factors. Integrated with the login of Microsoft Windows, Linux and Apple MacOS. Software appliance with easy deployment. Designed for high availability environments. Smartcards Biometrics Smartphone Radius protocol Hardware Tokens Question / Answers Voice call and SMS Open API to integrate with third party solutions.

88 Administration dashboard

89 Administration dashboard.

90 User self-service interface

91 User self-service interface.

92 Helpdesk dashboard

93 Helpdesk dashboard.

94 Responsive Web Design

95 Interface for Smartphones and Tablets.

96 Interface for Smartphones and Tablets.

97 NetIQ Auth App

98 Smartphone Authentication App.

99 Interoperability of the solution.

100 Integration with Microsoft Windows.

101 Integration with Linux.

102 Integration with Apple MacOS.

103 Integration with web applications.

104 Integration with Radius protocol.

105 Interoperability of the solution.

106 Analytics Dashboard

107 Analytics Dashboard.

108 Analytics Dashboard.

109

110

BEYOND AUTHENTICATION IDENTITY AND ACCESS MANAGEMENT FOR THE MODERN ENTERPRISE

BEYOND AUTHENTICATION IDENTITY AND ACCESS MANAGEMENT FOR THE MODERN ENTERPRISE OUR ORGANISATION AND SPECIALIST SKILLS Focused on delivery, integration and managed services around Identity and Access Management.