The Cloud Identity Crisis

Transcription

1 The Cloud Identity Crisis Strategies for Identity-based Access Control for Cloud Applications Marty Jost Symantec Product Marketing Jim Brigham O3 Product Management 1

2 Agenda Cloud Customer Experiences Industry Solutions and Symantec O3 Platform Use Cases and Customer Examples Product Demonstration 2

3 Cloud Applications Are Gaining Broad Acceptance Software as a Service (SaaS) offerings are easy to acquire Improve Service Be More Agile Lower Operation Costs Reduce Capitol Expenses Human Resource Management Finance and Payroll Enterprise Resource Planning Sales Automation Infrastructure Services Productivity Tools 3

4 Rapid Change Creates Challenges Ownership and Process IT usually must support even if multiple business units self-procure New Risk & Compliance Exposure Different threats when application and data in a 3 rd party data center Identity often dispursed Mobility and BYOD initiatives often happening in parallel Security vs. Convenience Trade-off Today the user experience is critical to perception of IT service Multi-app complexity creates need for Single Sign-On 4

5 Single Sign-On Options Legacy suite with SSO extended to the web Specialized vendor approaches to one identity (federation) Standards-based Security Broker for greater flexibility and fast time-to-value EMC/RSA Security SecureID Computer Associates SiteMinder IBM Tivoli Access Manager Microsoft Active Directory and ADFS Salesforce.com Oracle (application platform) Google, Facebook (social) Symantec O3 TM Various others 5

6 The Security Broker Helps Manage Cloud Issues Simpler for IT Staff and End Users Provides single cloud control point Integrates with existing identity management systems User logs-in only once then O3 acts on users behalf Broad Application Coverage Enterprise Software: Salesforce, SAP, Workday, etc. Productivity Tools: Google Apps, Dropbox, Office 365 Other web-based IT Can Retain Visibility and Oversight Manage entitlements from a single place Enforces access rules and enables easier compliance auditing Simplifies operations such as deprovisioning 6

7 A New Cloud Security Platform Symantec O 3 Single Sign-on Service Identity-based Access Control Mobile Support Access logs & Event information Secure and reliable delivery Manage policy from one place No side-door blind spots Consolidates logs across apps 7

8 Web Single Sign-on Intelligence Center Login Policies and Status Monitoring ID Management End-User Login Optional step-up for 2FA Symantec O 3 SSO Service Benefits Better user experience More productive Lower support costs Easy to deploy and manage How it Works User logs in to O3 Lookup login policy Lookup ID and group attributes Broker logs in to application Leverage SaaS federation support Web forms for non-federated apps 2FA step-up when required 8

9 Enterprise Wide Access Control Benefits Internal User Mobile User Retain control and visibility Works for both internal and mobile Prevent side-door access Device & Location Context User Context Application Context Symantec O 3 Access Control Internal Web Apps How it works Applications configured to only authorize login from O3 User attempts to access application O3 does identity-based lookup of access policy for application Access granted or denied Access events captured in log Instant deprovisioning possible for all apps if user ID is deleted 9

10 Compliance Audit Enterprise Symantec O 3 Log Engine Benefits Demonstrable proofs Logs consolidated in ONE place More complete and accurate view Reduces time and effort O 3 Logs SIEM Engine Network logs How it works Collects events across apps Output to standard format (Syslog) Consumable by information and Event Management system (SIEM) 10

11 BYOD Compliance Through Data Container The container provides an app dashboard User enters app through browser ios Mobile Data Container App Enterprise data kept separate from other user data (sandbox) Auto-encrypted Available when not connected (airplane mode) Enforces do not forward policy Files encrypted when moved to device Single binary for iphone/ipad 11

12 Other Integrations Symantec App Center Wrapped binary Complements O3 web coverage O3 acts as Wrapper Auth Server Automatically open if already logged in Login Policies and Status Monitoring ID Management Symantec O 3 App Center External ID provider Other Identity or Autentication Symantec VIP Public Key Infrastructure Social identity via SAML or OpenID Roadmap Support NSTIC provider Symantec DLP 12

13 Customer Example: SSO Across 15 Applications Customer Profile Gaming industry 50,000 internal users Heavily regulated - strict compliance requirements Scope Internal and cloud Includes mobile users 2 phased approach PHASE 1 Originally deployed with 5 apps PHASE 2 Self-integration of 10 more 13

14 Customer Example Consumer Facing Application Customer Profile Healthcare insurance provider SSO on Complex consumer web site multiple applications mixture of vendor technology More than 3 mil. users licensed Scope Simplify complex customer website Multiple applications which each require separate login Consumers use many different client platforms Mobile app on the roadmap 14

15 Customer Use Case A Single, Single Sign-on Scope Life and casualty insurer 30,000 internal users Replace 4 different SSO systems MS ADFS Tivoli Access Manager Ping Identity Homegrown system Reduce high maintenance costs Streamline and simplify Benefits Standards-based Lower costs More convenient Easier to manage 15

16 A Strategic Solution for Cloud Security Convenience Control Compliance Symantec O 3 Better experience through SSO Leverages existing identity infrastructure Manage entitlements across apps in a single place Enforces Identitybased access policy Internal, remote and mobile users No side-doors or blind spots Consolidate application logs Protect mobile data Reduce effort and lower costs for audit 16

17 Demonstration 17

18 Questions? 18

19 Thank you! Copyright 2012 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Symantec O 3 19