IBM Security Identity Governance and Intelligence Version Product Overview Topics IBM

Transcription

1 IBM Security Identity Goernance and Intelligence Version Product Oeriew Topics IBM

2

3 IBM Security Identity Goernance and Intelligence Version Product Oeriew Topics IBM

4 ii IBM Security Identity Goernance and Intelligence Version 5.2.0: Product Oeriew Topics

5 Table of contents Table list Chapter 1. Identity Goernance and Intelligence oeriew Virtual appliance oeriew Technical oeriew Features oeriew Identity Brokerage Adapters Chapter 2. What's new in Version Chapter 3. Getting started Chapter 4. Personas and use cases.. 17 Chapter 5. User interface Chapter 6. Language support Chapter 7. Known limitations, issues, and workarounds Index iii

6 i IBM Security Identity Goernance and Intelligence Version 5.2.0: Product Oeriew Topics

7 Table list 1. Data entities stored in the database serer 3 2. Data models Comparison between the Identity Brokerage Adapters and Enterprise Connectors Host edition adapters Application edition adapters Infrastructure edition adapters How to get started Virtual appliance administrator deployment tasks Virtual appliance administrator maintenance tasks Identity Goernance and Intelligence Administrator tasks Access Risk Controls Administrator tasks Process Designer Administrator tasks Access Optimizer Administrator tasks Report Designer Administrator tasks Task Planner Administrator tasks in the Administration Console Application Manager tasks in the Administration Console User Manager/Department Manager tasks in the Administration Console Role Manager tasks in the Administration Console Risk Manager tasks in the Administration Console Business users tasks in the Serice Center End User tasks in the Serice Center Identity Goernance and Intelligence consoles Administration Console modules Serice Center modules Supported languages

8 i IBM Security Identity Goernance and Intelligence Version 5.2.0: Product Oeriew Topics

9 Chapter 1. Identity Goernance and Intelligence oeriew Virtual appliance oeriew Technical oeriew IBM Security Identity Goernance and Intelligence deliers one platform for organizations to analyze, define, and control user access and access risks. This solution employs business-centric rules, actiities and processes, empowering line-of-business managers, auditors, and risk managers to goern access and ealuate regulatory compliance across enterprise applications and serices. Identity Goernance and Intelligence offers: A single identity goernance foundation platform to help organizations understand, control, and make business decisions that are related to user access and access risks. A business-actiity-based approach to facilitate communication between auditors and IT staff and to help determine segregation of duties iolations across enterprise applications, including SAP. Better isibility and user access control through consolidating access entitlements from target applications and employing sophisticated algorithms for role mining, modeling, and optimization. Access request management that deliers easier-to-implement, business-friendly, self-serice access request functions. Target integration that automates the process of data collection and fulfillment of identity and access from distributed target systems. The IBM Security Identity Goernance and Intelligence irtual appliance is an appliance-based identity goernance and administration solution. The irtual appliance includes the following features: A configuration wizard for the first time configuration of IBM Security Identity Goernance and Intelligence irtual appliance. A dashboard for iewing system status, such as disk usage, and notifications, interfaces, middleware monitor, quick links, partition information, and serer control. Analysis and diagnostics tools such as memory, CPU and storage statistics, SNMP monitoring, and troubleshooting log files. A configuration tool for managing the IBM Security Identity Goernance and Intelligence database, serice settings, and certificates. The controls for the irtual appliance settings such as updates and licensing, network settings, and system settings. The Identity Goernance and Intelligence solution consists of applications, adapters, and an external data tier. The following diagram illustrates these components. 1

10 IBM Security Identity Goernance and Intelligence Virtual Appliance WebSphere Application Serer Identity Goernance Identity Lifecyle Identity Brokerage Security Directory Integrator AIX HP LDAP Linux Solaris Adapters Database (DB2/Oracle) Directory Serer Figure 1. Identity Goernance and Intelligence components Applications Identity Goernance and Intelligence has the following application modules Identity Goernance Identity Goernance proides the core capabilities of Identity Goernance and Intelligence. Identity Lifecycle Identity Lifecycle proides the Target Administration Console capability. Identity Brokerage Identity Brokerage is a new gateway to directly integrate Identity Goernance and Intelligence with targets and hubs using IBM Security Identity Manager Adapters. These IBM Security Identity Manager Adapters are called Identity Brokerage Adapters in Identity Goernance and Intelligence. Directory integrator The Security Directory Integrator is configured with the following Identity Brokerage Adapters: 2 IBM Security Identity Goernance and Intelligence Version 5.2.0: Product Oeriew Topics

11 AIX HP LDAP Linux Solaris To install additional adapters or update the embedded adapters, the Administrator must install the adapters externally. Depending on the adapter, an external Security Directory Integrator may be required. To install and configure the supported adapters, see Installing and configuring Identity Brokerage Adapters for the general information. See the corresponding Installation and Configuration Guide for the prerequisites and other installation and configuration tasks specific to the Identity Brokerage Adapter that you want to use. Note: The PDF formats are aailable at: dociew.wss?uid=swg External data tier The irtual appliance supports an external data-tier, which consists of the database serer and the directory serer. For the supported database serer and directory serer, see Hardware and software requirements. The Identity Goernance and Intelligence data source is composed of arious data entities, which are stored in the database and directory serer. Database serer Table 1. Data entities stored in the database serer The database serer contains the following data entities. Data entities Identity Goernance and Intelligence data store Description It is inherited from the IBM Security Identity Goernance data store, but it contains other data artifacts that are used for the Identity Lifecycle module. Changes that are initiated from Identity Goernance and Intelligence or from external target systems are recorded and processed in an asynchronous manner through queues. Identity Goernance and Intelligence support backward compatibility with existing IBM Security Identity Goernance releases to support database upgrade. Identity Brokerage data store It contains data entities that are used by Identity Brokerage. Directory serer Data that is stored in the directory serer includes the target configuration and target cache. Identity Brokerage uses these data entities when processing change requests. Chapter 1. Identity Goernance and Intelligence oeriew 3

12 Data models The Identity Goernance and Intelligence database model is patterned on how the organization is structured in terms of the: Different entities that are registered in the organization Links and relationships between these entities Sets of application policies and processes that the organization uses to manage those entities Identity Goernance and Intelligence consists of a core data model and an extended data model. Table 2. Data models Data models Core data model This data model contains elements that define the organizational structure. Extended data model This data model contains elements that support the risk definition and detection layer of Identity Goernance and Intelligence. Elements Organization units Users Entitlements Resources Rights Applications Accounts Business actiities model and application permissions Risk definition and detection Segregation of Duties External SoD Risk mitigation Mitigation actions Domains Risk hierarchy Features oeriew Identity Goernance and Intelligence is an integrated identity goernance solution which offers seeral capabilities. Access goernance Identity Goernance and Intelligence proides an identity goernance infrastructure based on business requirements rather than on IT processes. Users are classified by organizational roles, group membership, job actiities, and access needs, not as indiiduals. Using the Identity Goernance and Intelligence Access Goernance Core module, you can outline the organizational structure in terms of its units, users, accounts, entitlements, resources, rights, and applications. The module aligns the IT teams, business managers, and auditors to model the company organization and operating processes. Business managers can assign and ealuate appropriate user roles and access priileges. 4 IBM Security Identity Goernance and Intelligence Version 5.2.0: Product Oeriew Topics

13 IT staff can automate the creation, modification, and termination of user access. There are audit trails and detailed reports, periodic reiew and certification of priileges, and detection and correction of non-compliant accounts. See Introduction to Access Goernance Core. Access risk assessment and management Segregation of Duties (SoD) is designed to manage conflicting relationships between certain model entities. Entities that are characterized by reciprocal conflict cannot be aggregated to the same user. Segregation of Duties iolations can reeal security ulnerabilities and cause serious damage when users hae access to highly sensitie data. The Identity Goernance and Intelligence data model identifies a Segregation of Duties iolation as a specific type of risk. Identity Goernance and Intelligence helps mitigate access risks and Segregation of Duties iolations through its Access Risk Controls module. It reduces risks by identifying iolations and preenting users from conflicting actiities. Managers and resource owners can use the information gathered to close inactie, unauthorized, and outdated accounts. There is also the option of managing an External SoD. Identity Goernance and Intelligence displays user risk information from external target systems. The Access Risk Controls module manages the risk definition and detection layer based on two relationships: The relationship between the business actiities model and the application permissions. The relationship between risks and business actiities. See Introduction to Access Risk Controls. Access certification Users' access entitlements tend to grow oer time if they are not managed. Periodic reiew preents users from acquiring accesses that are not necessary for their jobs. Regulations, such as Sarbanes-Oxley, require that companies periodically reiew all users' access rights and certify that these rights are correct. Identity Goernance and Intelligence ensures that access entitlements and rights are granted to authorized users only. It monitors and ensures that users' accesses are up-to-date and at the appropriate leels. When user access and entitlements are granted, potential Segregation of Duties iolations are identified. Identity Goernance and Intelligence uses the Access Certifier module to enable managers and resource owners to do the following tasks: Reiew, on a periodic basis, the access that their users hae on resources. Certify that the access rights are appropriate for users and applications and are still reasonable, based on policy and business needs. If there are changes to the role or access is no longer required, it is reoked. See Introduction to Access Certifier. Audit and reports Chapter 1. Identity Goernance and Intelligence oeriew 5

14 External audits ensure that the organization is current with goernment and industry regulations. Taking an internal audit of the employees, contractors, and business partners is also an essential part of securing the gateway to your organization. Proper tracking and auditing helps to gain deep insights and essential isibility into all accounts, access priileges, and entitlements across all users. Identity Goernance and Intelligence optimizes isibility into user access, priileges, and policies, which is an essential identity security capability. It consolidates access entitlements from enterprise applications in a central repository. It structures them into business roles and actiities as collectiely defined by business diisions, IT staff, and auditors. All Identity Goernance and Intelligence modules send notifications to the Audit module for large sets of operations. IT teams, business managers, and auditors can run regular reports to determine where and when users gained access and what users are doing with it. It proides documentation of who granted access to whom and when. Identity Goernance and Intelligence highlights Segregation of Duties iolations. Reports are defined through the Report Designer and Report Client modules. See Introduction to Report Designer and Introduction to Report Client. Access optimization The Identity Goernance and Intelligence uses the Access Optimizer to: Ealuate the business rules and controls and current Identity Management policies that are enforced. Reiew the accounts, access priileges, and entitlements across all users and determine inactie, unauthorized, and outdated accounts that require action. Enhance goernance and proide aluable intelligence to the organization. See Introduction to Access Optimizer. Automated identity goernance and control processes Identity Goernance and Intelligence streamlines and automates the following processes through the Administration Console and Serice Center: Access request management processes Certification and recertification processes Entitlements Management Entitlements management is concerned with maintaining the entitlements repository. Identity Goernance and Intelligence proide a means to capture, organize, and assign the accounts and other entitlements that determine the access that users hae across the enironment. Entitlements can take many forms, but they are most commonly reflected in target systems as accounts, group memberships, role assignments, and access leels. Workflow and policy management 6 IBM Security Identity Goernance and Intelligence Version 5.2.0: Product Oeriew Topics

15 Administrators can create and manage authorization policies on entitlements through the Access Goernance Core and Process Designer modules. Entitlements that require control, can be assigned with a policy that: Controls the isibility of the entitlement. Defines the conditions under which users can hae access without requiring approal. Identifies which person or group approes the access request. Self-serice features Identity Brokerage Adapters Identity Goernance and Intelligence proides a Serice Center for business users to perform access request, access certification, access analytics and reporting. Serice Center has a shopping cart for access request. Self-serice features help make access-related tasks more accurate, appropriate, and secure. First-time users can submit a request without further assistance. Identity Goernance and Intelligence proides two methods of integration with target systems, using Identity Brokerage Adapters and Enterprise Connectors. Identity Brokerage is a new gateway to directly integrate Identity Goernance and Intelligence with targets and hubs using IBM Security Identity Manager Adapters. These IBM Security Identity Manager Adapters are called Identity Brokerage Adapters in Identity Goernance and Intelligence. Identity Brokerage Adapters enable communication between Identity Goernance and Intelligence and the target systems. These adapters implement identity proisioning and target reconciliation. Comparison summary The following table summarizes the similarities and differences between the Identity Brokerage Adapters and Enterprise Connectors. Important: Use the Identity Brokerage Adapters instead of the Enterprise Connectors except when you want to retriee human resources (HR) data. HR data is only aailable through Enterprise Connectors. Table 3. Comparison between the Identity Brokerage Adapters and Enterprise Connectors Compare Identity Brokerage Adapters Enterprise Connectors Framework Identity Brokerage Enterprise Connector Framework Target integration Identity Administration Points (IAP) Identity Administration Points (IAP) Repository User interface Identity cache and metadata that is stored in LDAP 3 store Administration Console > Target Administration Console Cache Administration Console > Enterprise Connectors Chapter 1. Identity Goernance and Intelligence oeriew 7

16 Table 3. Comparison between the Identity Brokerage Adapters and Enterprise Connectors (continued) Compare Identity Brokerage Adapters Enterprise Connectors Custom integration Its framework can be used to deelop a custom adapter to integrate with target systems that are currently not supported by Identity Goernance and Intelligence. The Identity Brokerage Adapters framework proides out-of-the-box functionality for all adapters that are deployed within the Identity Brokerage. See the Identity Brokerage Adapters Deelopment and Customization Guide at dociew.wss?uid=swg , for information about adapter customization. Its framework can be used to deelop a custom connector but it is adised that you use the Identity Brokerage Adapters framework instead to integrate with target systems that are currently not supported by Identity Goernance and Intelligence. List of Identity Brokerage Adapters This section lists the supported Identity Brokerage Adapters and links to their corresponding Installation and Configuration Guide in the Knowledge Center. The PDF formats of these publications are aailable at: support/dociew.wss?uid=swg Note: Table 4. Host edition adapters Adapters The following information are accurate at the time of publication. Alternatiely, you can refer to the Adapters technote at dociew.wss?uid=swg The technote is constantly updated to include the latest inentory of adapters that are released; their ersion, release date, download part numbers, and release notes. To install and configure the supported adapters: 1. See Installing and configuring Identity Brokerage Adapters for the general information. 2. See the corresponding product documentation for the prerequisites, other installation and configuration tasks, and issues and limitations specific to the Identity Brokerage Adapter that you want to use. 3. See the Adapters release notes for any updates to these references. Supported in Identity Goernance and Intelligence Product documentation CA ACF2 Yes CA ACF2 Security for z/os Adapter CA TopSecret No CA Top Secret for z/os Adapter iseries (i5os) Yes IBM i Adapter Installation and Configuration Guide Password Sync Plug-in for iseries No IBM i Password Synchronization Plug-in Installation and Configuration Guide RACF No RACF Security for z/os Adapter 8 IBM Security Identity Goernance and Intelligence Version 5.2.0: Product Oeriew Topics

17 Table 4. Host edition adapters (continued) Adapters Supported in Identity Goernance and Intelligence Product documentation zsecure RACF Yes zsecure RACF Installation and Configuration Guide Table 5. Application edition adapters Adapters Supported in Identity Goernance and Intelligence Product documentation Box Cloud Yes Box Adapter Installation and Configuration Guide Documentum Content Serer Yes Documentum Adapter Installation and Configuration Guide Google Applications Yes Google Apps Adapter Installation and Configuration Guide Mircosoft Office 365 Yes Office 365 Adapter Installation and Configuration Guide Oracle ebusiness Suite No Oracle ebs Adapter Installation and Configuration Guide PeopleTools Yes PeopleTools Adapter Installation and Configuration Guide Remedy AR System Yes Remedy AR System Adapter Installation and Configuration Guide Salesforce.com Yes Salesforce.com Adapter Installation and Configuration Guide SAP HANA Database Yes SAP HANA Database Adapter Installation and Configuration Guide SAP NetWeaer Yes Directory Integrator-based Adapter for SAP NetWeaer Adapter Installation and Configuration Guide SAP Sybase DB Yes Sybase Adapter Installation and Configuration Guide SAP UME (Portal) No Directory Integrator-based Adapter for SAP User Management Engine Adapter Installation and Configuration Guide SericeNow Yes SericeNow Adapter Installation and Configuration Guide SharePoint Yes Microsoft SharePoint Adapter Installation and Configuration Guide Siebel Yes Siebel JDB Adapter Installation and Configuration Guide Table 6. Infrastructure edition adapters Adapters Supported in Identity Goernance and Intelligence Product documentation Azure Actie Directory Yes Azure Actie Directory Adapter Installation and Configuration Guide Blackberry Enterprise Serer No BlackBerry Enterprise Serer Adapter Installation and Configuration Guide Chapter 1. Identity Goernance and Intelligence oeriew 9

18 Table 6. Infrastructure edition adapters (continued) Adapters Cisco Unified Communications Manager Supported in Identity Goernance and Intelligence No Product documentation Cisco Unified Communications Manager Adapter Installation and Configuration Guide Command Line Yes CLIx Adapter Installation and Configuration Guide Desktop Password Reset Assistant (DPRA) No Desktop Password Reset Assistant Installation and Configuration Guide Groupwise (Windows only) No GroupWise Adapter Installation and Configuration Guide IBM DB2 Yes IBM DB2 Adapter Installation and Configuration Guide IBM Security Access Manager (ISAM) Yes IBM Security Access Manager Adapter Installation and Configuration Guide IBM Security Access Manager for Enterprise Single Sign-On (ISAM ESSO) No IBM Security Access Manager Enterprise Single Sign-On Adapter Installation and Configuration Guide IBM Priileged Identity Manager No IBM Security Priileged Identity Manager Adapter Installation and Configuration Guide LDAP Yes LDAP Adapter Installation and Configuration Guide Linux Yes UNIX and Linux Adapter Installation and Configuration Guide Lotus Notes (Windows only) Yes Lotus Notes Adapter Installation and Configuration Guide Noell NDS (Windows only) No Noell Directory Serices Adapter Installation and Configuration Guide Oracle Database Yes Oracle Database Adapter Installation and Configuration Guide Password Sync Plug-in for ISAM No Password Synchronization Plug-in for IBM Security Access Manager 7.0 Installation and Configuration Guide Password Sync Plug-in for WinAD 64-bit No Password Synchronization for Actie Directory Plug-in Installation and Configuration Guide RSA Authentication Manager Yes RSA Authentication Manager Adapter Installation and Configuration Guide SAP Sybase DB Yes Sybase Adapter Installation and Configuration Guide SoftLayer Yes SoftLayer Adapter Installation and Configuration Guide SQL Serer (Windows only) Yes SQL Serer Adapter Installation and Configuration Guide Unix/Linux (AIX) Yes UNIX and Linux Adapter Installation and Configuration Guide 10 IBM Security Identity Goernance and Intelligence Version 5.2.0: Product Oeriew Topics

19 Table 6. Infrastructure edition adapters (continued) Adapters Supported in Identity Goernance and Intelligence Product documentation Unix/Linux (HP-UX) Yes UNIX and Linux Adapter Installation and Configuration Guide Unix/Linux (Solaris) Yes UNIX and Linux Adapter Installation and Configuration Guide Windows Actie Directory 64-bit Yes Actie Directory Adapter Installation and Configuration Guide Windows Local Account Yes Windows Local Account Adapter Installation and Configuration Guide Chapter 1. Identity Goernance and Intelligence oeriew 11

20 12 IBM Security Identity Goernance and Intelligence Version 5.2.0: Product Oeriew Topics

21 Chapter 2. What's new in Version 5.2 IBM Security Identity Goernance and Intelligence Version 5.2, is focused on enhancements related to target integration and integration with external systems. The product was preiously known as IBM Security Identity Goernance. Enhanced target integration Target integration automates the process of collecting data from distributed target systems and reflects changes that are initiated from Identity Goernance and Intelligence in these target systems. Target systems are user repositories that contain user account information. Target integration is enhanced to: Proide a new gateway to directly integrate with targets and hubs by using common adapters. Add support for complex application entitlement structure through external roles. Add support for zsecure-racf integration by using a new target integration framework and external roles. Target Administration Console A new module is added to the Administration Console for Administrators to perform target administration, including: Related topics: Import target profile. Import account attributes mapping. Configure account defaults for target profile. Search, add, modify, and delete targets. Manage reconciliation. Set up account defaults for a target. Identity Brokerage Adapters on page 7 Target type administration Target administration Reconciliation management Enhanced Access Requests The key enhancements that affect Access Requests are: New sources and types of entitlement data. Fulfillment of targets that are enabled through enhanced target integration. Integration with external applications through the following: External access request authorization The product proides RESTful APIs to support access authorization through external applications such as Serice Now. The product can also use field deeloped extensions to perform access request authorization. 13

22 The Process Designer and Access Requests modules hae been enhanced to support an external application to authorize user access change requests. This external authorization application can immediately accept or reject the request or temporarily put the request in the authorization-pending state. This capability will allow for integration with arious Serice Desk applications. Learn more... External Segregation of Duties alidation The product proides RESTful APIs to support Segregation of Duties through an external application such as SAP GRC. The product can also use field deeloped extensions to perform Segregation of Duties alidation. With an external Segregation of Duties engine, Identity Goernance and Intelligence can display the possible risks for a user based on a user's current permissions assignment from external target systems. Learn more... External roles An external role is a data artifact for modeling roles in target systems. External roles can be loaded into Identity Goernance and Intelligence system by using a bulk load tool or the Identity Brokerage Adapters. Identity Goernance and Intelligence also supports a complex structure of the external role in target systems. The external role can be associated with other external roles or permissions of same or different applications. An external role can be: Assigned to users. Inoled in a segregation of duties alidation. Added as child of other roles. Learn more... Integration between IBM Security Identity Goernance and Intelligence and IBM Security Identity Manager A connector is proided to allow access to IBM Security Identity Goernance and Intelligence from IBM Security Identity Manager. The connector must be installed and configured separately. For instructions and further documentation, see Integration between IBM Security Identity Manager and IBM Security Identity Goernance at Note: This technote has been reised for ersion of the connector. 14 IBM Security Identity Goernance and Intelligence Version 5.2.0: Product Oeriew Topics

23 Chapter 3. Getting started Table 7. How to get started Task Before you deploy or use the product, you must complete the prerequisites and become familiar with product features to aoid issues. The following table lists the main tasks to get started, including the corresponding reference topics or guides for each task. Reference Check what's new in this release. Chapter 2, What's new in Version 5.2, on page 13 Learn about the different components, personas, and user interfaces. Check the hardware and software requirements. Deploy the product. Use the product functions. If you encounter an issue, check the existing limitations and issues. Chapter 1, Identity Goernance and Intelligence oeriew, on page 1 Chapter 4, Personas and use cases, on page 17 Chapter 5, User interface, on page 27 Hardware and software requirements in the Installing Guide Deployment oeriew in the Installing Guide Administering Guide Chapter 7, Known limitations, issues, and workarounds, on page 33 Troubleshooting and support Guide 15

24 16 IBM Security Identity Goernance and Intelligence Version 5.2.0: Product Oeriew Topics

25 Chapter 4. Personas and use cases Different personas deploy and use Identity Goernance and Intelligence. Each persona is responsible for a set of tasks or has priileges for specific workflows. The main personas are: Persona: Virtual appliance administrator Persona: Identity Goernance and Intelligence Administrator on page 19 Persona: Identity Goernance and Intelligence Business users on page 24 Administrators Business users An Administrator can access the Administration Console and define Administrator users as: An Administrator of a single module or of all the Identity Goernance and Intelligence modules. Authorized to perform a selected set of tasks on module A, B, and others. Examples of other Administrator personas based on modules: Persona: Access Risk Controls Administrator on page 20 Persona: Process Designer Administrator on page 21 Persona: Access Optimizer Administrator on page 21 Persona: Report Designer Administrator on page 21 Persona: Task Planner Administrator on page 22 Examples of other Administrator personas that can be defined and used in the system: Persona: Application Manager on page 22 Persona: User Manager/Department Manager on page 23 Persona: Role Manager on page 23 Persona: Risk Manager on page 24 Business users are defined in the Regular Users schema and can perform tasks in the Serice Center. Examples of business user personas: Persona: Application Manager Persona: User Manager/Department Manager Persona: Role Manager Persona: Risk Manager Persona: End User on page 25 Persona: Virtual appliance administrator The Virtual appliance administrator is responsible for the setup and actiation of the Identity Goernance and Intelligence irtual appliance and for its day-to-day administration. The following table lists these tasks. 17

26 Table 8. Virtual appliance administrator deployment tasks Tasks Subtasks and references Install and configure the database serer. For Oracle: Prepare the irtual machine. Installing the Oracle serer Configuring the Oracle serer For DB2 : Installing the DB2 serer Configuring the DB2 serer Setting up the irtual machine Install and set up the irtual appliance. Installing the IBM Security Identity Goernance and Intelligence irtual appliance Configure the application interfaces, mail serer, and data store. Setting up the initial irtual appliance Managing application interfaces Managing the mail serer configuration Managing the database serer configuration Set up irtual appliance cluster. Setting up a irtual appliance cluster Configuring IBM Security Identity Goernance and Intelligence by using the initial configuration wizard Table 9. Virtual appliance administrator maintenance tasks Tasks Prepare for disaster recoery. Set up a secondary irtual appliance for an actie-passie configuration. Monitor the irtual appliance eent logs, memory, CPU, disk space, and SNMP monitoring. Subtasks and references 1. Setting up a primary irtual appliance 2. Backing up the irtual appliance 3. Reerting the irtual appliance to its backup 4. Creating a snapshot of the irtual appliance 5. Setting up a secondary irtual appliance Viewing the eent logs Viewing the memory utilization Viewing the CPU utilization Viewing the storage utilization Managing the SNMP monitoring Manage the irtual appliance serer settings. Managing the lifecycle configuration Manage the irtual appliance update history, firmware, fix packs, and licenses. Manage the irtual appliance logs, core dump files, and build information. Managing the database serer configuration Managing the mail serer configuration Managing custom files Managing certificates Managing the firmware settings Viewing the update history Installing a fix pack Managing the log configuration Managing the core dump files Viewing the About page information 18 IBM Security Identity Goernance and Intelligence Version 5.2.0: Product Oeriew Topics

27 Table 9. Virtual appliance administrator maintenance tasks (continued) Tasks Subtasks and references Manage the irtual appliance network settings. Managing application interfaces Managing hosts file Configuring static routes Exporting or importing the configuration settings Manage the irtual appliance system settings. Viewing the update history Manage the irtual appliance by using the command line interface. Configuring the date and time settings Configuring the administrator settings Managing the snapshots Managing the support files Configuring system audit eents Restarting or shutting down Management SSL certificate Adding a JVM property Tailing logs and archiing logs Enabling trace for the irtual appliance serices Cleaning core dump files Persona: Identity Goernance and Intelligence Administrator The Identity Goernance and Intelligence Administrator is created during the Access Goernance Core installation along with the creation of the Administration schema. This super administrator is responsible for defining other Administrator profiles using a free configuration of 34 permissions, a combination of Business Roles and IT Roles. Table 10. Identity Goernance and Intelligence Administrator tasks Tasks Subtasks and references For target integration, configure the target system. Import the target type, also known as the adapter profile. See Importing target types (adapter profiles). Create an instance of the target from the target type. Specify the target identity and other information to connect to the serer where the target resides. See Creating targets. Configure the initial entities. Create realms. See Concept of Realm and Managing the Administration Realm. Create resources. See Resources. Create entitlements. See Hierarchy of entitlements. Create applications. See Applications. Create accounts. See Accounts. Configure organizational units. Create organization units. See Organization units. Assign the organization unit to an entitlement. See Org Units. Assign resources to an organization unit. See Group Resources. Chapter 4. Personas and use cases 19

28 Table 10. Identity Goernance and Intelligence Administrator tasks (continued) Tasks Subtasks and references Configure groups. Create groups. See Groups. Assign entitlements to the group. See Entitlements. Assign resources to the group. See Group Resources. Configure roles. Create and publish roles. See Roles. Define the entitlements and dependencies. See Management and Dependencies. On-board Administrators. 1. Create the Administrator role. See Admin Roles. On-board users. For example, a new employee UserA, joined the organization. Add entitlements to the on-boarded user, such as an external role. For example, assign UserA with the external role Senior Deeloper on the Data Manager application. 2. Assign organization units to the Administrator role. See Org Units. 3. Assign users to the Administrator role. See Users. 1. Create the user profile. See Users. 2. Assign user to a role. See Users. 3. Assign an entitlement to the user. See Entitlements. 4. Assign resources to the user. See User Resources. 5. Create and manage the account for the registered user. See Accounts. 6. Assign rights. See Rights. 7. Set a mitigation action if the user is assigned with a risk leel. See Mitigations. 1. View the permissions that are defined for the application. Search for the external role you want to assign. Check whether the external role configuration is set for user assignment on the target system. See Application Permissions. 2. Add the entitlement. Assign the external role to the on-boarded user. See Entitlements. 3. Check whether the assignment eent Add Permission is generated for the external role. See Eents. Enable a custom Segregation of Duties policy. 1. Enable the external Segregation of Duties feature. 2. Set up the external serice, which can be a REST WEB Serice or an implementation of a JAVA interface. Define a certification campaign and data sets. See General. See Certification Campaigns and Certification data sets. Persona: Access Risk Controls Administrator Administrators, who are granted access to the Access Risk Controls module, can perform the following tasks: Table 11. Access Risk Controls Administrator tasks Tasks Model a business actiity tree structure. Associate the permissions to one or more actiities. Subtasks and references Business actiities Tech transformation 20 IBM Security Identity Goernance and Intelligence Version 5.2.0: Product Oeriew Topics

29 Table 11. Access Risk Controls Administrator tasks (continued) Tasks Subtasks and references Set mitigation controls. Mitigation controls Define risks. Risk definition Define domains. Domains Ealuate risk iolations. Risk iolations Compare configurations. Configuration comparison Request or download report. Report Persona: Process Designer Administrator Administrators, who are granted access to the Process Designer module, can perform the following tasks: Table 12. Process Designer Administrator tasks Tasks Define actiities that can be associated to a process. Design a process. Assign one or more administratie roles to each actiity defined in the process. Subtasks and references Actiity Process Assign Persona: Access Optimizer Administrator Administrators, who are granted access to the Access Optimizer module, can perform the following tasks: Table 13. Access Optimizer Administrator tasks Tasks Configure and compare data snapshots. Define access data sets. Configure risk criteria. Create and manage a data exploration analysis. Create a role mining request. Subtasks and references Data snapshot Access data sets Risk criteria Data Exploration analysis and details Role mining Persona: Report Designer Administrator Administrators, who are granted access to the Report Designer module, can perform the following tasks: Table 14. Report Designer Administrator tasks Tasks Create and customize report queries. Create and customize product reports. Assign the product report to a user or an application role (IT role or Business role). Organize the product reports. Subtasks and references Query Report Report assignment Menu Chapter 4. Personas and use cases 21

30 Persona: Task Planner Administrator Administrators, who are granted access to the Task Planner module, can perform the following tasks: Table 15. Task Planner Administrator tasks in the Administration Console Tasks Add jobs and configure job class attributes. Create and configure tasks, define job class parameters, and configure scheduling. Synchronize tasks to the selected scheduler. Group tasks by context. Subtasks and references Jobs Tasks Scheduler Context Persona: Application Manager The Application Manager can perform any of the following tasks in the Administration Console. Table 16. Application Manager tasks in the Administration Console Tasks Subtasks and references For target integration, configure the target system. Import the target type, also known as the adapter profile. See Importing target types (adapter profiles). On-board users. For example, a new employee UserA, joined the organization. Add entitlements to the on-boarded user, such as an external role. For example, assign UserA with the external role Senior Deeloper on the Data Manager application. Create an instance of the target from the target type. Specify the target identity and other information to connect to the serer where the target resides. See Creating targets. 1. Create the user profile. See Users. 2. Assign user to a role. See Users. 3. Assign an entitlement to the user. See Entitlements. 4. Assign resources to the user. See User Resources. 5. Create and manage the account for the registered user. See Accounts. 6. Assign rights. See Rights. 7. Set a mitigation action if the user is assigned with a risk leel. See Mitigations. 1. View the permissions that are defined for the application. Search for the external role you want to assign. Check whether the external role configuration is set for user assignment on the target system. See Application Permissions. 2. Add the entitlement. Assign the external role to the on-boarded user. See Entitlements. 3. Check whether the assignment eent Add Permission is generated for the external role. See Eents. 22 IBM Security Identity Goernance and Intelligence Version 5.2.0: Product Oeriew Topics

31 Table 16. Application Manager tasks in the Administration Console (continued) Tasks Subtasks and references Enable a custom Segregation of Duties policy. 1. Enable the external Segregation of Duties feature. 2. Set up the external serice, which can be a REST WEB Serice or an implementation of a JAVA interface. See General. Persona: User Manager/Department Manager The User Manager/Department Manager can perform any of the following tasks in the Administration Console. Table 17. User Manager/Department Manager tasks in the Administration Console Tasks On-board users. For example, a new employee UserA, joined the organization. Add entitlements to the on-boarded user, such as an external role. For example, assign UserA with the external role Senior Deeloper on the Data Manager application. Subtasks and references 1. Create the user profile. See Users. 2. Assign user to a role. See Users. 3. Assign an entitlement to the user. See Entitlements. 4. Assign resources to the user. See User Resources. 5. Create and manage the account for the registered user. See Accounts. 6. Assign rights. See Rights. 7. Set a mitigation action if the user is assigned with a risk leel. See Mitigations. 1. View the permissions that are defined for the application. Search for the external role you want to assign. Check whether the external role configuration is set for user assignment on the target system. See Application Permissions. 2. Add the entitlement. Assign the external role to the on-boarded user. See Entitlements. 3. Check whether the assignment eent Add Permission is generated for the external role. See Eents. Enable a custom Segregation of Duties policy. 1. Enable the external Segregation of Duties feature. 2. Set up the external serice, which can be a REST WEB Serice or an implementation of a JAVA interface. See General. Persona: Role Manager The Role Manager can perform any of the following tasks in the Administration Console, including the tasks of a Process Designer Administrator. Chapter 4. Personas and use cases 23

32 Table 18. Role Manager tasks in the Administration Console Tasks Subtasks and references Configure roles. Create and publish roles. See Roles. On-board users. For example, a new employee UserA, joined the organization. Define the entitlements and dependencies. See Management and Dependencies. 1. Create the user profile. See Users. 2. Assign user to a role. See Users. 3. Assign an entitlement to the user. See Entitlements. 4. Assign resources to the user. See User Resources. 5. Create and manage the account for the registered user. See Accounts. 6. Assign rights. See Rights. 7. Set a mitigation action if the user is assigned with a risk leel. See Mitigations. Persona: Risk Manager The Risk Manager can perform any of the following tasks in the Administration Console, including the tasks of an Access Risk Controls Administrator. Table 19. Risk Manager tasks in the Administration Console Tasks Add entitlements to the on-boarded user, such as an external role. For example, assign UserA with the external role Senior Deeloper on the Data Manager application. Subtasks and references 1. View the permissions that are defined for the application. Search for the external role you want to assign. Check whether the external role configuration is set for user assignment on the target system. See Application Permissions. 2. Add the entitlement. Assign the external role to the on-boarded user. See Entitlements. 3. Check whether the assignment eent Add Permission is generated for the external role. See Eents. Enable a custom Segregation of Duties policy. 1. Enable the external Segregation of Duties feature. 2. Set up the external serice, which can be a REST WEB Serice or an implementation of a JAVA interface. See General. Persona: Identity Goernance and Intelligence Business users Business users can perform any of the following tasks in the Serice Center. Table 20. Business users tasks in the Serice Center Tasks Approe or reoke campaign requests. Manage access requests. Subtasks and references Campaign Management AR functions Map permissions and actiities. Permission Perspectie Actiity Perspectie 24 IBM Security Identity Goernance and Intelligence Version 5.2.0: Product Oeriew Topics

33 Table 20. Business users tasks in the Serice Center (continued) Tasks Subtasks and references Configure, run, and download the report. Request Download Persona: End User End users can request access to resources such as accounts, roles, and entitlements in the Serice Center. Table 21. End User tasks in the Serice Center Tasks Request access. Subtasks and references ACCOUNT CHANGE GEN and Account Update: Accounts Chapter 4. Personas and use cases 25

34 26 IBM Security Identity Goernance and Intelligence Version 5.2.0: Product Oeriew Topics

35 Chapter 5. User interface The Identity Goernance and Intelligence solution has a web console for irtual appliance management and web consoles for identity goernance and administration. It proides persona-based dashboards for the different types of users and supports single-sign on. Table 22. Identity Goernance and Intelligence consoles Interface Virtual Appliance Dashboard Administration Console Serice Center Description Virtual appliance administrators can monitor, configure, and maintain: Different components of the irtual appliance such as CPU, memory, storage. Installed applications such as WebSphere Application Serer and Security Directory Integrator. The irtual appliance' connectiity to an external data source. Administrators can perform all administration tasks for Identity Goernance and Intelligence. They can: Manage access, risk controls, and role administration. Manage tasks, schedules, dependencies, and performance. Manage enterprise connectors, and target systems. Define reports, their layout, localization, and users isibility restrictions. Analyze trends, users, and roles. Non-administrator users, such as End users and Business users like User Managers, Application Managers, Role Managers or Risk Managers, can perform any of these tasks, where applicable. Request, change, or delete user or other users access, depending on the persona. View, authorize, or delegate requests, depending on the persona. Certify access. Run or schedule reports. View user or team access status, or the team risk score. Administration Console modules The Administration Console consists of the following Identity Goernance and Intelligence modules. 27

36 Table 23. Administration Console modules Administration Console modules Access Goernance Core Description It is the central module and is dedicated to the implementation of the authorization processes. Access Goernance Core manages users, roles, accounts, applications, rules and eents, and campaign configurations. It proides a modeler for outlining the organization's current situation. Access Risk Controls See Introduction to Access Goernance Core. It helps manage business actiities, business actiity mappings, and related risks. It helps determine users and roles that hae Segregation of Duties iolations. Access Risk Controls enforces Segregation of Duties checks by relating the business actiities model and application permissions. It uses the concept of at-risk actiities and proides the tools necessary to link actiities to entitlements or permissions. The assessment of the risk leel of actiities can be translated into the risk leel of entitlements or permissions that are assigned to users inoled in those actiities. Access Risk Controls for SAP Process Designer See Introduction to Access Risk Controls. It extends the capabilities of Access Risk Controls to the authorization framework of SAP systems. It enables the implementation of an Segregation of Duties analysis based on the SAP system transactions. See Introduction to Access Risk Controls for SAP. It is a tool that is used by system integrators or administrators for designing and defining the authorization processes. It produces the Access Requests authorization workflows. Process Designer proides a modeler for outlining the access request and approal process and for integrating other external target systems. It works with the Access Goernance Core module to manage: Requests to access the system application. Allocation and reocation of authorization profiles. Password lifecycle. Notifications that are sent to users during different phases of the authorization process. Temporary delegations of personal roles that are associated with users of the system. Definition of the isibility range that is associated with an administratie figure. See Introduction to Process Designer. 28 IBM Security Identity Goernance and Intelligence Version 5.2.0: Product Oeriew Topics