SafeNet Authentication Service for Your Business Introducing Strong Authentication as-a-service. Marko Bobinac PreSales Engineer CEE, Russia & CIS

Transcription

1 SafeNet Authentication Service for Your Business Introducing Strong Authentication as-a-service Marko Bobinac PreSales Engineer CEE, Russia & CIS

2 Agenda SafeNet introduction Introduction to Authentication as a Service SafeNet Authentication Service Service architecture Key features Additional features Summary and Benefits Next steps 2

3 Introduction to SafeNet Authentication Service for Your Business Insert Your Name Insert Your Title Insert Date

4 2012 Authentication News March 2012: SafeNet Acquires Cryptocard January 2012 : Gartner s Magic Quadrant for User Authentication 4

5 Gartner Magic Quadrant for User Authentication 2012 Gartner predicts that, by 2017, more than 50% of enterprises will choose cloud-based services as the delivery option for new or refreshed user authentication implementations, up from less than 10% today. 5

6 Market Trends Automation and ease of administration are the biggest desires for Authentication Figure 2: Cost Of System Administration Is The Greatest Challenge Enterprises Face What challenges does your organization face with its current customer authentication process? Together with flexibility and further cost reduction Thinking about authentication-as-a-service, what are some of the benefits that you could foresee for your organization? Cost of administering the authentication system Cost of Deploying additional authentication factors Frequency of password resets, replacing OTP generators 41% 40% 48% Improved technical flexibility Improved scalability Reduced cost for providing additional authentication factors Reduced costs of adding strong authentication to new Web-based services 51% 46% 44% 42% Source:- Forrester. March 20, Authentication-As A-Service 6

7 How 2FA works WebPortals Online banking Domain logon, VDI VPN, SSL VPN RADIUS, SAML, API, SafeNet agents SafeNet Confidential and Proprietary 7

8 SafeNet Authentication Service SafeNet Authentication Service delivers fully automated strong Authentication-as-a-Service from the cloud With no infrastructure required, SafeNet Authentication Service Protects everything SaaS, apps, networks Protects everyone multiple token options Choose from a leading range of Software, SMS, Hardware and Grid tokens Benefit from simple service delivery and reduced overheads through Automation of everything: provisioning, reporting, self service Security policy engine and templates Total flexibility to customize everything: tokens, processes, policies 8

9 as a Service benefits Cost Reduction, Simplicity and Flexibility A full virtual enterprise authentication server available from the cloud ready to go in minutes and available 24*7 A powerful management portal which allows you to automate everything Highly secure infrastructure and service delivery Per user per year OPEX pricing 9

10 10 It s about Total Cost of OPERATION

11 Why is SAS Total Cost of Operation lower? Simple all-inclusive pricing with no extra costs for agents, replica servers 11 Huge range of non-expiring physical tokens and re-assignable software and SMS tokens reduce token costs Integration into existing user stores such as LDAP and automation of management tasks reduces management time by 90% User self-service that removes the need for help desks to fix most common user issues Rule driven management system

12 Core Components Overview Subscriber Companies User Authentication Service Provider Tokens & Users SafeNet Confidential and Proprietary 12

13 Introduction - Protect Everything: Networks, Applications and Cloud Services Tokens & Users Cloud Applications Private Networks Corporate Network API LDAP / Active Directory SAML RADIUS Corporate Network LDAP / Active Directory Agent Cloud Services SAML SAML Corporate Network LDAP / Active Directory Applicatio n Hosting Corporate Network Online Storage Administrator LDAP / Active Directory Disaster Recovery 13

14 Introduction - Widest Choice of Tokens, including Tokenless & 3rd Party Authenticators for every user type and an increasing focus on commoditization Multi Platform H/W BlackBerry ios OSx Android Microsoft Microsoft SMS Java USB Grid Authenticators that: Don t expire Seed keys can be owned by the subscriber Can be easily re-assigned to new users Easy deployment saves cost and time A token can be included in the service charge

15 Introduction - Automate everywhere SafeNet Authentication Service automates everything, reducing management time, the main cost of a strong authentication solution User Synchronisation Security Policy Application Token Provisioning Self Enrollment SAML Service Registration Alerts Reporting 15

16 Introduction - Migrate Easily and Protect Current Investment in Tokens Continue to use your existing tokens Protect your investment Eliminate user disruption Replace on expiry Import existing tokens into SafeNet Authentication Service (uses your existing infrastructure to authenticate) Get a single view of all users and authentication activity Use the comprehensive reporting across all tokens Automate the deployment of replacement tokens prior to expiry of your existing tokens Zero effort and zero-touch migration of all users without administrator intervention Secure and easy self-enrolment 16

17 Introduction Save Money and Resources Reduces help desk load massively via self-healing tokens and user self-service Cut management time by 90% via integration with existing user directories and automation of all management and reporting tasks Simple, low per-user per year pricing model with no hidden or extra costs No infrastructure costs, no maintenance costs Huge range of non-expiring physical tokens and re-assignable software and SMS tokens reduce tokens costs substantially 17

18 Insert Your Name Insert Your Title Insert Date

19 Up and running in Minutes Your Company Administrator Applications Active Directory Access Device 4 Step Step 1 2 Select Service Provider Create Your Account Step 3 Set-up Administrator Step 4 Configure Access Device(s) Step 5 Link User Directory Step 6 Provision Tokens 6 Step 7 Users self-enrol 7 Your Provider Tokens & Users 1 19

20 SafeNet Authentication Service Architecture SafeNet Authentication Service SafeNet Authentication Service User Repository Portals Service Provider Subscriber User Self-Service Self-Enrolment North America DataCenter EMEA DataCenter Agents LDAP Synch Migration Solutions Token Repository Engines Security Policy Authentication Provisioning Reporting/Alerts SMS via HTTP(S) via SMTP Internet SMS Service Provider (Subscriber or SP selected) SMS message Virtual Server Management & Admin Reports & Alerts User service requests User information Authentication Request Radius Authentication Request SAML Authentication Request Agent Administrator Tokens Users User Repository Agents Access Devices 20

21 Strong Authentication Made Easy Automation Reporting Security Customization and Branding Multiple Business Unit Entities, Groups & Containers Operator Role and Scope Corporate Integration APIs 21

22 Automation SafeNet Authentication Service automates everything, reducing management time, the main cost of a strong authentication solution 1. User Synchronisation 2. Security Policy Application 3. Token Provisioning 4. Self Enrolment 5. SAML Service Registration 6. Alerts 7. Reporting 22

23 User Directory Sources 1. User Synchronisation Supporting any user store SQL, LDAP, AD,ODBC, Lotus, Novell, anything (via custom field mapping) Zero schema change Read only Non intrusive Full customisation Multiple domains No hardware required Secure In Addition users can be bulk imported eg via.csv files and / or created locally 23

24 LDAP Changes 1. User Synchronisation Automatic updates of LDAP changes User Changes Directory Server LDAP Agent Users Access Device or Application Groups LDAP Rules Authentication Self Enrollment 24

25 Token policies and your security 2. Security Policy Application Ability to set token Policies Pre-configured to best practice for optimal security Reconfigurable to match your policy Multiple options can be re-defined PIN length and complexity OTP length and complexity Try attempts Forced PIN change Portal shows details of EVERY individual token Initialisation of tokens Software/SMS tokens initialised at point of deployment Hardware tokens can also be initialised

26 Provisioning rules 3. Token Provisioning Rules Engines for auto-provisioning & authorization Powerful and flexible auto-provisioning Token allocation, suspension and de-allocation and more Auto registration for SAML services Central administration of rules that are automatically applied to users based on their group membership All token management can be done via group membership in LDAP Changes in LDAP initiate the provisioning process without any admin intervention Access/authorization is controlled by the real-time application of another rules engine and authentication is allowed or denied based on criteria such as Access point LDAP attributes (group membership or time of day) 26

27 Provisioning rules 3. Token Provisioning 27

28 Simple Enrollment process 4. Self enrolment Customisable messages Fully automated with auto-provisioning Alerts highlight incomplete enrolments OR Automated self-enrolment for all tokens 28

29 Optional Enrollment workflows 4. Self enrolment Request Approval Level 1 Status Updates Approval Level 2 (Optional) Standard Self-Enrollment (O Issuing Authority Requires OOB during Self-enrollment Shipping Authority 29

30 Pro-active management 5. Alerts Pro-active alerts System, deployment and user events Capacity or SMS credits are running low Users who have not enrolled Provisioning Internal or external delivery SMS or based 30

31 Reports delivered to you 6. Reporting Reports can be scheduled Time-of-Day / Day-of-Week Cyclic repeat for regular reports based delivery or via portal access to both internal or external recipients Fully automated delivery Output in html, csv, tab, xml Delivery via FTP, SFTP, SCP 31

32 Comprehensive Possibilities 6. Reporting Over 35 administration reports including Inventory management Progress reports Estate management User management Reports are grouped for instant access Security policy Compliance Billing Inventory Additional reporting suite available for managing multiple domain based networks 32

33 Complete flexibility Extensive customization options Time/date based parameters Specific user/token selection Include/exclude fields Export capability All authentication and operator activities are captured Logs can be viewed internally or exported 33

34 Security - Control and peace of mind Unique policy engine allows centralized control of security posture Latest encryption algorithms used to generate passcodes, to encrypt user data and to protect all communication between different components Operational role segregation and delegated management Highly secure infrastructure housed in tier-4 data centres with appropriate certification such as ISO27001 and PCI 34

35 Multiple Business Unit entities, Groups & Containers Support multiple business units Main Company USA EMEA APAC R&D Operations Sales R&D Sales Administration R&D Operations 35

36 Multiple Business Unit entities, Groups & Containers Support multiple business units Gain power and flexibility to support Delegated administration and localization within business units or departments Local and centralized user directories Local and central authentication points: VPNs, applications and network devices Organizations lower in the hierarchy can inherit policies and settings Avoid multiple instances of authentication servers 36

37 Multiple Business Unit entities, Groups & Containers Groups and containers Groups of users allow actions or policy application to be applied to multiple users Pre-auth based on security groups Auto-Provision / revoke based on security groups Internal and/or AD/LDAP groups RADIUS attributes either by user or group Containers allow groups of people to see and manage users and tokens, enabling devolved management and separation of administrator functions Independent containers hold objects (users, tokens or both) Objects exist in only 1 container Segregated management ( containers: administrators) 37

38 Your Administration Portal For multi-domain management: Dashboard: Service Status. On Boarding: Business functions for all subscribers Virtual Servers: Operation functions for all subscribers Administration: Role, Scope, Billing & Reporting EMEA APAC For local management: Virtual Server management for Service Provider and Subscriber Token / User management, provisioning ACLs, RADIUS attributes Local Roles/Scope Reporting Policies Branding Delegation of management 38

39 Operator Role and Scope A role decides what an operator can do Hide, show, enable or disable tabs, modules and actions to form a role The scope decides who you can do it to Use organizations and containers to control the scope 39

40 User Self-Service Portal Fully customisable throughout images, text, options 40

41 User Self-Service Portal Provide alternative log-in methods for lost tokens password, SMS password, Use Q&A Integrate into workflows Self registration Management sign-off Wrap into logistics services 41

42 Customization and Branding Customize Everything User experiences User messages such as enrolment, token related (SMS or software) alerts etc Log-on experience Self service experience Administrator experience Language Alert messages Branding Infrastructure SMS Gateways Modems Reporting Security Policy engine OTP policy Administrator and operator Role Management Infrastructure Security Policies Administrator and Operator Role Management User Experiences Customize Everything Administrator Experience Branding Reporting

43 Customization and Branding Brand Everything Branding of Portal Branding of Self-Service Portal Token branding options Customisation of SMS messages and s Default messages SP text within message Customer text within message Customise deployment message Dedicated URLs Portal Self Enrollment Self Service Branding of documentation Branding of Self-Service Portal Token Branding Options Branding of Portal Branding Customisation of SMS Messages and s Dedicated URLs Branding of Documentation

44 Migrating to your new service BEFORE RSA Authentication Manager w/radius (any 3 rd party auth. Server) RSA Agent (any 3 rd party agent) Add SAS as a RADIUS Client RADIUS Use any token type SAS-Agents RADIUS Add Auth.Manager as an Auth Node SAML 44

45 Corporate Integration APIs and Web Services Authentication and management APIs availability Made available as WSDLs, so any programming language capable of consuming WSDLs can call the APIs Authentication API allows custom authentication From an application or network device that does not support or does not want to use industry standards such as RADIUS and SAML Management API supports user and token management without use of the standard web UI Extensive functionality available Highly secure Invoke any or all of the UI functionality from external applications 45

46 Additional value documentation

47 Documentation and agents 47

48 Microsoft integrations 48

49 49 Microsoft integrations sample Office 365 User synchronization AD ADFS ADFS proxy SAS Cloud Agent SAS OTP cloud server

50 1 st and 2 nd Line Troubleshooting guides SafeNet Confidential and Proprietary 50

51 Summary

52 Summary Key Features and Benefits Widest choice of tokens, including tokenless & 3rd party e.g. RSA Protect everything: networks, applications and cloud services Drastically reduce management time by up to 90% through automation and user self service Save money and resource Migrate easily from your existing solution whilst protecting your current investment in tokens 52

53 Summary Key Features and Benefits Rules and policy engines that automate everything Scheduled, automated, fully-customizable reporting Customize everything, brand everything Use multiple business units, groups and containers to find the perfect mix of central management and devolved administration Increase security from token options to granular operator roles 53

54 Summary Authentication Must Haves Choose any token Protect everything, now and in the future Automate everything Migrate easily, with zero impact on your end users Save time, money and the environment by going SaaS Ditch unnecessary local servers and take advantage of our world class SaaS infrastructure and SLA No ongoing hassle and costs for infrastructure Save money with simple per user per annum pricing 54

55 Thank You