EXECUTIVE VIEW. SecureAuth IdP. KuppingerCole Report

Transcription

1 KuppingerCole Report EXECUTIVE VIEW by Dave Kearns March 2015 SecureAuth IdP SecureAuth IdP combines cloud single sign-on capabilities with strong authentication and risk-based access control while focusing on both internal and external users that want to access to both on-premise and cloud services. by Dave Kearns March 2015 Content 1 Introduction Product Description Strengths and Challenges Copyright... 5

2 1 Introduction Cloud Computing is a reality for most organizations today. More and more organizations, from the smallest SMEs to the largest multi-nationals, rely on SaaS (Software as a Service) and other types of cloud services. On the other hand, organizations are challenged by the increasing demand for granting business partners and customers access to their applications, whether these applications are running on-premise or in the cloud. There are many terms for what we call Cloud IAM for Cloud Identity and Access Management. IDMaaS (Identity Management as a Service), IDaaS (Identity as a Service), and various other names are used. However, there is no common understanding of what constitutes that market segment to which vendors have taken different paths. One common denominator is Cloud Single Sign-On, which allows users to access a portal that links to his (or her ) Cloud services and provides a seamless login, either based on passing through username and password or relying on Identity Federation standards. While there are a multitude of solutions available on the market addressing some or all of these new challenges, the risk is that organizations opt for tactical point solutions, rather than integrated or holistic approaches, to address certain business requests. However, on closer examination all this is basically about the same challenge: Managing identities and access, regardless of the type of user and the deployment model of services. Thus, organizations should focus on platforms that cover a broad range of requirements, e.g. beyond pure Cloud SSO or other specialized use cases. Currently, there are two groups of solutions on the market covering the business demand for connecting the enterprise on a broader basis. One contains cloud services in the segment KuppingerCole has defined as Cloud User and Access Management, while the other encompasses on-premise services that support Identity Federation and Web Access Management requirements. SecureAuth, a part of this market, has chosen to call its product IdP, which should not be confused with the three part system promulgated by the OpenID Foundation and later adapted by OASIS for use with the Security Assertion Markup Language (SAML). The three parts are: Principal (SAML) or User (OpenID); Service Provider (SAML) or Relying Party (OpenID); Identity Provider (both) While the idea of a standalone, third party Identity Provider never did catch on, SecureAuth has built a business on its interpretation of being an IdP, and only an IdP, with a good deal of success. 2 Product Description SecureAuth IdP more closely resembles a Simplified SignOn (SSO) provider, and competes with other vendors in what we call the Cloud Identity and Access Management sector. But, should Relying Parties (or Service Providers) decide to accept Identity tokens issued by SecureAuth there would be no time lag in putting that service into practice. Page 2 of 6

3 Nevertheless, SecureAuth IdP is just what the name implies, an identity provider. Its sole purpose is to secure user access control, for all users, for all data, for all platforms. In today s world, control of the device, application, and even the infrastructure is moving out of the datacenter, and a service such as SecureAuth IdP is an excellent solution to ensure that the enterprise maintains secure control of user access to its resources and data, whether in the cloud, on the web, via a mobile device or through VPN. The product includes multi-factor authentication as well as single sign-on in one solution. Among its advanced features are: adaptive authentication (to examine the context of each request) and user selfservice tools (such as self-enrollment and password reset). The service accepts over twenty different methods of authentication (with more being added) either singly or in combination with step up, or adaptive, authentication being an option for all. The operation of SecureAuth IdP is a six step process: 1. It accepts an identity from the user through one of the configured methods (such as Browser, Kerberos, Web Portal, Proxy, Social ID/OAuth, OpenID, SAML, Cookie, X.509 Certificate Device Independent, or even Username/Password) either alone or in combination; 2. It validates the identity against your chosen identity datastore (such as Active Directory, LDAP, SQL, JDBC, ODBC, Sun One, Novell edirectory, Tivoli Directory, Web Services, etc.); 3. It analyzes the context of the authentication event and user (Login History, Device Type, Location, IP Address and Reputation, Geo-fencing, Geo-velocity, Domain, Heuristic) then applies a risk metric and can optionally ask for more data, limit the activity of the user, or deny access entirely; 4. It presents the user s credentials (Password, , SMS, Telephony, X.509, PIN, Yubikey, CAC/PIV, Kerberos, OAuth, Browser Print) as an SSO provider; 5. It can also assert the identity to services which accept tokens (Web, Gateway/VPN, Cloud, Mobile, and/or Identity Management) 6. Finally, SecureAuth IdP centralizes and inspects access control activity through unified user access which streamlines your audit trail which simplifies being in, and proving to be in, compliance SecureAuth IdP does offer on-boarding capabilities. It provides, in one package, a focus on both internal and external users that want to access both on-premise and cloud services. As such, it can replace multiple other products in your IAM/IAG and Cloud IAM/IAG portfolio. SecureAuth IdP installs as either a datacenter based appliance or a cloud based service. If deployed as a Cloud service, SecureAuth offers AWS (Amazon Web Services) as a potential provider. SecureAuth does not own its own datacenters, but that is quite common in this market. There is, though, a standard option for running the service only within the EU, as far as Cloud deployments are concerned. Also, the service is already run from some EU hosted datacenters. Page 3 of 6

4 3 Strengths and Challenges A major strength of SecureAuth IdP is its option to use Adaptive Authentication. Adaptive Authentication uses risk-based policies to evaluate a user s login and post-login activities against a range of risk indicators. Systems then ask for additional assurance of the user s identity when a risk score is out of range or policy rules have been violated. This risk and context-based authentication and authorization methodology provides transparent authentication for the majority of the users, and provides an appropriate level of risk mitigation for those who are in untrusted positions. The level of assurance for a given identity depends on the risk of identity fraud calculated from the user's activity or the criticality of the resources to which access is requested. With the latest in adaptive methods built in, IdP can help you quarantine suspicious actors to prevent them from moving laterally in your network. Whether you want to inspect IP addresses and device fingerprints, analyze group memberships or ensure that geo location and velocity make sense, you can easily build risk analysis into your authentication workflows where needed and stay one step ahead of trouble. In the past we ve criticized SecureAuth for a lack of worldwide partners and presence. The company now has an EU office (in London), as well as strong partnerships worldwide including Cisco, Juniper, F5, Citrix, Microsoft, Google and Amazon. SecureAuth combines cloud single sign-on capabilities with strong authentication and user on-boarding capabilities, focusing on both internal and external users that want to access to both on-premise and cloud services. Organizations looking to improve both security and ease-of-use for their data and users should definitely consider SecureAuth IdP for Access Control services. Strengths/Opportunities Multi-factor and adaptive authentication support Well thought-out approach to Cloud Single Sign-On Integrated cloud and datacenter services Tight integration with identity datastores especially with on-premise Microsoft Active Directory Strong standards support Well thought-out approach to security and data privacy Weaknesses/Threats Third party datacenters (Amazon, Google) Limited, but growing global ecosystem Somewhat limited, but expanding support for external users such as business partners and customers Page 4 of 6

5 4 Copyright 2015 Kuppinger Cole Ltd. All rights reserved. Reproduction and distribution of this publication in any form is forbidden unless prior written permission. All conclusions, recommendations and predictions in this document represent KuppingerCole s initial view. Through gathering more information and performing deep analysis, positions presented in this document will be subject to refinements or even major changes. KuppingerCole disclaim all warranties as to the completeness, accuracy and/or adequacy of this information. Even if KuppingerCole research documents may discuss legal issues related to information security and technology, KuppingerCole do not provide any legal services or advice and its publications shall not be used as such. KuppingerCole shall have no liability for errors or inadequacies in the information contained in this document. Any opinion expressed may be subject to change without notice. Page 5 of 6

6 The Future of Information Security Today KuppingerCole supports IT professionals with outstanding expertise in defining IT strategies and in relevant decision making processes. As a leading analyst company KuppingerCole provides first-hand vendor-neutral information. Our services allow you to feel comfortable and secure in taking decisions essential to your business. KuppingerCole, founded in 2004, is a leading Europe-based analyst company for identity focused information security, both in classical and in cloud environments. KuppingerCole stands for expertise, thought leadership, and a vendor-neutral view on these information security market segments, covering all relevant aspects like Identity and Access Management (IAM), Governance, Risk Management and Compliance (GRC), IT Risk Management, Authentication and Authorization, Single Sign-On, Federation, User Centric Identity Management, eid cards, Cloud Security and Management, and Virtualization. For further information, please contact clients@kuppingercole.com Kuppinger Cole Ltd. Sonnenberger Strasse Wiesbaden Germany Phone +49 (211) Fax +49 (211)