Schlumberger PKI /Corporate Badge Deployment. Neville Pattinson Director of Business Development & Technology IT & Public Sector

Transcription

1 Schlumberger PKI /Corporate Badge Deployment Neville Pattinson Director of Business Development & Technology IT & Public Sector 1

2 Overview Background Overview of the PKI and Corporate Badge components Applications Deployment Status Next Steps Lessons Learned 2

3 Schlumberger... built on global technical services leadership Two Divisions: Oilfield Services SchlumbergerSema 80,000 employees 140 Countries 3

4 IT security: the business case IT Security represents a huge opportunity to enhance SLB image as secure information provider and provide new ways of leveraging our services. IT Security poorly executed has the potential to destroy our business reputation. Two main priorities: Ensure the privacy and integrity of our client s and our own systems and data. IT system availability is critical to our business. 4

5 IT security: facts Decentralized management needs to be responsible for the performance of a highly centralized IT Security system. SLB knowledge is a significant competitive advantage and needs to be protected People and process are more critical to IT Security than technology World Class as compared to Silicon Valley companies not traditional Oilfield competitors 5

6 A Corporate Badge? Passwords are expensive and provide poor security Many different standards increase management complexity and help desk support costs Increasing network fraud, poor security around transactions and messaging Hard drive based security can be improved =>One single ID card for both secure physical and logical access and providing portability and non-repudiation. 6

7 Corporate Badge Solution (Dexa.Badge) Authentication Authorization Non-repudiation Integrity Confidentiality Global physical access Corporate ID Global PKI plus Smart Card Secure network logon and web access Signed/encrypted and docs Smart Login (Secure password store) Card-based VPN Secure Dial-Up Access DoD CAC platform 7

8 PKI Corporate Badge Overview Off-site Tape Storage Card Issuance System Tape Test CAProduction CA + Backup Firewall High Security CA Room LDAP Director y SSO or LRA Master Users and PKI Support Team Registration Authority End User with: Standard PC Aus tin Remedy Event Tracking System 8 Service Managemen t Center Card and User Management Service Service Management Center Houston Local Service Desk Regional Operations Jero me De nis Austin Produc tcenter Card Perso Service Desk User Site

9 Card Issuance System Distributed issuing is essential for a ID Badge roll out Web-based system for card issuance Physical card issuance (card-user binding) Central database for card history Directory Interface Printing Stations (25) Admin client Camera Printer 9

10 Card Management System Essential for a smart card roll out Web-based system to address card related issues Logical card issuance (initial PIN set up) Issues applications such as PKI, SLB GINA, Smart Login Automatic certificate request and load Runtime (Smart Card related) PIN management with policy support Unblocking Lifecycle Lost card, Temporary card Not tied to the Certificate Authority 10

11 PC Client Architecture Web , Forms Encrypt/sign File/Folder Encryption VPN CheckPoint Secure Dial-up Access Thin Client Authentication Secure PC&Network Login PKI Client Suite Entrust Entelligence Credential Store Smart Login Smart Card Middleware Schlumberger SCUK Reflex Reader Card Management System CMS 11

12 Request card files Certificate Creation Process Subscriber agreement Signs Gives the codes + (card) Identifies user Creates profile USER Sends one time codes (partial) Encrypted CA CA Publishes LDAP enables Request certificates 12 REGISTRATION AUTHORITY (RA) Site Security Officer CIS

13 Application: Virtual Private Networking Contractor Remote SLB user Customer Office Encryption Gatew ay SVPN Internet Central Office Encryption Gateway SLB people Customer Encryption Gatew ay Remote Office Encryption Gatew ay 13

14 Application: Secure Dial-up Access Provides Smart Card based PKI authentication via dial-up connection Secure Communication between Network Access Point (NAS) and RADIUS Uses industry standards to facilitate transition from existing methods Performs Certificate Revocation List (CRL) checking 14

15 Application: Secure Web Access Confidentiality Authentication Username Password PIN & Digital Certificate Authorization Web Servers Public Key Infrastructure Integrity Digital Signature Application Servers Policy Server Non Repudiation Digital Signature Encryption SSL 40 or 128 Bit 15

16 General PKI Application Issues What to do while not all users of an application are deployed with PKI? Information Security Policy is key to guide efforts and spending Transition Rules are required.. Some applications are difficult/costly to upgrade Budget Allocation Issues who pays for what? Infrastructure, cards, applications, physical access, 16

17 Physical Access Control One badge to access any facility or building worldwide Mifare contactless technology Compatible with most Physical Access Control vendors Global roaming Card issuance System plays a key role Today almost 100 facilities support the technology Capital Intensive you cannot replace everything Globalization of the solution in progress 17

18 Schlumberger Deployment Status About 35,000 Cyberflex Access cards issued 21,000 + Active certificates Users in 300+ locations worldwide Target is between 25,000 and 30,000 PKI users by year end 30 pki enabled web applications by end of July, 80 by EOY 4,000 + VPN Users Daily encrypted to top 1000 managers 18

19 What is Next? PKI Corporate Badge is a Living System Our IT Environment Evolves Example: Windows 2000 Integration (Active Directory) Optimize the registration processes Focus on ease of use Continue Integration in Business Applications Secure offline content delivery Electronic Signatures Moving towards Single Sign On 19

20 Lessons Learned A PKI/Corporate Badge solution is a multi-year project which requires strong top Management Support Deploying PKI and Corporate Badge requires a thorough understanding of the business IT and platform strategy. Directory, PC platform, Operating Systems, Networking Logistics are important! Training, Training, Training 20

21 Schlumberger PKI /Corporate Badge Deployment Thank You Austin Neville Pattinson Austin Technical Center 21