Identity and Access Management

Transcription

1 Identity and Access Management Maricopa Association of Governments- Telecommunications Advisory Group Earl Perkins Notes accompany this presentation. Please select Notes Page view. These materials can be reproduced only with Gartner's official approval. Such approvals may be requested via

2 Gartner: Introduction Gartner is the leader in technology research: objective, vendorneutral, trusted, and action-oriented Clients can take action because of our practical approach, rigorous analysis, and proven methodologies Gartner clients are members and have unlimited access to Gartner resources - over 650 IT subject matter experts and thousands of pieces of current written research Gartner is State-approved with a competitively bid State contract A few examples of what Gartner can do for you: - Make investments in the right technologies - Understand key technology trends and their implications - Develop and implement meaningful IT strategies - Demonstrate IT value and contribute to the enterprise - Choose vendors to meet business and technology needs - Identify cost reduction opportunities in your IT contracts - Find answers to the technology issues that matter most to you

3 Gartner: Contact Information Earl Perkins Research Vice President Information Security and Privacy Shilpi Narang Senior Account Executive Public Sector Phone:

4 Identity and Access Management: Client Issues 1. What exactly is identity and access management? 2. What drives IAM deployments? 3. The state of the IAM industry today 4. Practices and pitfalls of IAM implementation

5 IAM Defined User Identities, Transactions, Roles, Policies and Privileges Identity Management (Administration) Access Management (Real-Time Enforcement) Administer Authenticate Authorize Audit/Compliance Identity Admin Authentication Services Enterprise Reduced Sign-On Password Management User Provisioning Role Matrix Management Metadirectory Enterprise Access Management Alarm/ Alerting Accounting (ITSM) NAC Federated Identity Management Physical Resources Applications Databases Directories Security Systems Operating Systems

6 Identity and Access Management As a Process Infosec, Risk Policy Business Process Identity process Workflow process Access model process

7 IAM Defined- The Identity and Access Process Policy Create Access Model Use Access Model Use Identity Create Identity Change Access Model Legend: Create Workflow Use Workflow Change Identity Retire Identity Report Identity ACCESS MODEL PROCESS WORKFLOW PROCESS IDENTITY PROCESS Monitor Identity Change Workflow Report Access Model

8 Business Drivers: Regulations Impacting IAM CA SB 1398 CA AB 1950 CA SB 1386 PIPEDA Sarbanes-Oxley HIPAA FDA CFR Part 11/Annex 11 GLB FISMA Companies Act BDSG DPA KonTraG RIP Basel II IAS LOPD EUPD Reg. 357 Japan Privacy Personal Data Protection Law Bill 3494/2000 Bill 321/2004 Law f/protection Of Personal Data Nov2000 King II Rpt Banking Act CLERP 9 AS4360 PA&PAA Control Frameworks: COBIT ISO NIST

9 Business Drivers: Why, Who and Where Business Units Regulatory Compliance GLB Act HIPAA (U.S.) PIPEDA (Canada) 21 CFR Part 11 (FDA) NERC Sarbanes-Oxley CISO Risk Management Audit management Terminations Policy-based compliance Business Facilitation Customer self-registration Portal and personalization Outsourcing Customer retention Mobile Content Integration CIO CFO Cost Containment Reduce/avoid staff Security admin. Help desk Common IAM architecture Non-IT services Help Desk SEC Admin Operational Efficiency & Effectiveness Improved SLA: <24 hrs Productivity savings User convenience Security admin. reporting

10 Rating the Identity Management Market User Provisioning Vendors Oracle Beta M-Tech OSM Netegrity Microsoft Courion Thor CA Siemens HP IBM Tivoli Novell BMC Leader Sun Performanc e 40 Challenger Follower Presence 5 January 2005

11 Competitive Market for Identity & Access Management Component, Suite Stacks MIIS Enterprise + Active Directory (Federation Services) ASP.NET MIIS Active Directory Windows Server SAML WS-* Nsure Identity Mgr ichain extend/ GroupWise Nsure DirXML edirectory Open Enterprise Svr System Identity Manager System Access Manager Application Server ID Synch System Directory Server Solaris/Linux Tivoli Identity Mgr Tivoli Access Mgr WebSphere Tivoli Directory Integrator Tivoli Directory Server Unix/Linux User Provisioning Access Mgmt App Server Metadirectory Directory OS/Server Platform Novell

12 Evolving IAM Technology Needs vs. Availability Customers need Scalability to larger deployments Faster deployments Richer audit, reporting for compliance Better training, best practice templates Outsourcing models Vendors are currently designing/providing Suites of semi-integrated products Mini-suites of both infrastructure and management Services for access, provisioning, workflow and audit Templates, profiles for best practices

13 Sample IAM Implementation Process Timeline Project Initiation & Scope Definition days Strategy, Architecture, Initial Funding days Technology Selection days Business Requirements Gathering Technical Requirements Gathering Market Research Strategy Document Architecture Development Initial Schedule and Funding Estimate Project Approval ENVIRONMENT PROFILE: 5000 users, 100 locations, national network Corporate HQ, distributed divisions Microsoft Windows/Active Directory MS Exchange, Lotus Notes, SAP Web application portfolio, 10 applications Detailed Project Plan Development days Product Implementation 270+ days

14 IAM in Information Security Organizations Security Steering Committee Resource Owners Audit Leadership Communications Analysis/ Design Tech Support Admin. Security Operations Identity Management Architecture Without clear accountabilities, investment and commitment fail to materialize

15 IAM Pitfalls to Avoid Someone to watch your back (executive sponsorship) Fighting without a cause (business owners) Building without a blueprint (project planning) Cooking more than can be eaten (complexity creep) Promising more than can be delivered (scope creep)

16 What Do These Changes Mean to You? The time to consider identity management as part of your information security strategy is past. Identity services, application security and SOA planning strategies are merging. The market has matured enough for action the degree can now be driven by requirement, not utility. Identity can now be viewed as a strategic asset, with identity management as an enabler for exploiting it.