Security and Identity. Kevin Harris Account Technology Strategist Microsoft Corporation

Transcription

1 Security and Identity Kevin Harris Account Technology Strategist Microsoft Corporation

2 2 Session Objectives Enhanced Authorization within the Enterprise Help with Compliance and Data Leakage Improve File Management

3 3 Agenda Customer Challenges Windows Server 8 Active Directory Changes Dynamic Access Control

4 4 Sound Familiar?

5 5 Data Management Challenges Growth of Users and Data? Distributed Computing Regulatory and Business Compliance? Budget Constraints

6 6 Different views of Information Governance CSO/CIO department I need to have the right compliance controls to keep me out of jail Infrastructure Support I don t know what data is in my repositories and how to control it Content Owner Is my important data appropriately protected and compliant with regulations how do I audit this IW I don t know if I am complying with my organization s polices

7 7 Windows Server 8 Active Directory Changes Bring existing identity claims model into the Windows platform Introduce a new Windows authorization and audit engine Improvements to the File Classification Infrastructure

8 8 Active Directory Authentication Domain Controller issues groups and claims! - Claims (user & device) sourced from Identity attributes in AD - Compound ID binds a user to the device to be authorized as one principal - Claims delivered in Kerberos PAC NT Token has sections - User & Device data - Claims and Groups! OID to claim for cert based Auth Support for X-Forest Claims Transformation

9 9 Access in the Enterprise?

10 Dynamic Access Control (DAC) Expression-based access control policy Active Directory File Servers User claims User.Department = Finance User.Clearance = High Device claims Device.Department = Finance Device.Managed = True Resource properties Resource.Department = Finance Resource.Impact = High ACCESS POLICY Applies == High Allow Read, Write if (@User.Clearance == High ) AND (@Device.Managed == True) 10

11 11 Classification and Tagging Define classification properties using resource property definitions - Eg. Impact Tag data by consuming classification properties - Eg. Low, Moderate, High

12 12 Dynamic Access Control on File Servers Identify data Control access Audit access Protect data Manual tagging by content owners Expression based access conditions with support for user claims, device claims and file tags Central audit policies that can be applied across multiple file servers Automatic RMS protection for Office documents based on file tags Automatic classification (tagging) Central access policies targeted based on file tags Expression based auditing conditions with support for user claims, device claims and file tags Near real time protection soon after the file is tagged Application based tagging Access denied remediation Policy staging audits to simulate policy changes in a real environment Extensibility for non Office RMS protectors

13 Control access to information In Active Directory: Create claim definitions Create resource property definitions Create central access policy In Group Policy: Send central access policies to file servers On File Server: Apply access policy to the shared folder Identify information At Runtime: User tries to access information Windows 8 Active Directory End User Access policy Claim Definitions Resource Property Definitions Allow / Deny Windows 8 File Server

14 14 Review Session Objectives Enhanced Authorization within the Enterprise - Dynamic Access Control - Central Authoring & Distribution of Access Policies Help with Compliance and Data Leakage - Target Audits with Claims Based Expressions - Only audit what you care about! Improve File Management - Learned how file classification ties into Windows Server 8 Dynamic Access Control

15 Questions?

16