Identity and Access. Management in Cloud. December 21, 2012

Transcription

1 Identity and Access Management in Cloud December 21, 2012

2 Agenda 1. Identity and Access Management (IAM) 2. What is Cloud 3. Operating Models 4. Risk and Challenges 5. Vendors Landscape 1

3 Identity and Access Management

4 What is a digital identity? The digital representation of a user, including a unique identifier, credentials, and both common and application-specific profiles. User Identity: First Name, Last Name, Unique Identifier, Date of Birth Account Credentials: Login ID and password SecurID card, other strong authentication factors Common Profiles: Job Functional Roles Business Unit Office Location Manager/Supervisor User User s Digital ID Application Profiles: Permission levels Access control items Limited Access* Update Personal Web Parts Add/Remove Personal Web Parts Manage Personal Views Approve Items Delete Versions View Versions Cancel Checkout Open Items View Items Delete Items Read ü ü ü Contribute Design Full Control ü ü ü ü ü ü ü ü ü ü ü ü ü ü ü ü ü ü ü ü ü ü ü ü ü ü ü ü New in Window SharePoint Services (version 3)? No No No New New New No New No No 3

5 Large Financial Institution - Case Study in Identity Fraud Creates a false portfolio and begins issuing trades circumventing Credit and trade size controls (late 2006) Flag: Failure to detect inappropriate access and SOD violations SoD Violation John starts work in the Risk Compliance and Control section of the bank s middle office (2000) Forges trade acknowledgements from bank that goes unconfirmed triggering an investigation (Jan 2008) Misappropriate names and passwords of colleagues to mask his fraud. Flag: Ineffective user authentication & Identity risk management Transfers to front office as a trader (2005) Flag: Failure to deprovision access Social Engineering Enters fabricated offsetting trades before nightly reconciliation concealing his fictitious trade positions (thru 2007) Flag: Inadequate user activity logging/monitoring Ineffective Deprovisioning Processes Abuse of privileges Outmaneuvers trading risk control Framework Flag: Ineffective IT Risk management No SIEM Company loses $7.2B after unwinding the fraudulent trade positions (Jan 24, 2008) 4

6 How to relate Identity and Access? Ensuring that only authorized users have access to information resources means managing Digital Identities for diverse user populations, with access needs based on their business relationship with the enterprise. Control Visibility Audit 5

7 Identity management: Provisioning Processes for on-boarding, transferring, and off-boarding of employees, third-party business partner users, contractors, and brokers/agents. Revalidation of these users and recertification of their access privileges to managed resources integrated with the IAM System are also addressed. 6

8 Access management: Resource access A system that provides a single point of authentication and authorization for web applications by implementing security policies across a wide range of Web and application resources. Increases overall system security and Improves user experience by providing web single Sign-on. User Repository Policy Store IAM Administrator Create, Modify, Delete User, Group, Policy Request Resource Security Administration Provide Credentials Access Gateway Authenticate User Authorize User Resource Page Resource Page Resource Page Requestor Protected Resources Produce Audit Reports Audit Report Access Management System 7

9 What is Role Based Access Control? Access Control mess Compliance problems SoD violations Streamlined access control Ease of access monitoring Before Without Roles After With Roles Systems: Systems: Supervisors System Supervisor Role System Directory Directory Database Database Staff Service Role Internet Internet 8

10 What is Cloud?

11 What is Cloud? The Cloud is a collection of internet based or private network services providing users with scalable, abstracted IT capabilities, including software, development platforms and virtualized servers & storage Also known as IT Resources Accessible Over Web Dynamically Scalable Computing Power Virtualization Abstraction of IT Infrastructure On Demand Computing Utility based Computing Related Buzzwords : IaaS, PaaS, SaaS 10

12 Cloud Delivery Model The cloud be in the deployed in three different delivery model Software-as-a-Service (SaaS) As-a-service delivery of applications targeted at private users (e.g. social networking, micro-blogging) and business users (e.g. ERP, CRM) Platform-as-a-Service (PaaS) As-a-service delivery of tools for development, testing, deployment, hosting and application maintenance Infrastructure-as-a-Service (IaaS) As-a-service delivery of virtual CPUs, disk space, and database services Vendor Cloud (External) Private cloud (Internal) Cloud Delivery Model Hybrid Cloud Community cloud 11

13 Operating Models

14 How IAM For A Cloud? Identity and Access management can be deployed in two operating models within Cloud environment Model Description IAM for a Cloud Cloud Service Providers Identity & Access Management Functionality extension of an existing IAM infrastructure Standards for interoperability between on-premises and in-cloud applications Strong authentication and encryption Ability to leverage and sustain existing risk, compliance, and privacy controls built within the enterprise 13

15 How IAM In A Cloud? Identity and Access management can be deployed in two operating models within Cloud environment Model Description IAM in a Cloud Cloud Service Providers Identity & Access Management An IAM solution hosted in a cloud Ability to pay only for the IAM functionality required Reduction in costs related to IAM maintenance Limited in-house expertise required On-demand increase of capacity, functionality, predetermined Service Level Agreements (SLAs), and accountability 14

16 Risks and Challenges

17 Risks associated with IAM in cloud environment Enterprises need to be aware about the risks associated with deploying IAM in a cloud environment. Some important risks are listed below: Service Level Agreements Security of Identity System Integration Total Cost of Ownership (TCO) CA CouldMinder Vendors Stability Downtime will affect the access to the applications and can stop a business in its tracks. Sure, short and infrequent IAM system outages may not be as critical as the other business applications downtime; nonetheless, when people aren't able to access the system it has a negative cascading effect throughout the business. The number one concern for companies opting for the IAM in a cloud. Companies cannot afford to risk compromise of customer / employee identity information. Factors that include are vendor s security policies; data encryption; firewalls. Make aware of compliance policies with regards to data handling and the vendor s liability in case data is compromised IAM solutions shall be capable to integrate with all the applications. A failure to integrate business information systems across the company results in an increase of manual processes for the identity life cycle management. The Cloud IAM service provider shall provide interfaces and ability to integrate with any enterprise application. While predictable expenditures and a utilization based pricing model are welcome news in the business systems software industry, IAM systems must also deliver a comparable total cost of ownership when stacked against the prior on premise solution Assess the vendor for its stability and capability to deliver on its promise. If the vendor decides to wind up operations, is he bound to inform you in advance? What happens to the data if he sells his business? What if there is a change in the usage policies? 16

18 Vendor Landscape

19 Major Providers Vendor landscape increased competitive intensity As Cloud computing grows, an increasing variety of vendors have emerged including traditional IAM vendors influencing the game with innovative solutions and services. Product Vendors CA Entrust Evidian IBM Microsoft Novell OpenIAM Oracle Ping Identity RSA Safew here Siemens Symlabs (Quest Softw are) Ubisecure Service Providers CA Arcot Clavid Cloud Identity Covisint Exostar FuGen Solutions CryptoCard Gluu PingConnect ProtectNetw ork Signicat SSOCircle Symplified VMw are Horizon App Manager Myonelogin Key trends that will impact the Cloud providers in the coming years Specialized hosted identity service companies are trying to expand their reach into the identity federation space Niche as well as established technology vendors provide an opportunity to partner Managed identity service providers are looking to expand their capabilities and cater to multiple market segments globally There is no consistency in the standards supported by vendors 18