IQS Identity and Access Management

Transcription

1 IQS Identity and Access Management Identity Management Authentication Authorization Administration The next generation security solution 2003 RSA Security Conference

2 IAM is a combination of inter-dependent processes and technologies to manage users, user s profiles and users rights to enterprise resources based on the unified user identity concept. 2 What Is Identity and Access Management? Suppliers Partners Employees Internal Systems & Data Employees Partners Customers

3 Common Features of IAM IAM includes: Unified identity - enterprise identity is linked to the user and not to his account User profile maintenance Support for user data in multiple enterprise repositories User authentication Policy-based authorization Delegated administration including user s self management of user identity Framework to allow enterprise applications secure to user identity Built-in applications such network logon, SSO, VPN 3

4 Why Identity Management? The infrastructure challenge Virtual enterprise cannot rely on the disappearing physical perimeter Users migrate within the virtual network Point solutions use different security models and multiple management tools The security challenge Security must span logical and physical boundaries Provide more flexible without sacrificing security The enterprise must have a consistent security policy Legal and regulatory trends for higher security The budget challenge Provide better security and within budget limitations 4

5 IQS IAM - Main Features Main Features: Manages users and user profiles in multiple directories Combines multiple instances of user identity into a unified user identity Supports multi-factor authentication smart cards, tokens and s Supports the most popular enterprise user repositories Includes dynamic and static policy-based authorization Supports automatic policy decisions based on a user s profile Supports role-based control and multiple user roles in a single user session Includes role-based administration of the integrated applications Supports secure delivery of user identity to enterprise applications Supports storage of the user identity to smart card or virtual tokens Includes built-in security applications such as network logon, Web, single sign-on, and VPN Supports delegated administration and user self service administration Flexible framework: easily expanded list of supported directories, authentication methods, policies, and applications 5

6 Identities and Roles 6 Role Role of of a a Sales Sales Person Person ADS ADS Logon Logon SSO SSO CRM CRM Web Web anonymous anonymous ADS ADS authentication authentication Citrix Citrix published published applications applications VPN VPN `- `- password password Role Role of of a a Financing Financing Person Person ADS ADS Logon Logon SSO SSO CRM CRM Web Web anonymous anonymous ADS ADS authentication authentication HR HR with with revalidation revalidation SAP SAP authentication authentication Application Roles Access Active Directory Sales, Financing Allow Single Password (Win32, Web) Sales, Financing Allow CRM Sales, Financing Allow Web Everyone Allow Sales ADS, Financing ADS Allow Citrix published applications Sales Allow VPN Sales Allow Authentication User Set SAPSchedule Location Financing Role Allow Biometric Sales All Services Worktime & only Applications Internal network Everyone Sales Deny Biometric Finanicing Worktime only Internal network Financing ADS Auth Sales Worktime only Internal network Sales ADS ADS Auth Finanicing Worktime only Internal network Financing ADS Any method All Users Anytime Anywhere Auth Users

7 IQS IAM - Components 7

8 IQS Administration Center IQS Administration Center Manages users, user profiles, policies and applications from a single administration tool Manages all aspects of user identities across multiple directories Provides a consistent view of the enterprise security model Supports delegated administration Web enabled Includes a complete smart card management system Allows centralized SSO application registration 8

9 IQS Administration Center 9

10 IQS Multifactor Authentication Provides the following authentication methods out-of-the-box: Password Single-use password Smart card and USB token Virtual token (encrypted containers with the user identity) Digital certificates Biometrics Supports any arbitrary combination of the above authentication methods Allows the use of multiple alternative authentication methods for a user Supports interface for plug-in authentication methods 10

11 IQS Role-Based Authorization Dynamic and static policies Authentication method, time, date, IP address and protocols Automatic policy decision based on the business rules that combine a user s directory attributes User sets allow combining users from different groups and directories Role Based Authorization and Access Control (RBAC) Maps complex policies and business rules to multiple roles Simplifies policy management Reduces the number of policy relationships Simplifies application management Provide both application role and role application views of the enterprise control 11

12 IQS Built-In Applications 12 Logon for Microsoft Windows, NDS and Citrix VPN and Remote Access client for CheckPoint and Microsoft Enterprise Single Sign-On (SSO) MS Windows, Web- or host-based applications Centralized, administrator-initiated and user-based SSO model Allows easy registration of new applications Role-based to Web resources PKI client with support for CAPI and PKCS#11 Supports smart cards and virtual tokens Certificate issuance Automatic delivery of the certificates Self-service administration tool Maintains user profiles Self-administers user identities Register additional credentials New user self-registration Allows policy driven new user self-registration

13 IQS User Self-Services Single user self-service tool allows: Centrally controlled self-maintenance of the user s profile Register new SSO applications Enroll/change user credentials Register new network/vpn accounts Issue and install new certificates Store/load identity to smartcard, USB token or virtual token Launch Panel Instant to authorized applications Self-registration service Policy driven new user self-registration Includes profile creation and credential enrollment Policy controlled registration flow 13

14 Benefit Analysis Productivity increase Administrator Single administration tools increase administrator efficiency Role-based control simplifies policy and application management Automatic policy decisions based on user attributes reduced Single user identity model reduces number of duplicate accounts Single deployment installs multiple integrated applications, including network logon, SSO, VPN, user self-service and PKI client Easy smart card deployment via user self-services Easy PKI deployment via user self-services User self-service tool delegates account maintenance to the user Built-in enterprise SSO eliminates multiple password requirements Built-in authentication methods such as smart cards or s can eliminate needs for password authentication 14

15 Benefit Analysis Continued Productivity increase User Single easy to learn self-service user interface Launch panel provides immediate to authorized applications User can add new SSO applications, eliminating need for passwords 15

16 Benefit Analysis Continued Security benefits Centralization of the information security Consistent security policy throughout the enterprise Flexible security targets specific danger areas, such as external or after hours, without complicating regular user Strong multifactor user authentication Easy deployment of smart card/virtual token combination 16

17 Benefit Analysis Continued Architecture benefits Framework approach: expandable architecture via IQS SDK Add custom data sources, authentication methods, policies, and applications High performance authorization architecture does not require fast connection between IQS server and authorized applications Special case: user identity on a smart card does not require connection to IQS server Large enterprise scalability with a standard load balancer and multiple installations of IQS server Can be used as part of managed services to provide security services to multiple enterprises 17

18 IQS Identity and Access Management Identity Management Authentication Authorization Administration The next generation security solution 2003 RSA Security Conference