It s 2014 Do you Know where Your digital Identity is? Rapid Compliance with Governance Driven IAM. Toby Emden Vice President Strategy and Practices

Transcription

1 It s 2014 Do you Know where Your digital Identity is? Rapid Compliance with Governance Driven IAM Toby Emden Vice President Strategy and Practices 2014

2 CONTENTS Evolution Business Drivers Provisioning to Governance Best Practices Reference Architecture Challenges with Traditional Trends Qubera Solutions Copyright

3 THE EVOLUTION OF IAM SERVICES 1990s Directory Services (Authentication) Pure Play ~25% of global population is online. Growth of Digital Identities 30% CAGR 1999 Meta Directory Password Management Web Single Sign On Portfolio and Partners From operational gatekeeping, to business enablement Virtual Directory User Provisioning Role Based Access Controls Basic Attestation SAML 2003 Vertical Integration Enterprise SSO Basic Federation Strong Authentication Role Mining / Analytics Policy Governance Physical Device Provisioning Closed-Loop Access Remediations SPML 2007 Horizontal Integration 2013 Contextual Authorization Identity Governance Unstructured Data Cloud Identity IAM Cloud Services Device Identity Social/Enterprise/B2C Identity Convergence Advanced Risk Modeling Identity Assurance Logical / Physical Access Convergence SCIM Identity & Policy Services 2014 Qubera Solutions Copyright

4 IAM REFERENCE ARCHITECTURE Access Governance Cloud & Perimeter Security Cloud Services Access Certifications Policy Enforcement Role Based Access Controls Cloud and Social Media Governance Monitor Certify Detect Evaluate Incident Monitoring and Response Federate Identity Governance Enrich Behavioral Analytics Authentication User Administration Password and Credential Management Monitor Single Sign-On (Web, Federated, ESSO) Identity Analytics Data Transformation Identity Warehouse People Accounts Data Cleansing User Account Management Provision Enterprise Applications (On-Premise and Cloud) Authenticate Strong Authentication (e.g. two-factor) Secure VPN Identity Lifecycle Management Groups Entitlements Entitlements Management Enrich Authorize Authorization Advanced and Contextual Authorization Business Processes Business Rules Protect Application & Data Security Policy Control Point (PCP) Unified Authoritative Source Enrich Privileged User Management (PxM) Policy Decision Point (PDP) Unstructured Data Management Enrich Directory Services Data Loss Prevention (DLP) Directory Synchronization and Consolidation Virtual Directory Services Cryptographic Services Qubera Solutions Copyright

5 TRADITIONAL BUSINESS DRIVERS FOR IAM Regulatory Compliance 360 o View of User Access and Activity Compliance-Driven Reporting and User Access Reviews Protection of Sensitive Information Assets Operational Efficiencies Automated Fulfillment and Password Management Processes Closed-Loop Attestation and Remediation Streamlined IAM Business Processes (i.e. joiners, movers, leavers) Risk Reduction Detective and Preventative Policy Enforcement Risk Measurement and Analysis Discovery of Rogue / Orphan / Privileged Accounts. Platform Consolidation User Experience Single Interface for Access Request and Approval Processes Single or Consistent Sign-On to Secure Systems Faster Onboarding and Provisioning Migration from Legacy / Homegrown IAM Tools Consolidation of IAM Infrastructure, Platforms and Tools Directory Consolidation / Virtualization Qubera Solutions Copyright

6 CHALLENGES WITH TRADITIONAL IAM Tools are cumbersome, intrusive, complex and costly to implement. Require highly specialized skillsets, large infrastructure footprint Operational support costs frequently exceed cost savings Provisioning-centric implementations rarely deliver the expected business value. Data cleansing is often overlooked, leading to unanticipated complexity and budget / schedule overruns. Even clean repositories need scrubbing Difficult to succeed without clean data Implementations are often ITdriven, not business-driven, reducing the likelihood of stakeholder buy-in. Data, resource and process ownership contention can prove fatal without robust and sustained executive sponsorship IAM is often perceived as a necessary evil, not a business enabler IAM should align with strategic business goals, not tactical IT wins Qubera Solutions Copyright Excessive focus on provisioning automation, not business process optimization. True cost of managing user access is in cumbersome business processes, not last mile provisioning Provisioning automation is extremely risky if data is unclean Vertical integration methodology increases timeto-value and promotes unnecessary reengineering of business processes

7 THE JOURNEY FROM PROVISIONING TO GOVERNANCE A horizontal governance-centric approach is less intrusive, focusing on rapid integration of applications and creating a rich view of user access. Consistent policies and business processes can be layered on top of discovered privilege data. Last mile provisioning mechanisms can be subsequently enabled in either a manual or automated fashion. The classic vertical provisioning-centric approach to IDM approaches each target system with a unique set of business processes and provisioning mechanisms. This can lead to technical bottlenecks, unnecessary complexity, project delays and a high likelihood of failure to deliver significant business value. Qubera Solutions Copyright

8 THE CASE FOR IDENTITY AND ACCESS GOVERNANCE Access Governance focuses on creating a rich 360 o view of user access, not automation of broken business processes A typical phase one involves loading account and entitlements data from connected systems, and correlating to authoritative source(s) Facilitates data cleansing and rapid remediation of rogue / orphan / privileged accounts, immediately reducing organizational risk Avoids the data / process contention and data quality issues that often plague traditional IDM projects Drives accountability and ownership for user access to the business Comprehensive visibility into user access delivers rapid ROI Consolidating user access data into a single view enables: Detective / Preventative Policy Governance Centralized Attestations and Closed-Loop Remediation Processes Role Mining and Analytics Risk Modeling and Scoring Optimization of Business Processes Reduces the risk of provisioning automation Last Mile provisioning automation can be selectively and safely enabled for connected systems once data has been cleansed, consistent business processes have been defined and a robust governance framework is in place Qubera Solutions Copyright

9 IAM TRENDS IN 2014 AND BEYOND Cloud Governance Mobile Technologies Access Governance Regulatory Compliance Platform Maturity Managing access consistently across disparate service providers as cloud services proliferate. Providing consistent authen(ca(on / authoriza(on processes across disconnected iden(ty siloes. Convergence between enterprise and social iden(ty constructs; e.g. using Facebook accounts to access corporate systems. Organiza(ons rapidly adop(ng BYOD (Bring Your Own Device) policies. Providing secure access to sensi(ve informa(on assets using unregulated devices. Consistent provisioning and deprovisioning of people AND devices. ShiZ away from provisioning- centric tools towards governance- centric solu(ons. Increasing focus on policy- based controls rather than pla[orm- centric opera(onal controls. Growing demand to monitor user ac(vity in addi(on to user privilege assignments Increasingly stringent regulatory mandates (e.g. Basel II, HIPAA, SOX, FISMA, FERPA, IFRS, PCI- DSS, EU 2002/58) An(cipa(on of (ghter regulatory controls in response to growing public concern over data privacy Focus on ease and speed of implementa(on greater configurability, less customiza(on, reduced (me- to- value. Trend towards point solu(ons rather than cumbersome and intrusive stacks. Cloud- based iden(ty services and appliances predicted to gain market share Increasing legal liability concerns for service providers and consumers Qubera Solutions Copyright

10 SUMMARY OF BEST PRACTICES Integrate applications horizontally. not vertically Focus on access governance, not operational gatekeeping Don t migrate broken business processes, optimise and standardise them Don t underestimate the importance of data cleansing Aim for best-of-breed product stack Increase ROI with rapid onboarding of applications Obtain robust executive sponsorship Develop a communication and outreach strategy Devise a loosely-coupled, service-based architecture Qubera Solutions Copyright

11 STAY IN TOUCH For inquiries in the United States: For inquiries in the United Kingdom: h^p:// security/ pages/default.aspx Qubera Solutions Copyright