1 The intersection of IAM and the cloud Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications Theory, practice, pros and cons with a focus on enterprise deployments of IAM and cloud computing. Idan Shoham, CTO 2011-04-19 2 Agenda Overview of cloud computing. Different types of IAM. Intersection of IAM and cloud computing. Discussion. 2011 Hitachi ID Systems, Inc. All rights reserved. 1
3 Hitachi ID Corporate Overview Hitachi ID is a leading provider of identity and access management solutions. Founded as M-Tech in 1992, a division of Hitachi, Ltd. as of 2008. Hitachi, Ltd.: Founded in 1910. $105 billion revenue in FY2010. 360,000 employees. Hitachi ID has 840+ customers with a combined 10.4M+ licensed users. Offices in North America and partners overseas. Approximately 140 employees. Award: SC Magazine Best Buy for the ID Management Suite. 4 Cloud 4.1 Cloud computing The word cloud... Is a metaphor for the Internet, originating in old network diagrams. The key concept... Is ambiguity we do not specify where a service is running. A cloud service provider... Hosts systems or applications for multiple customers: Must be able to ramp up and down quickly. OpEx replaces CapEx. Delivered over the Internet. A business model... Cloud computing is not about new technology it s about who runs the apps and where. 2011 Hitachi ID Systems, Inc. All rights reserved. 2
4.2 Many meanings of cloud Cloud computing is a marketing buzzword. There is a whole taxonomy of what this might mean. SaaS PaaS IaaS Host a single application. Salesforce.com, Google apps. Software development and runtime environment. Force.com, Microsoft Azure. On-demand virtual network landscape. Amazon EC2, Hosting.com. Location is also a variable: Public. Private (is this still in the cloud?). Hybrid. 4.3 Why cloud computing? Theory SaaS PaaS IaaS General Expert at hosting the app. Zero setup time/effort. Always up-to-date. Scalable. Adaptive capacity. Lower cost. Pay for what you use. Reality Frequent upgrades. Limited features. Platform lock-in. Attractive for low-demand apps. Always-on servers expensive. Dynamic capacity. Replace CapEx with OpEx. 2011 Hitachi ID Systems, Inc. All rights reserved. 3
4.4 Objections and FUD Common concerns Is it secure? High availablity? Performance? Can you imagine a cloud provider staying in business after a security breach or if performance or availability are poor? More serious problems Does the contract support transfer of liability? Vendor viability? Integration with on-premise systems? Data portable to other providers? To what jurisdictions will data be moved? Cloud computing is a business model, not a technology. Real-world problems are mostly business problems. 5 IAM 5.1 Definitions An integration layer linking user lifecycle events to changes in profiles and access rights. Manage: Authenticate with: Authorize: User profiles. Identity attributes. Login accounts. Authentication factors. Group/role memberships. Account and entitlement administration. Passwords. Security questions. OTP tokens. Smart cards / PKI certificates. Biometrics. More (CAPTCHA, mobile phone, etc.) Authentication factor management. Logins. Actions. Single sign-on and access control. 2011 Hitachi ID Systems, Inc. All rights reserved. 4
5.2 The User Lifecycle At a high level, the user lifecycle is essentially the same in all organizations and across all platforms. 5.3 User Lifecycle: Business Challenges More IT more users to manage. There are challenges throughout the user lifecycle. Support cost. User service. Security. Slow: too much paper, too many people. Expensive: too many administrators doing redundant work. Reliable: notification of terminations. Fast: response by sysadmins. Complete: deactivation of all IDs. Role changes: add/remove rights. Policies: enforced? Audit: are privileges appropriate? Org. relationships: track and maintain. Passwords: too many, too weak, often forgotten. Access: Why can t I access that application / folder / etc. 6 Intersection 2011 Hitachi ID Systems, Inc. All rights reserved. 5
Alberta OPERATOR S LICENCE No: 137669-669 Class: 5 Cond/End: A Expires: 18 JAN 2008 0234-69472 Slide Presentation 6.1 IAM in the Cloud There is a lot of marketing buzz around "IAM in the cloud" but what does that actually mean? An on-premise IAM system managing user access to SaaS applications? A SaaS IAM system managing user access to on-premise applications? A SaaS IAM system managing user access to SaaS applications? A SaaS IAM system augmenting an on-premise system? Federated access management for corporate users to access SaaS? An access management for SaaS vendors? 6.2 Moving parts Participants The user signs into... an application after authenticating to... an authentication system which is managed by... an identity and access management system. Each participant could be at any of the locations. Locations The corporate network. The Internet. The cloud service provider. These locations are separated by routers and firewalls. 6.3 Baseline Private Corporate Network Cloud-based Software Provider s Public Network Identity Management System Application Public Internet User Authentication System 6.4 and Well understand architecture. Direct integration (no firewalls to hop over). Typical deployment only gets upgraded every 3 4 years. Costly physical infrastructure. Talent to manage this effectively is scarce. 2011 Hitachi ID Systems, Inc. All rights reserved. 6
Alberta OPERATOR S LICENCE No: 137669-669 Class: 5 Cond/End: A Expires: 18 JAN 2008 0234-69472 Alberta OPERATOR S LICENCE No: 137669-669 Class: 5 Cond/End: A Expires: 18 JAN 2008 0234-69472 Slide Presentation 6.5 IAM hosted in the cloud Private Corporate Network Cloud-based Software Provider s Public Network Application Public Internet Identity Management System User Authentication System 6.6 and No server hardware, DBMS to purchase/deploy. Always running current software. Fewer skilled workers needed in-house? Integration with on-premise applications is hard. Where do you find a vendor that: Operates a reliable 24x7 NOC; and Has a consulting team to implement an IAM? Vendor lock-in? 6.7 Managing access to SaaS/cloud Private Corporate Network Cloud-based Software Provider s Public Network Identity Management System Public Internet Application User Authentication System 2011 Hitachi ID Systems, Inc. All rights reserved. 7
Alberta OPERATOR S LICENCE No: 137669-669 Class: 5 Cond/End: A Expires: 18 JAN 2008 0234-69472 Slide Presentation 6.8 and If this means federated login to a SaaS app: Convenient for users. May reduce admin burden (if no persistent IDs on the SaaS app). Do mobile users have to setup a corporate VPN before they can sign into the SaaS app? What about non-vpn-capable devices? If this means identity administration on a SaaS app: Just another IAM integration. Always good to add "target systems." One more connector. 6.9 Outsource the directory Private Corporate Network Cloud-based Software Provider s Public Network Identity Management System Application Public Internet User Authentication System 2011 Hitachi ID Systems, Inc. All rights reserved. 8
Alberta OPERATOR S LICENCE No: 137669-669 Class: 5 Cond/End: A Expires: 18 JAN 2008 0234-69472 Slide Presentation 6.10 and Users might be happy to sign into corporate apps with their Facebook credentials. Reduce onboarding effort for new hires. Eliminate some costly infrastructure (e.g., AD DCs). Do you trust SaaS authentication inside the corporate perimeter? Can legacy apps integrate with this? Will auditors accept this? 6.11 Remote access for mobile users Private Corporate Network Cloud-based Software Provider s Public Network Identity Management System Application Public Internet Authentication System User 6.12 and Mobile workforce. Lower facility cost. Staff retention. Productivity. Need a VPN. Is the VPN redundant when apps move to SaaS? 6.13 There are 24 base cases Even with just one of each participant, there are 24 arrangements. Each has its own architectural pros and cons. These are in addition to the general pros and cons of moving any part of the infrastructure into the cloud. 2011 Hitachi ID Systems, Inc. All rights reserved. 9
6.14 Architectural considerations Firewalls Trust/compliance Mobility Connectivity Tend to be porous in one direction. Outbound connection easier than inbound. Lead to proxies. Can you trust the CSP? To safeguard data? To stay in business? Users are mobile. Moving apps to the cloud helps. Intense client/server traffic? Low bandwidth to Internet? High latency? Link reliability? OpEx vs. CapEx Dynamic capacity Maturity Retooling Budget impact? Tax treatment? Buying is cheaper for heavy use. Renting is cheaper for sporadic use. Process maturity? Staff skills? SaaS works best with federated access. Apps may not be ready. 6.15 Opinions Baseline Safe. Expensive. Slow. Mature? IAM hosted in the cloud Managing access to SaaS/cloud Outsource the directory Remote access for mobile users Limited examples today. Hosting vendors not good at consulting / implementation. ultants not good at hosting / operations. No different than managing access to internal apps. New, higher risk profile. Sign into work system with facebook account? Everyone already does it. Vendors can outsource VPN, virtual desktop. 2011 Hitachi ID Systems, Inc. All rights reserved. 10
7 Content On-Line Free White Paper: Intersection of identity management and cloud computing: http://tinyurl.com/4cm7baa This presentation: http://tinyurl.com/3rqmkfy QUESTIONS? 500, 1401-1 Street SE, Calgary AB Canada T2G 2J3 Tel: 1.403.233.0740 Fax: 1.403.233.0725 E-Mail: sales@hitachi-id.com www.hitachi-id.com File: PRCS:pres Date: April 18, 2011