Select the right solution for identity and access governance

IBM Security Buyer s Guide June 2015 Select the right solution for identity and access governance Protecting critical assets from unauthorized access

2 Select the right solution for identity and access governance At the core of every cyber-security strategy is identity and access management. Because so many security issues and audit failures are user-related, organizations need to make sure people have appropriate, up-to-date access entitlements and that their access activities are monitored wherever they are located. Not so long ago, an organization only needed to worry about employees accessing a few, highly controlled and contained applications in-house. Fast-forward a few years and now, there can be potentially millions of users trying to access critical systems and information that need to be strictly controlled. And these users are not only your own employees, but also customers, partners, contractors and other third parties. Organizations now need to secure an extended enterprise, where employees work remotely on mobile devices, applications are outsourced to cloud providers, and traditional borders have disappeared. This velocity and volume requires a different approach to security a risk-based approach. In today s open enterprise, users can be the weakest link in security. To combat these insider threats and protect critical assets, organizations need automated, role-based access controls that can help identify who the users are, where they are located, what they want to do, and what their normal behavior is before letting them in the door. In fact, organizations now need threat-aware identity and access management (IAM) solutions to help them: Safeguard mobile, cloud and social access: Today s users expect convenient access to cloud and web applications from any device at work, at home or on the go. The right IAM solution can help validate who is who when users connect from outside the enterprise, authenticating the device and the user. They can also provide risk-aware access in accordance with pre-set security policies, to help protect corporate assets in less secure environments. Prevent advanced insider threats: While outsiders certainly pose a security threat, more often it s someone you trust a privileged authorized user inside the organization conducting unauthorized activities, or another user who poses as authorized but isn t who is the bigger danger. To address insider threats properly, it is critical to go a step beyond the security measures deployed for the general user population. These more powerful users need extra security measures for every step they take including tighter control of their identities and detailed monitoring and reporting of their activities. Administrators need IAM solutions that enable access for trusted privileged users but validate their actions with session recording tools, audit reports and security intelligence. Simplify cloud integrations and identity silos: New partnerships and customer-facing applications, along with rapid cloud and mobile services adoption, have led to a fractured identity environment where silos of user information reside in multiple disparate sources. In order to manage risk and comply with security regulations, it is imperative that organizations have a single authoritative source of identity data. A true cross-domain IAM solution helps administrators gain visibility and control of users access rights and activity that spans data center and cloud applications. Deliver actionable identity intelligence: Managing, updating and governing user identities and access privileges can be a key security challenge. Today s organizations need to ensure that individuals have access privileges appropriate to their roles and that their activities are authorized. They need tools to help them implement an identity governance strategy, centralize identity management, and reduce the costs associated with user provisioning and access management. To help monitor user behavior and entitlements, administrators should analyze actions to discover and fix anomalies as well as prevent malicious activities in the future. The right IAM solutions facilitate collaboration between IT and business teams, empowering line-of-business managers to make role-based entitlement decisions for their employees, as well as provide analytics to highlight unauthorized or suspicious activities.

IBM Security 3 Getting started with identity and access management This buyer s guide can help you find the right IAM solution for your organization one that meets your unique needs for compliance, provisioning, access management and governance, along with the identity intelligence to stay ahead of threats from the data center to the cloud. To help you achieve business value, the right IAM solution should help your organization: Protect critical data and applications from unauthorized access and security breaches Support access-control policies that range from simple decisions based on group membership to real-time, context-aware decisions based on risk analysis and data Monitor and report on user access activity to ensure it follows appropriate use policies and is consistent with regulations Take corrective action when compliance policy violations are detected Provide users with secure single sign-on and sign-off across heterogeneous web applications and services Enable line-of-business managers to manage and assign employee and job-role entitlements that help enforce business policies, audit guidelines and external regulations Easily automate lifecycle management with centralized user self-service, role management, automated approvals processing, recertifications and password management Increase efficiency with user-friendly dashboards, streamlined approval processes and self-service capabilities Manage and prevent business-policy conflicts through separation-of-duty checking and enforcement Enable secure user access to cloud, social and mobile resources and safeguard online business collaboration Make identity data available for general use in searches, browsing and social interaction Protect and monitor access to privileged and shared accounts to mitigate insider threats Synchronize enterprise-wide identities to help improve security for data, applications and infrastructure To help you evaluate whether an IAM solution effectively supports your short- and long-term objectives, this guide includes checklists of key features and capabilities in the following areas: 1. Identity governance and management 2. Access management for web, cloud and mobile environments 3. Policy-based entitlements and access controls 4. Identity intelligence (for monitoring and auditing) 5. Time to value You will also find tips to help you select solutions with support and a vendor with the financial stability to address the full range of your IAM requirements. 1. Identity governance and management Evolving threats and security breaches are forcing organizations to reconsider their approach to user and access management. As regulations and compliance efforts focus more and more on how and why user access is granted, organizations need to ensure their identity management practices comply with external and internal security policies and requirements. Identity governance and management is the evolution of core identity management functions. While traditional identity management focuses on IT processes, such as user provisioning and authorization, identity governance goes much further to address the business requirements of compliance managers, auditors and risk managers. Identity governance and management solutions help organizations protect identity as a new perimeter with controls to manage, enforce, and monitor user entitlements and access activities. With identity and access governance, organizations can help protect their critical data that is vital to business survival and success. They can define, discover, validate and maintain truly meaningful job roles. And based on those roles, they can maintain strong control over user access to applications and carefully monitor how the entitlements align with business roles and responsibilities.

4 Select the right solution for identity and access governance Centralized, automated identity management solutions can make administering and auditing user roles, identities, credentials and access permissions more efficient and accurate. An automated, policy-based provisioning system can support adherence to your business policies, provide proper context for securing user access and enhance regulatory compliance. An easy-to-use solution that empowers business managers to make entitlement decisions for their employees can help ensure that all users have access privileges appropriate for their job role. Managing and governing user identities and access privileges is instrumental in maintaining regulatory compliance and reducing risk. The right identity governance and management solutions should help organizations create an identity governance strategy, centralize identity management tasks and reduce related costs. The products should also help audit, monitor and report on user compliance with acceptable use policies. Identity governance and management Provides complete user lifecycle management, password management and role governance in a single integrated solution Creates comprehensive identity governance, risk and compliance infrastructure such as audits, reporting, access review and certifications, separation of duties (SoD), and access risk mitigation Helps reduce risk with zero- day deprovisioning of users when they leave the organization or change roles Improves collaboration with business users by aligning roles design with business objectives Facilitates continuous development and optimization of roles as business processes evolve Defines user roles from a business- activity point of view rather than application capabilities and aligns the roles with business policies Simplifies the design, implementation and validation of role and access structures across the organization, performing role mining and role optimization with SoD validation Manages and prevents business process conflicts through group management and SoD enforcement Provides a business- friendly, intuitive user interface to support business managers requesting and approving access for their employees, both on- premises and via a mobile device Empowers users to actively participate in and manage their own access privileges and passwords, helping reduce costs Helps enforce pre- established policies for how user access should be granted throughout access request and provisioning processes Supports the ability to create and implement actionable business- centric governance rules for quick time to value Provides a self- service interface for user enrollments, user validation, account updates and password management

IBM Security 5 Identity governance and management Reduces costs and simplifies deployment with a virtual appliance format Supports identity management on a group basis, simplifying and reducing the cost of user administration Bundles a best- of- breed directory with data integration and synchronization tools to help solve integration challenges Reconciles accounts automatically and on demand to rapidly and reliably discover invalid orphaned accounts and unnecessary entitlements, and to initiate either automatic or manual remediation processes Maintains accurate records of configuration and changes to user access rights for auditing purposes Provides access to both approval and operational workflows, allowing customization of the provisioning activity Integrates with a wide range of identity servers, applications, middleware, operating systems and platforms, including SAP and Oracle Addresses compliance mandates via audit trail collection, correlation and reporting Helps reduce the time and effort needed to design, manage and approve roles and role structures for enterprise IT governance Directory services Serves as the identity data foundation for web applications and identity management initiatives Offers a universal directory capability, to transform identity silos and support virtual directory -like deployments Offers in-depth user insight via security intelligence platform integration, a lightweight directory access protocol (LDAP) group connector and analytics platform reporting Includes a System for Cross-domain Integration Management (SCIM) connector for enhanced on-boarding to cloud applications and other SCIM-enablement targets Easily synchronizes with other directories to provide a single, authoritative, enterprise-level view of data. Provides a highly scalable identity infrastructure to meet the needs of all organizations, from small and midsized businesses to those with hundreds of millions of users Offers intelligent search and social networking support for identity store browsing

6 Select the right solution for identity and access governance Privileged identity management Provides complete identity management for authorizing privileged users throughout the users lifecycles Enables the secure setup, management and approval of a pool of shared and privileged accounts to help improve control and oversight of privileged identities Provides an integrated approach to managing both privileged and non-privileged identities for simplified IT deployment and ease of use Provides out-of-the-box connectors to support a wide variety of managed endpoints such as servers, applications and devices Helps secure and track the use of privileged credentials in applications, and supports password rotation of those credentials Allows you to schedule password changes in managed application instances using lifecycle rules Helps reduce total cost of ownership and speeds time to value with a virtual appliance deployment option Provides privileged user accountability with optional session recording/replay support and usage tracking of shared IDs Protects privileged access to enterprise resources with secured user credentials, automated password management and single sign-on capabilities Strengthens compliance and governance with comprehensive tracking and reporting of privileged users activities Supports external directories such as Microsoft Active Directory for user authentication, eliminating the need for a separate, dedicated directory Enables control and auditing of privileged access to cloud-based resources

IBM Security 7 2. Access management for web, cloud and mobile environments Many organizations face access management chaos. As applications and resources have spread across on-premises data centers and multiple cloud providers, users are accessing these resources from anywhere and on multiple devices. These trends have left many access management systems fragmented and access polices inconsistent. In addition, the fragmented environments are expensive to maintain and challenging to secure. Organizations can take back control of access management by using an integrated solution to manage access across many common scenarios. For example, combining web application protection, single sign-on, context-based access control and identity federation is an efficient, effective approach to securing web, mobile and cloud workloads. Access management for web, mobile and cloud environments Enables secure user access to web, mobile and cloud applications with single sign- on, session management and context- based access control Provides an integrated solution to safeguard user access to web, mobile and cloud workloads Supports multiple standards for cross- site authentication, including Security Assurance Markup Language (SAML), Open Authorization (OAuth), Liberty Alliance and Web Services Federation Language (WS- Federation) token- passing protocols Provides integrated access management with a web reverse proxy for use across the enterprise Simplifies setup and maintenance with local management graphical user interface (GUI) and automated service updates Helps protect user access and applications with integrated threat intelligence and built- in protection against application threats Enforces context- aware user authorization and authentication using information about the user, device fingerprinting, one- time passwords, geographic location awareness, fraud indicators and IP reputation scores Provides a graphical policy management interface that supports authoring complex access control policies Integrates with existing identity management systems to import users and roles and synchronize passwords between the two products for efficient user lifecycle management

8 Select the right solution for identity and access governance Access management for web, mobile and cloud environments Provides identity services to validate and centrally manage access across private, public and hybrid cloud deployments Supports federated single sign- on for users across multiple cloud- based applications through support of SAML 2.0 and OpenID Connect protocols for federated access Simplifies installation and maintenance with an easy- to- deploy- and- manage physical appliance or virtual appliances Delivers built- in Layer 7 load balancing and distributed session caching to provide shared session management across multiple appliances and application instances Provides mobile sign- on, session management and an authentication service for supporting multiple strong authentication schemes Provides flexible web and identity services using its own security token service (STS) to validate and issue a wide variety of identity formats Helps block the Open Web Application Security Project (OWASP) top 10 web vulnerabilities before they reach the targeted application Offers high performance and scales to tens of millions of users and hundreds of applications Provides the ability to securely implement bring your own identity scenarios using popular social identity providers Includes pre- integrated federation connectors to popular cloud applications Centrally manages user access to on- and off- premises cloud and web applications services in heterogeneous IT environments Supports broad and flexible integration with strong third- party authentication solutions

IBM Security 9 3. Policy- based entitlements and access controls As the number of users increases exponentially, organizations need an efficient solution to help them consistently manage and enforce access-control policies across every application, data source, operating system and organizational boundary. These policies must integrate with core business systems and keep identity information synchronized across multiple sources. Organizations must be able to put into place access-control policies that reflect business goals and help ensure regulatory compliance and do both in a cost-effective manner. Also, as organizations establish their access control policies, they need identity and access governance tools that include analytics to help identify and mitigate risks. Whether users gain access through portals, websites or the enterprise network, organizations need to be able to track who is accessing key systems, align the degree of access granted with organizational priorities and needs, manage access with greater accountability, and help ensure that access policies are enforced. What s more, with more internal and external audiences accessing the same corporate resources, the scalability and availability of the security solution is critical. Organizations need a solution that will scale to a very large number of users and that provides the right level of technology support and failover capabilities to maintain the availability of business-critical applications. Policy- based entitlements and access controls Provides a business- friendly description of what users can do with their access rights for better decision making in new access- approval requests, recertification and audit reviews Enables managers to proactively enforce pre- established business policies for how access should be granted throughout the access request and provisioning processes Enables modeling of security policies and creating of security- policy templates for consistent use across the organization Allows application owners to create data entitlements using roles and attributes without requiring knowledge of IT operations

10 Select the right solution for identity and access governance Policy- based entitlements and access controls Provides auditing, tracking and reporting of user access and entitlements for actionable IT operations and effective compliance reporting Includes what- if policy change simulation analysis to identify who and what entitlements will be impacted before a change is made; provides an impact analysis and preview of policy changes, with ability to drill down on accounts, attributes and values Incorporates business rules into access- control decisions and evaluates these rules dynamically at run- time Manages and prevents business process conflicts through group management and SoD enforcement Provides a policy- based user authentication and authorization system that helps defend against the latest web- based security threats Periodically reviews and recertifies user access, identifying SoD policy violations and remediating risks associated with inappropriate user access privileges Sets an access policy that automatically detects and remediates intentional and inadvertent noncompliance events in real time Automatically escalates and redirects workflow processes to alternate participants when timely action is not taken Scales to tens of millions of users for authentication and authorization Enables multiple policy enforcement points for application and data sources such as Microsoft SharePoint, IBM DB2 and other application and data resources Uses the security token service (STS) to validate and issue a wide variety of identity formats and to flow auditable identities between applications and services across multiple security domains and the organization

IBM Security 11 4. Identity intelligence Organizations must be able not only to control access to data and applications, but also to demonstrate the strength and consistency of their access controls throughout the identity lifecycle and provide auditable proof of compliance. In today s complex computing environments, organizations need a closed-loop view of who has access to what, why they have access to it, and what they are doing with that access. This visibility must extend to privileged and trusted users, as these accounts are particularly vulnerable to abuse. The open enterprise needs to be able to quickly detect anomalous user behavior. It needs to be able to analyze actions to discover and fix system vulnerabilities as well as help prevent malicious activities in the future. Monitoring reports can be used to understand whether user activities align with the rights and policies of the organization. Any abnormal or out-of-policy activity should be highlighted so it can be addressed and corrected. Including monitoring as part of the overall compliance process closes the loop and helps ensure that the right level of security is in place. Identity intelligence Provides risk- based compliance and threat analytics for improved ability to combat insider threats Produces customizable analytics reports that show role details, user access, permission views and explorations of modeling data Integrates with security information and event management (SIEM) tools such as IBM QRadar Security Intelligence Platform or other reporting tools to provide actionable insights for reducing risks and demonstrating compliance Supports a comprehensive risk management program, which can impact the organization s financial position and security compliance posture Utilizes a single, secure identity repository from which virtually all identity events can be tracked and audited Provides true closed- loop policy compliance enforcement that both detects and remediates access entitlements granted outside the provisioning process Provides comprehensive tracking and reporting on how privileged identities are used and what users have done with these identities

12 Select the right solution for identity and access governance Identity intelligence Provides a single identity graphical user interface for performing administrative functions and for tracking and auditing identity events Includes workflows as an integral component so that all lifecycle and provisioning events are managed and monitored by the solution, which can then log all transactional data for forensic auditing and reporting Offers closed- loop access and audit management support for integrating with security information and event management tools Transparently logs all user login activities and centrally records them inside the system database to support compliance Translates and maps a diverse set of user identities across different services Establishes an identity trust management framework to help ensure transactions are performed securely Tracks and collates all login events, allowing users to extensively audit application access and generate detailed reports Provides an audit trail of who has access to what and who approved those access rights Offers privileged user monitoring, reporting and auditing on databases, applications, servers and mainframes Translates captured native log data into easy- to- understand reporting that can be used without the need for any platform knowledge Updates administrators with IAM analytics and reporting for improved visibility into potential risks Provides an easy- to- use interface for creating custom reports, including summary, detail and threshold reporting Supplies fine- grained logging and reporting of user activities that can help demonstrate compliance with government security regulations

IBM Security 13 5. Time to value As you re evaluating different identity and access governance solutions, it s important to select one that offers rapid time to value and the ability to add new capabilities, such as identity governance, fraud protection or reporting tools, as needed. The right solution, while cost effective, also should include a number of key features designed to provide easy configuration, integration, maintenance and robust security especially in complex enterprise environments. Time to value Provides an integrated IAM solution to simplify the ongoing management of disparate security systems across the extended enterprise Includes necessary infrastructure adapters, leading commercial versions of middleware and software components (including necessary databases), LDAP servers, and web and application servers Delivers user metrics to support collaboration among business, IT and audit teams Provides access management solutions in hardware or virtual appliance formats for simplified configuration and faster time to value Supports integration with third- party applications (including SAP, Oracle and Microsoft), as well as support for multiple directories and user repositories and heterogeneous middleware Supports local languages and incorporates dynamic language support to display deployment- specific content in each user s preferred language Provides breadth of platform support, including Microsoft Windows, Linux and IBM z/ OS Helps secure access to applications and workloads, including web, mobile, cloud, and application programming interfaces (APIs), with a single integrated appliance Simplifies the user experience with single sign- on access across applications, wherever they are running Provides visibility into risks to help cross- functional teams govern identities, gain control and support regulatory compliance

14 Select the right solution for identity and access governance Selecting the right vendor The provider you choose should be a trusted, long-term partner who can support the full breadth of your identity and access assurance requirements helping you address the issues of complexity, compliance and cost. Ideally, you ll also want a provider who can support you throughout the implementation process. So before you select a provider, make sure to ask these questions: Does your vendor offer only part of the solution, or the complete solution? With a vendor who is focused too narrowly on a solution that addresses only a particular environment, you can run into the islands of security problem. Solution costs, and the time it takes to manage multiple vendors, can rise dramatically when multiple vendors are involved. Look for a vendor with a complete portfolio for identity and access governance, including distributed and mainframe access controls, web services security, mobile access controls and federation. Are your vendor s products tightly integrated for streamlined functionality? The better integrated the solution, the less work you will need to do to manually integrate the technology. What type of global presence does your vendor have? If your organization has international offices, you should look for a vendor with a global presence and proven international experience. Make sure the vendor can support your offices abroad with their own local resources. Are the vendor s products and services consistently rated highly by the analyst community? Look for solutions that leading analysts recognize as superior through independent analysis and examination across multiple dimensions. Can your vendor deliver products that are strategically designed and technically superior? When comparing various security solutions, look for technical superiority well-designed functionality, an intelligent architectural design and broad support for industry standards. Address your identity and access governance needs with IBM As regulatory hurdles multiply, data volumes expand and digital channels continue to transform access requirements, IAM solutions become crucial to an organization s day-to-day security and business operations as well as its ongoing compliance efforts. As you evaluate IAM vendors, you ll find that IBM is the trusted partner you need to support your long-term security goals. With a strategic, policy-driven approach, IBM can provide the services and infrastructure necessary to support today s security requirements, whether for mobile devices, cloud computing, websites or enterprise networks. IBM Security solutions can help you respond to change, reduce management costs and protect your most valuable information assets. These solutions can integrate with third-party environments, including Oracle, Microsoft and SAP, for streamlined implementation. Is the solution supported by a mature support organization with expertise and bandwidth that can be relied upon when you need it? Your vendor should offer highly responsive and highly effective customer support. Find a vendor with a proven support organization to help you maximize the value of your software investment.

IBM Security 15 Establishing a centralized and automated infrastructure for identity and access assurance can ultimately become a business enabler helping you: Minimize the complexity of providing a secure environment that safeguards your data Control high help desk costs around user access, including costs attributable to cross-domain scenarios. Comply with security and privacy regulations by demonstrating consistent, policy-based user access security across all channels (enterprise, web, mobile, cloud) Gain visibility into who has access to what across all resources both in the cloud and across the infrastructure and identify policy violations Support expanding user populations and facilitate collaboration with secure access to online resources within cloud, mobile and social environments Securely manage and monitor the activities of privileged users to reduce the risk of security breaches and improve compliance Analyze identity data and business rules to help improve the effectiveness of controls Protect your organization against internal and external threats with powerful and flexible security controls IAM solutions from IBM Security are strengthened with threataware technologies designed to improve your organization s defenses. They can validate who is who when users connect from inside or outside the enterprise while protecting user access and applications from web threats. The accountability and transparency provided by built-in reporting and auditing tools give organizations the identity governance they need to manage users with strong controls while supporting the business need for connectivity and access. For more information IBM Security solutions provide comprehensive identity governance and management, access management, and user compliance auditing capabilities. By integrating proven technologies with a layer of security intelligence, they help organizations ensure that the right users have access to the right information in a timely manner. The solutions centralize and automate the management of users, then close the identity and access loop, providing industry-leading capabilities not only for assigning and enforcing user access rights, but also for monitoring user activity and for detecting and correcting situations that are out of compliance with security policy. To learn more about IBM identity and access assurance solutions, contact your IBM representative or IBM Business Partner, or visit: ibm.com/security

Copyright IBM Corporation 2015 IBM Security Route 100 Somers, NY 10589 Produced in the United States of America June 2015 IBM, the IBM logo, ibm.com, DB2, QRadar, and z/os are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the web at Copyright and trademark information at ibm.com/legal/copytrade.shtml Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both. Microsoft and Windows are trademarks of Microsoft Corporation in the United States, other countries, or both. This document is current as of the initial date of publication and may be changed by IBM at any time. Not all offerings are available in every country in which IBM operates. THE INFORMATION IN THIS DOCUMENT IS PROVIDED AS IS WITHOUT ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING WITHOUT ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND ANY WARRANTY OR CONDITION OF NONINFRINGEMENT. IBM products are warranted according to the terms and conditions of the agreements under which they are provided. The client is responsible for ensuring compliance with laws and regulations applicable to it. IBM does not provide legal advice or represent or warrant that its services or products will ensure that the client is in compliance with any law or regulation. Statements regarding IBM s future direction and intent are subject to change or withdrawal without notice, and represent goals and objectives only. Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a lawful, comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. Please Recycle TIO14000-USEN-05