Robert Haaverson Imanami Corporation November 30, 2018 IdM & Security Robert Haaverson Imanami Corporation Copyright © 2005 Imanami Corporation. All Rights Reserved.

Agenda What is Identity Management Where does IdM fit within Security? November 30, 2018 What is Identity Management Where does IdM fit within Security? How does IdM fit into Security? Conclusions More Information Copyright © 2005 Imanami Corporation. All Rights Reserved.

What is Identity Management? November 30, 2018 What is Identity Management? Authentication Authorization Access Control Traditional Definition Admin Audit Increasing Complexity Current Trend Results 1 - 10 of about 1,110,000 for "Identity Management". (0.34 seconds) Copyright © 2005 Imanami Corporation. All Rights Reserved.

What is Identity Management? November 30, 2018 What is Identity Management? Identity Management (IdM) is defined as the quality or condition of being the same; absolute or essential sameness; oneness. Identity is what makes something or someone the same today as it, she, or he was yesterday. Importantly, identity can refer to a thing (e.g. a computer) as well as a person. Things and people can have different identities when working with different systems, or can have more than one identity when working with a single system, perhaps when working in different roles. Source: Open Group Copyright © 2005 Imanami Corporation. All Rights Reserved.

November 30, 2018 META’s View Delegated Admin. P/W Mgmt. Self-service Identity Management User Provisioning Audit, logging, reporting Workflow Directory Metadirectory Identity Infrastructure Authentication Servers (e.g. RADIUS, OS) Authorization Servers (e.g. RBAC, policy) SSO “While simplistic and not entirely accurate, it’s helpful for planning purposes to think of access and identity management as separate layers of an identity architecture.” (META Group) Copyright © 2005 Imanami Corporation. All Rights Reserved.

Gartner’s View AUDIT Identity Administration Administer Authenticate November 30, 2018 AUDIT Identity Administration Administer Authenticate Authorize Authentication Services Enterprise Single Sign-on Password Management User Provisioning Metadirectory Enterprise Access Management Federated Identity Management Access Management (Real-time Enforcement) Identity Management (Administration) Copyright © 2005 Imanami Corporation. All Rights Reserved.

Burton’s View ~ Burton Group’s Simplified Architecture ~ November 30, 2018 Burton’s View ~ Burton Group’s Simplified Architecture ~ IdM reference architecture root template Copyright © 2005 Imanami Corporation. All Rights Reserved.

Deloitte’s View Business Value Vision Source: Deloitte November 30, 2018 Deloitte’s View Federated Identity SSO & Portals User account provisioning Identity roles Integrated authoritative source Business Value Strong Authentication Identity Repository Access Management Vision Source: Deloitte Copyright © 2005 Imanami Corporation. All Rights Reserved.

Imanami’s View – The IdM Journey November 30, 2018 Imanami’s View – The IdM Journey Federated Identity User account provisioning SSO & Portals Integrated authoritative source Identity roles Identity Repository Business Value Password Reset /Sync Access Management Strong Authentication Vision Basic Source: Deloitte Copyright © 2005 Imanami Corporation. All Rights Reserved.

IdM Business Drivers Enabling Business Increasing Efficiency Complying with Regulation Increased Security Basic Source: Computer Associates Copyright © 2005 Imanami Corporation. All Rights Reserved.

Where does IdM fit? Blocking Attacks: Network Based Intrusion Prevention Intrusion Detection Firewall Anti-Spam Blocking Attacks: Host Based Intrusion Prevention Spyware Removal Personal Firewall Anti-Virus Eliminating Security Vulnerabilities Vulnerability Mgmt Patch Management Configuration Mgmt Security Compliance Safely Supporting Authorized Users ID & Access Mgmt File Encryption PKI VPN Tools to Minimize Business Losses Forensic Tools Backup Compliance Business Recovery Source: SANS Copyright © 2005 Imanami Corporation. All Rights Reserved.

Where does IdM fit? Blocking Attacks: Network Based Intrusion Prevention Intrusion Detection Firewall Anti-Spam Blocking Attacks: Host Based Intrusion Prevention Spyware Removal Personal Firewall Anti-Virus Eliminating Security Vulnerabilities Vulnerability Mgmt Patch Management Configuration Mgmt Security Compliance Safely Supporting Authorized Users ID & Access Mgmt File Encryption Authentication / PKI VPN Tools to Minimize Business Losses Forensic Tools Backup Compliance Business Recovery Source: SANS Copyright © 2005 Imanami Corporation. All Rights Reserved.

Where does IdM fit? Safely Supporting Authorized Users Blocking Attacks: Network Based Intrusion Prevention Intrusion Detection Firewall Anti-Spam Safely Supporting Authorized Users ID & Access Management Verify that the right people are allowed to use a system Ensure they perform only those tasks for which they are authorized Access blocked when employment is terminated Blocking Attacks: Host Based Intrusion Prevention Spyware Removal Personal Firewall Anti-Virus Eliminating Security Vulnerabilities Vulnerability Mgmt Patch Management Configuration Mgmt Security Compliance Safely Supporting Authorized Users ID & Access Mgmt File Encryption Authentication / PKI VPN Tools to Minimize Business Losses Forensic Tools Backup Compliance Business Recovery Source: SANS Copyright © 2005 Imanami Corporation. All Rights Reserved.

Where does IdM fit? Safely Supporting Authorized Users Blocking Attacks: Network Based Intrusion Prevention Intrusion Detection Firewall Anti-Spam Safely Supporting Authorized Users Authentication Verify that the person is whom they claim to be, whether it be via one, two or three factor. Blocking Attacks: Host Based Intrusion Prevention Spyware Removal Personal Firewall Anti-Virus Eliminating Security Vulnerabilities Vulnerability Mgmt Patch Management Configuration Mgmt Security Compliance Safely Supporting Authorized Users ID & Access Mgmt File Encryption Authentication / PKI VPN Tools to Minimize Business Losses Forensic Tools Backup Compliance Business Recovery Source: SANS Copyright © 2005 Imanami Corporation. All Rights Reserved.

Where does IdM fit? Tools to Minimize Business Losses Blocking Attacks: Network Based Intrusion Prevention Intrusion Detection Firewall Anti-Spam Tools to Minimize Business Losses Forensic Tools When attackers get through enterprises need to find out what they accessed, what they damaged, and how they got in. Blocking Attacks: Host Based Intrusion Prevention Spyware Removal Personal Firewall Anti-Virus Eliminating Security Vulnerabilities Vulnerability Mgmt Patch Management Configuration Mgmt Security Compliance Safely Supporting Authorized Users ID & Access Mgmt File Encryption Authentication / PKI VPN Tools to Minimize Business Losses Forensic Tools Backup Compliance Business Recovery Source: SANS Copyright © 2005 Imanami Corporation. All Rights Reserved.

Where does IdM fit? Tools to Minimize Business Losses Blocking Attacks: Network Based Intrusion Prevention Intrusion Detection Firewall Anti-Spam Tools to Minimize Business Losses Regulatory Compliance Tools Gramm-Leach-Biley, FISMA, Sarbanes Oxley, and HIPAA each generate enormous documentation burdens for companies, universities, and/or government agencies. Blocking Attacks: Host Based Intrusion Prevention Spyware Removal Personal Firewall Anti-Virus Eliminating Security Vulnerabilities Vulnerability Mgmt Patch Management Configuration Mgmt Security Compliance Safely Supporting Authorized Users ID & Access Mgmt File Encryption Authentication / PKI VPN Tools to Minimize Business Losses Forensic Tools Backup Compliance Business Recovery Source: SANS Copyright © 2005 Imanami Corporation. All Rights Reserved.

How does IdM fit into Security? Object (user) lifecycle management Provisioning Change Deprovisioning Strong Authentication / SSO (RSO) n-1 Enterprise Access Management The Whole Enchilada Copyright © 2005 Imanami Corporation. All Rights Reserved.

Object Life Cycle Management Hire Sally’s first day at work PeopleSoft Active Directory Exchange Live Communications Server Avaya Faxination IdM Sally is Provisioned Sally entered into Peoplesoft. IdM adds Sally to AD. IdM assigns Sally to groups based on her role. IdM adds Sally to other systems based on role. Copyright © 2005 Imanami Corporation. All Rights Reserved.

Object Life Cycle Management Promotion Sally’s second day at work PeopleSoft Active Directory Exchange Live Communications Server Avaya Faxination IdM Sally is Changed Sally’s title is changed in Peoplesoft. IdM updates Sally in AD. IdM assigns adds and removes Sally to and from groups based on her role. IdM adds/removes Sally to/from other systems based on role. Copyright © 2005 Imanami Corporation. All Rights Reserved.

Object Life Cycle Management Retire Sally’s last day at work PeopleSoft Active Directory Exchange Live Communications Server Avaya Faxination IdM Sally is Deprovisioned Sally’s status changed in Peoplesoft. IdM disables Sally’s account in AD. IdM removes Sally from groups. IdM removes Sally from other systems. Copyright © 2005 Imanami Corporation. All Rights Reserved.

Strong Authentication / SSO Without IdM Bill logs in from home 1. SecureID Card Access 2. Username & Password Access Copyright © 2005 Imanami Corporation. All Rights Reserved.

Strong Authentication / SSO With IdM Bill logs in from home 1. SecureID Card Access Access Copyright © 2005 Imanami Corporation. All Rights Reserved.

Enterprise Access Management Hire without IdM Jim’s first day at work PeopleSoft Active Directory Exchange Live Communications Server Avaya Faxination Copyright © 2005 Imanami Corporation. All Rights Reserved.

Enterprise Access Management Hire with IdM Jim’s first day at work PeopleSoft Active Directory Exchange Live Communications Server Avaya Faxination IdM Business Rules Copyright © 2005 Imanami Corporation. All Rights Reserved.

Regulatory Compliance Accuracy Auditability Transparency Compliance Cost Time Errors Copyright © 2005 Imanami Corporation. All Rights Reserved.

Trends of IdM in Security RSA has more announcements of identity based approaches of agile and integrated security. There is an upcoming paradigm shift, where identity will allow security across dynamic distributed systems. So as security functions become packaged as appliances that can all be integrated and managed with federated protocols that allow centralized policies to create security and auditability, "security" is relentlessly morphing into "management by identity.“ - Phil Becker, Editor, Digital ID World Copyright © 2005 Imanami Corporation. All Rights Reserved.

Realizing the Potential of Digital Identity Deployment considerations, lessons learned: Begin by cleaning your own identity house Start looking at how you use identity, authoritative sources, processes You still need LDAP directory, meta-directory, and provisioning One tool or one suite won’t solve all your IdM problems 80% politics and business, 20% technology Your mileage may vary, but build in time to get stakeholders on board Carefully scope the problem you’re trying to solve Manage expectations: Don’t try to solve all problems at once Pick projects with early demonstrable results; it’s a long journey, with small steps Build momentum (and political capital) for next phase(s) All of these are 100% independent of product selection Copyright © 2005 Imanami Corporation. All Rights Reserved.

Contact Resources Robert Haaverson, CEO Imanami Corporation 925-371-3000 robert.haaverson@imanami.com Resources Digital ID World, May 9-12 Hyatt Embarcadero, San Francisco Digital ID World Magazine – http://www.digitalidworld.com Burton Group – http://www.butongroup.com Open Group – http://www.opengroup.com Sans What Works – http://www.sans.org/whatworks Copyright © 2005 Imanami Corporation. All Rights Reserved.