Identity Access Management (IAM)

Identity & access
management

Jacques Folon

Chargé de cours ICHEC
Me. de conférences Université de Liège
Prof. invité Université de Lorraine (Metz)
Prof. Invité ISFSC, HE F.Ferrer

Partner Edge-Consulting

Cette présentation est sur

www.slideshare.net/folon

elle est à votre disposition

IAM
1. C’est quoi ?
2. Quel est le contexte
actuel?
3. IAM & cloud computing
4. Pourquoi en avons nous
besoin?
5. To do list
6. IAM et vie privée
7. IAM et contrôle
8. e-discovery
9. Conclusion

1. IAM c’est quoi ?
Single Sign
Password On
Management Secure Remote
Fede
ratio
n Access

Role based
Manageme
nt
Provisionin
g
Web
Services
Security
&
Auditing
Authorization ng
R eporti

es
ctori
Dire
DRM Strong ion
ticat PKI
Authen

Source: Identity and Access Management: OverviewRafal Lukawiecki - Strategic Consultant, Project Botticelli Ltd rafal@projectbotticelli.co.uk

Q: What’s posted on this
monitor?
a – password to financial application
b – phone messages
c – to-do’s

Q: What determines your
employee’s access?

a – give Alice whatever Wally has
b – roles, attributes, and requests
c – whatever her manager says

Q: Who is the most privileged
user in your enterprise?

a – security administrator
b – CFO
c – the summer intern who is now working
for your competitor

Q: How secure is your
identity data?

a – It is in 18 different secured stores
b – We protect the admin passwords
c – Privacy? We don’t hold credit card
numbers

Q: How much are manual
compliance controls costing
your organization?
a – nothing, no new headcount
b – don’t ask
c – don’t know

Today’s IT Challenges

More Compliant Business
• Increasing regulatory demands
• Increasing privacy concerns
• Business viability concerns

More Agile Business More Secured Business
• More accessibility for employees, • Organized crime
customers and partners • Identity theft
• Higher level of B2B integrations • Intellectual property theft
• Faster reaction to changing requirements • Constant global threats

State Of Security In Enterprise

• Incomplete
• Multiple point solutions from many vendors
• Disparate technologies that don’t work together

• Complex
• Repeated point-to-point integrations
• Mostly manual operations

• ‘Non-compliant’
• Difficult to enforce consistent set of policies
• Difficult to measure compliance with those policies

Identity Management Values

• Trusted and reliable security

• Efficient regulatory compliance

• Lower administrative and development costs

• Enable online business networks

• Better end-user experience

IAM n’est pas uniquement une tâche
informatique !
La gestion des identités consiste à gérer le
cycle de vie des personnes (embauche,
promotion, mutation, départ, etc.) au sein de
la société et les impacts induits sur le système
d’information (création de Comptes
utilisateurs, attribution de Profils utilisateurs,
mise en œuvre du contrôle d'accès, etc.).

source clusif 15

IAM n’est pas uniquement une tâche
informatique !
• Cette gestion des identités doit pouvoir
être faite d'un point de vue fonctionnel par
des non-informaticiens (exemple :
Ressources Humaines, Maîtrise d’ouvrage,
l’utilisateur lui-même) et d'un point de vue
technique par des informaticiens
(exemple : administrateur, Maîtrise
d’œuvre).

source clusif 16

La solution de gestion d’identités doit être une solution globale sur la
base d’une infrastructure centralisée avec une gestion fonctionnelle
distribuée et qui intègre les fonctionnalités suivantes :

• la gestion du référentiel central des utilisateurs (alimentation à partir
de référentiels utilisateurs sources),
• la gestion du référentiel central des ressources concernées par la
gestion des droits d’accès,
• la gestion des habilitations (gestion des Profils, Rôles, gestion des
utilisateurs, workflow),
• le provisioning (synchronisation des référentiels cibles de sécurité),
• l’administration décentralisée,
• l’auto-administration (gestion par les utilisateurs des mots de passe et
des données privées),
• l’audit et le reporting,
• le contrôle d’accès (authentification, autorisation).
source clusif 17

Définition
• What is Identity Management ?
“Identity management is the set of
business processes, and a
supporting infrastructure, for the
creation, maintenance, and use of
digital identities.” The Burton
Group (a research firm specializing
in IT infrastructure for the
enterprise)
• Identity Management in this
sense is sometimes called
“Identity and Access
Management” (IAM)

Identity and Access Management is the process for
managing the lifecycle of digital identities and access for
people, systems and services. This includes:
User Management – management of large, changing user
populations along with delegated- and self-service
administration.
Access Management – allows applications to authenticate
users and allow access to resources based upon policy.
Provisioning and De-Provisioning – automates account
propagation across applications and systems.
Audit and Reporting – review access privileges, validate
changes, and manage accountability.

CA

IAM : J. Tony Goulding CISSP, ITIL CA t
ony.goulding@ ca.com 19

IAM c’est par exemple…
• “Bonjour je suis Julie, une
étudiante d’INFOSAFE.”
(Identité)
• “Ceci est mon mot de passe.”
(Authentification)
• “Je veux accéder à la plateforme”
(Authorisation accordée)
• “Je veux améliorer la note de mon
examen.”
(Autorisation refusée)

Mais c’est aussi…

• Un nouveau professeur
• Donc une adresse email, à
donner dès que possible
• Un mot de passe sur ICHEC
Campus
• Un mot de passe Intranet
• Un mot de passe IE Campus
• Définir les autres services
auxquel il a accès

Quelles sont les questions à se poser??

• Les personnes sont-elles ce
qu’elles disent être?
• Sont-elles des membres réels
de notre communauté ?
• Ont-elles reçu les
autorisations nécessaires ?
• Le respect de leurs données
personnelles est-il mis en
place?

Exemples de questions

– Quel mot type de mot de passe donner?
– Quelles sont les activités autorisées?
– Quelles sont les activités interdites?
– A quelle catégorie de personne cette nouvelle
identité doit-elle être attachée?
– A quel moment du processus d’entrée les
autorisations doivent-elles être données?
– Quelles modalités de contrôle sont mises en place?
Peut-on prouver tout cela à un auditeur ?

Le triple A de l’IAM
Authentication
WHO ARE YOU?
Authorization / Access Control
WHAT CAN YOU DO?
Audit
WHAT HAVE YOU DONE?

24

Components of IAM
• Administration
– User Management
– Password Management
– Workflow
– Delegation
• Access Management
– Authentication

Authentication
– Authorization

Administration
Authorization
• Identity Management
– Account Provisioning
– Account Deprovisioning
– Synchronisation

Reliable Identity Data


2. Contexte actuel

Quel est le contexte actuel
qui est à la base du
développement de l’IAM?

Les identités multiples selon F Cavazza

27

Les identités varient selon les plateformes

28

Entre l’identité virtuelle et ...

Dans ce contexte, l’amoncellement de parcelles laissées plus ou
moins à l’abandon dessine un portrait par petites touches. Un peu
comme les tableaux pointillistes : de manière unitaire, aucune des
traces n’est réellement significative. Mais le tableau général, lui,
représente le sujet dans son ensemble. À la vue de tous et pas
forcément sous un angle souhaité…
http://www.buschini.com/2009/12/04/identite-traditionnelle-versus-identite-numerique/
29

• Internet est basé sur des
communications anonymes
Welcome to a digital world
• Les entreprises participent à de
nombreux réseaux générant de
multiples identités
• Les systèmes internes ont parfois des
systèmes d’identifiants différents
• Les utilisateurs sont les maillons faibles
de la sécurité
• La criminalité informatique augmente
• La mise en place de contrôles impose
l’identification
• La gestion des traces est indispensables
• La protection de la vie privée impose
des contrôles

Explosion of IDs
# of Business Partners
Digital IDs Automation (B2B)
Company
(B2E)

Customers
(B2C)

Mobility

Internet

Client Server

Mainframe s
ion
cat
pli Time
Pre 1980’s 1980’s
Ap 1990’s 2000’s

The Disconnected Reality •Authentication
•Authorization
•Identity Data
HR
Finance
•Authentication
•Authorization
•Identity Data

•Authentication
•Authorization
•Identity Data
Office
Enterprise Directory
•Authentication
•Authorization
Infra
•Identity Data
Application
•Authentication
•Authorization
•Identity Data External app
• “Identity Chaos”
– Nombreux utilisateurs et applications
•Authentication
•Authorization In-House
– Nombreuses ID
•Identity Data
Application
•Authentication
– Plusieurs identité par utilisateur •Authorization
•Identity Data
employee
– Plusieurs log in et mots de passe Application
– Multiple repositories of identity information
– Multiple user IDs, multiple passwords
– Management décentralisé
– Conflits business <-> IT

Multiple Contexts
Customer satisfaction & customer intimacy
Cost competitiveness
Reach, personalization

Your CUSTOMERS Your SUPPLIERS
Collaboration
Outsourcing
Faster business cycles; process
automation
Value chain

Your COMPANY and
your EMPLOYEES

M&A
Mobile/global workforce
Flexible/temp workforce

Your REMOTE and Your PARTNERS
VIRTUAL EMPLOYEES

Trends Impacting Identity
Rising Tide of Regulation and Compliance
SOX, HIPAA, GLB, Basel II, 21 CFR Part 11, …
• $15.5 billion spend on compliance (analyst estimate)

Deeper Line of Business Automation and Integration
One half of all enterprises have SOA under development
• Web services spending growing 45%
Increasing Threat Landscape
Identity theft costs banks and credit card issuers $1.2 billion in 1 yr
• $250 billion lost from exposure of confidential info

Maintenance Costs Dominate IT Budget
On average employees need access to 16 apps and systems
• Companies spend $20-30 per user per year for PW resets
Data Sources: Gartner, AMR Research, IDC, eMarketer, U.S. Department. of Justice

Pain Points

Business
IT Admin Developer End User Security/ Compliance
Owner

Too many user Redundant Too many Too many Too expensive
stores and code in each passwords orphaned to reach new
account admin app Long waits for accounts partners,
requests Rework code access to Limited channels
Unsafe sync too often apps, auditing ability Need for
scripts resources control


Cloud Computing: Definition
• No Unique Definition or General Consensus about what Cloud
Computing is …
• Different Perspectives & Focuses (Platform, SW, Service Levels…)

• Flavours:
– Computing and IT Resources Accessible Online
– Dynamically Scalable Computing Power
– Virtualization of Resources
– Access to (potentially) Composable & Interchangeable Services
– Abstraction of IT Infrastructure
 No need to understand its implementation: use Services & their APIs
– Some current players, at the Infrastructure & Service Level:
SalesfoRce.com, Google Apps, Amazon, Yahoo, Microsoft, IBM, HP, etc.

The Future of Identity in the Cloud: Requirements, Risks & OpportunitiesMarco Casassa Mont marco.casassa-mont@hp.com HP Labs Systems Security Lab Bristol, UK - EEMA e-Identity Conference, 2009

Cloud Computing: Models
Cloud
Provider #1
On Demand
Printing CPUs
Service
CRM
Office Service Data
Apps Storage
User Service
… Cloud
Provider #2
Enterprise

Backup
Service
ILM
Service Service
Employee
Service Service 3

Service
Business …
Apps/Service
…
Internal Cloud … The
Internet

Cloud Computing: Implications
• Enterprise:
Paradigm Shift from “Close & Controlled” IT Infrastructures and Services to
Externally Provided Services and IT Infrastructures

• Private User:
Paradigm Shift from Accessing Static Set of Services to Dynamic & Composable
Services

• General Issues:
– Potential Loss of Control (on Data, Infrastructure, Processes, etc.)
– Data & Confidential Information Stored in The Clouds
– Management of Identities and Access (IAM) in the Cloud
– Compliance to Security Practice and Legislation
– Privacy Management (Control, Consent, Revocation, etc.)
– New Threat Environments
– Reliability and Longevity of Cloud & Service Providers


Identity in the Cloud: Enterprise Case
Cloud
IAM Capabilities User Account
Provisioning/
Data
& Confidential
Provider #1
User Account
On Demand
and Services De-provisioning Information
Printing
Service
CPUs
Provisioning/
De-provisioning
Authentication CRM Identity &
Can be
Authentication
Authorization Credentials
Authorization
Audit Office Service Data
Identity & Audit
Storage
Outsourced in Apps Credentials
Service Data
& Confidential
The Cloud … Identity & …
Identity &
Cloud
Information
Credentials
Credentials Provider #2
Enterprise User Account
Provisioning/
De-provisioning Data
Authentication
& Confidential
Backup
Authentication
Identity & Authorization Authorization ILMInformationService
Credentials Audit Audit Service
Service
Employee Identity &
Data Service Credentials Service 3
& Confidential User Account
Provisioning/
Information
Identity & Service De-provisioning
Business Credentials …
Apps/Service
…
Internal Cloud … The
Internet

Issues and Risks [1/2]

• Potential Proliferation of Required Identities & Credentials to Access Services
 Misbehaviours when handling credentials (writing down, reusing, sharing, etc.)

• Complexity in correctly “enabling” Information Flows across boundaries
 Security Threats
(Enterprise  Cloud & Service Providers, Service Provider  Service Provider, …_

• Propagation of Identity and Personal Information across Multiple Clouds/Services
 Privacy issues (e.g. compliance to multiple Legislations, Importance of Location, etc.)
 Exposure of business sensitive information
(employees’ identities, roles, organisational structures, enterprise apps/services, etc.)
 How to effectively Control this Data?

• Delegation of IAM and Data Management Processes to Cloud and Service Providers
 How to get Assurance that these Processes and Security Practice are Consistent with
Enterprise Policies?
- Recurrent problem for all Stakeholders: Enterprise, Cloud and Service Providers …
 Consistency and Integrity of User Accounts & Information across various Clouds/Services
 How to deal with overall Compliance and Governance issues?

Issues and Risks [2/2]

• Migration of Services between Cloud and Service Providers
 Management of Data Lifecycle

• Threats and Attacks in the Clouds and Cloud Services
 Cloud and Service Providers can be the “weakest links” in Security & Privacy
 Reliance on good security practice of Third Parties


4.Pourquoi en avons nous besoin?

•Sécurité
•Compliance
•Réduction des coûts
•Support pour l’audit
•Contrôle d’accès

Source: ftp://ftp.boulder.ibm.com/software/uk/productnews/tv/vh_-_access_and_identity_management.pdf

Economies possibles
• Directory Synchronization
“Improved updating of user data: $185 per user/year”
“Improved list management: $800 per list”
- Giga Information Group
• Password Management
“Password reset costs range from $51 (best case) to $147 (worst
case) for labor alone.” – Gartner
• User Provisioning
“Improved IT efficiency: $70,000 per year per 1,000 managed users”
“Reduced help desk costs: $75 per user per year”
- Giga Information Group

Can We Just Ignore It All?
• Today, average corporate user
spends 16 minutes a day logging on
• A typical home user maintains 12-18
identities
• Number of phishing sites grew over
1600% over the past year
• Corporate IT Ops manage an average
of 73 applications and 46 suppliers,
often with individual directories
• Regulators are becoming stricter
about compliance and auditing
• Orphaned accounts and identities
lead to security problems

Source: Microsoft’s internal research and Anti-phishing Working Group

IAM Benefits
Benefits today Benefits to take you
(Tactical) forward
(Strategic)
Save money and improve operational
efficiency New ways of working

Improved time to deliver applications and
service
Improved time to market
Enhance Security

Closer Supplier, Customer,
Regulatory Compliance and Audit
Partner and Employee relationships


5. IAM to do list
• Création et suppression
automatique de comptes
• Gestion des traces
• Archivage (durée??)
• Vie privée
• Compliance
• Sécurité <> risques
• De plus en plus
d’utilisateurs
• E-business

Les trois éléments

52

6. La protection des données personnelles

Source : https://www.britestream.com/difference.html.

Les informations circulent
Qui vérifie?

Qui doit avoir accès à quoi?
Limitations légales !

Responsabilités de l’organisation

Données reçues et transférées

• Que peut-on
contrôler?
• Limites?
• Correspondance
privée
• Saisies sur salaire
• Sanctions réelles
• Communiquer les
sanctions?

• Sécurité organisationnelle

– Département sécurité

– Consultant en sécurité

– Procédure de sécurité

– Disaster recovery

• Sécurité technique
– Risk analysis
– Back-up
– Procédure contre incendie, vol, etc.
– Sécurisation de l’accès au réseau IT
– Système d’authentification (identity management)
– Loggin and password efficaces

• Sécurité juridique
– Contrats d’emplois et
information
– Contrats avec les sous-
contractants
– Code de conduite
– Contrôle des employés
– Respect complet de la
réglementation

Definition of e-discovery
• Electronic discovery (or e-discovery) refers to discovery in civil
litigation which deals with information in electronic format
also referred to as Electronically Stored Information (ESI).
• It means the collection, preparation, review and production of
electronic documents in litigation discovery.
• Any process in which electronic data is sought, located,
secured, and searched with the intent of using it as evidence
in a civil or criminal legal case
• This includes e-mail, attachments, and other data stored on a
computer, network, backup or other storage media. e-
Discovery includes metadata.

Recommandations
Organizations should update and/or create information
management policies and procedures that include:
– e-mail retention policies, On an individual level, employees
tend to keep information on their hard drives “just in case”
they might need it.
– Work with users to rationalize their storage requirements and
decrease their storage budget.
– off-line and off-site data storage retention policies,
– controls defining which users have access to which
systems andunder what circumstances,
– instructions for how and where users can store data, and •
backup and recovery procedures.
– Assessments or surveys should be done to identify business
functions, data repositories, and the systems that support
them.
– Legal must be consulted. Organizations and their legal teams
should work together to create and/or update their data
retention policies and procedures for managing litigation

9. Conclusion

• IAM n’est pas uniquement une
question informatique les aspects
juridiques et de gestion sont
essentiels
• Attention aux aspects compliance
• Plus de sécurité nécessaire
– Cloud computing
– Virtualisation
– Data privacy
– archivage
• Transparence
• E-discovery

L’IAM est aussi une opportunité

• Repenser la sécurité
• Limiter les risques
• Réduire les coûts
• Repréciser les rôles et
responsabilités
• Appréhender les risques futurs

Jacques Folon
Jacques.folon@ichec.be

Je suis prêt à répondre à vos questions

Identity Access Management (IAM)

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Ähnlich wie Identity Access Management (IAM)

Ähnlich wie Identity Access Management (IAM) (20)

Mehr von Prof. Jacques Folon (Ph.D)

Mehr von Prof. Jacques Folon (Ph.D) (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Identity Access Management (IAM)