Building a Secure Cloud with Identity Management

Editor's Notes

• #2: Bridging The Security Gap Between The Enterprise and Cloud.While public and private clouds simplify the IT environment, they complicate security and compliance by disrupting the control and administration of user access. As a result, security is the number one barrier to cloud adoption. Organizations that move applications into the cloud have to bridge the gap between the enterprise and the cloud by providing user administration, application authorization, authentication and compliance reporting to restore control and address regulatory mandates. Oracle Identity Management provides multiple solutions to address the speed, scale and trust required by organizations to bridge the gap and unlock the potential of the cloud.
• #5: I want to set some context for the talk by describing the dramatic changes in end user requirements. As we speak to customers we are amazed by how large an impact cloud computing play into their strategy for the future. The Cloud is the biggest opportunity to reduce cost The barrier to most of the cloud projects today is security …As we speak to customers in diverse verticals with regard to cloud – the feedback is that security is the number one barrier to unlocking the opportunity – lines of business complain about the loss of forensics , the loss of visibility and reporting and more importantly the compliance issues. Cloud applications are enabling new business and IT models through hosted and flexible, scalableapplications. Yet, mass migration to cloud-delivered applications has been slowed due to concernsabout security. Key barriers to entry are focused around loss of control, lack of cloud access visibility, and enforcement of corporate governance and regulatory compliance.Central to these concerns is that corporate users manage their own accounts for cloud applications, typically using weak passwords that are disconnected from the corporate identity infrastructure. User actions in these disconnected applications go without oversight or authorization, leading to risk of sensitive data loss and compliance violations. Additionally, the lack of standardized logging prevents administrators from monitoring and correlating cloud application user activity with internal audit repositories.
• #7: We have been putting in the plumbing – and focused on inputs and outputs – we need an intelligent approach ( Examples)Today we are fragmented As we try to respond to insider fraud and breaches – our systems are not well prepared. Our current approach to access control is fragmented. By Fragmentation we disconnected in Workflow, Visibility and Audit Workflow is critical Workflow – when a user changes jobs the ability to detect the change and propagate changes to all of the systems they have access to. In addition when a user requests access – being detective about the controls and separation of duties constraints on the user. We have lots of cases where users separate and still have access to systems. It means if a user is on you CRM application in a session and they are removed being able to shut down the access in real time.360 view of the user Visibility – The lack of a 360 degree view on user access and more so fine grained access is challenging. Being able to tell immediately by looking at a user if they have been granted emergency access or look a their historical access. We hear stories about organizations doing certification reviews and certifying access to employees that are no longer with the company. – CLEARLY CERTICICATION REVIEW ALONE IS NOT THE ANSWER. This is an example of how fragmentation hurts.Audit reporting Audit Reporting – Lastly audit reporting – because our identity systems are fragmented companies are spending 40% of their IT budgets on compliance issues.We are not able to address the challenge effectively because our view of access is fragmentedChange today does not propagate as fast as HR changes occur. Or as system changes occur – this is a real problem – Many people can
• #8: So we have this new techology and opposition and opportunity, but why?Benefits are compellingVertical requirements – Organizations have worked diligently to customize and adapt COTS to address the requirementsIntegration requirementsNo one wants parts
• #9: Cloud-ready IdM is a set of Identity Services that identify, control, and manage users and their access to Cloud resources. There are 3 dimensions to an Identity management solution which is cloud ready.Identity as a bridge to cloudWhen organizations adopt SaaS applications ex. Google apps, they may want to have local authentication or delegate authentication to the cloud provider, while maintaining local SSO system interoperating with the cloud provider through federated assertions. Also, cloud consumers needs to ensure users can securely access applications from a range of different devices…this too creates the need for local security enforcement. So there is need to extend identity administration and access review to cloud applications – integration between the two (standards)Foundation for CloudOne of Oracle’s goals is to provide customers with the technology they need to power cloud offerings. ManyOrganizations are looking to add new business services which need to be underpinned with standards based identity management technology. Many organizations also want to provide a consistent user experience for users irrespective of which device they access business services from. With its Identity Management 11g, Oracle is delivering the foundation for a unique architecturecalled Service-Oriented Security which is all about making every aspect of the Oracle identity management stack service enabled through shared service interfaces based on open standards . With Service Oriented Security, we are abstracting out the complexity of implementing security into applications so that developers can now seamlessly weave security into their applications, as well as deploy them rapidly into a cloud based identity management framework.Hosted as a Cloud Service Some organizations have a business requirement to externalize specific Identity Management tasks to avoid operational expenditures. For example, Certain tasks can be outsourced – examples include service request management , layered security etc. For such organizations, IdM hosted by a Managed Service Provider can create unique business value. In order to simplify administration, managed service providers (MSPs) typically delegate administration tasks to customers. However, deploying and maintaining an identity infrastructure may not be a core competency for these MSPs. Oracle offers a set of turnkey IDM tools to help MSPs offer core IDM services such as identity synchronization, password synchronization, role based provisioning, and enterprise single sign on.
• #10: In the cloud computing context, the ability to authenticate your external users such as partners, suppliers, and consumers becomes very important. And so does the ability to provide cross domain, cross-perimeter single sign on between services. For example, organizations may want all of their users to leverage an external cloud application without replicating all of that identity information in a third party product. Many organizations also want the convenience of having SSO for their users as they access not only internal applications but also SaaS applications in the cloud. Oracle offers a best in class Access Management offering called the Oracle Access Management Suite Plus which delivers SSO, Federation, Security Token Service and centralized policy management for web applications. With our Access Management solutions, an organization can link its online services with those of its partners and constituents without imposing on them the additional burden of managing user identities and credentials. An additional benefit of Oracle Access Management is a consistent user Irrespective of which device users are accessing applications from.
• #11: The ability to collaborate seamlessly with your partners, vendors, customersand so on is important in the cloud context . For example, an organization may already have all of its internal user identities stored in an AD and its external users such as partners and vendors in an LDAP directory and they may want all of their users to leverage an external cloud application without replicating all of that identity information in a third party product. Many organizations also want the convenience of having their users sign on once to access not only internal applications but also SaaS applications in the cloud. Oracle Access Management includes Federation which allows organizations to do more business online by enabling business partners seamless and secure single sign-on access to various protected applications. Oracle offers extended standards-based support for several federation standards including the latest versions of SAML, OpenID, Oauth, Liberty Alliance Federation, WS-Fed and Windows CardSpace. This enables flexible integration capabilities and helps accelerate deployment in heterogeneous and cloud environments
• #12: With Oracle Entitlements Server, you can externalize and centralize fine grained authz policies based on industry authz standards.Externalization of Fine-grained Entitlements takes out the complexity of building security policies into each application and it simplifies the enforcement of granular security policies simplifying the task of compliance with the newer regulations around data privacy. The centralized management of entitlements enables your security policies and business logic to evolve separately. Because your security policies are maintained and evolved separately, developers can focus their resources on streamlining the business logic. This leads to operational efficiencies. OES can enforce authz policies in real-timeenabling mission-critical apps to make millions of authorization decisions in under a second.Oracle Entitlements Server offers comprehensive support for several modern security standards such as XACML, NIST RBAC, Enterprise RBAC, OpenAZ and JAAS. Support for a broad spectrum of standards provides greater choice and flexibility for customers when it comes to enforcing granular security policies on the basis of user roles, run-time attributes, context-aware conditions or any combination of those.
• #13: Defense against Sophisticated security threats needs sophisticated security solutions. Threats such as phishing, session hijacking, and so on are very hard to defend against with traditional security mechanisms. The traditional ways of defending against external threats is by strengthening authentication at the server end. Strong auth solutions like hardware tokens are not only expensive but are vulnerable like we saw with the recent RSA breach. That is why Oracle has introduced a technology called context-aware security to combat this problem. Just like in the real world where we rely on multiple attributes to identify a person, in the digital world we can rely on multiple data points to ensure that a user’s digital identity is real. The data that we have available to us is data such as user identity, device identity, geographical location, IP address, transactional information and application data. In addition we can also pull historical data from a user’s previous interactions with the site and 3rd party data such as data derived from identity proofing providers.. All of these data points can be used to evaluate risk and take action in real time to prevent fraud. If the perceived level of real-time risk is high, actions can be initiated against threats with secondary authentication techniques layered on top of existing authentication schemes – for example - the system can challenge the user some knowledge based questions. Alternatively, in extreme cases the transaction may be blocked and reported if the level of risk is high.
• #14: Catalog Roles, Entitlements, Accounts in Application Instances : Connected & Disconnected Centralized Catalog Lifecycle ManagementAutomated Catalog Population from Apps and Asset Management SystemsAutomatic Seeding and Manual Edits for Keyword Tags & CategoriesOOB Fields: Business Friendly Glossary, Risk Levels, Search Keyword tags, Resource Audit Objectives, Navigational Category etcBusiness user Friendly Search PatternsFull Text Search with Auto-TaggingCategories, Keyword Searches, Saved Shopping CartBookmark/Quick-Links – Saved Catalog QueriesShopping Cart Experience“Add” Access to Cart and then “Submit”Saved Shopping Carts or ProfilesCreated by Admins to provide “out of box” request accelerators specific to jobs, locations, departments etc
• #15: BASICLY: Prevent fraud from occurring by making it simple to confirm that the right users have access to the right systems applications and information - this requires us to provide business oriented user experiences – reporting to them what has been authorized and certify it and incorporating the analytics they need to understand if the access is appropriate and giving them a simple way to remediate any anomaly – Prevention starts with the appropriate level of controls to make sure the right people have the right access – things break and sometimes and we need to constantly analyze the data to check it complies with what we have done in the past. LET ME PROVIDE A HEALTHCARE EXAMPLE– but I think many vertical industries can parallel this:In healthcare organizations many hospitals and health delivery networks not only need to certify who has access to patient data they need to meet the requirements of disclosure laws and also make sure that legitimate users are not accessing information they shouldn’t like practitioners looking at the private health records of VIP patients.As a preventive control we would certify user access – but that alone does not tell us who has viewed which patient records - we need to be able to collect access audit information from the the registration system, the medical records systems and potentially an data requests that pass through the HL7 interfaces and correlate these by user id to know who is doing what. But just correlation is not enough – we would have to filter to alert on the specific anomalies that matter. IN ONE OF OUR DEPLOYMENTS AFTER A ONE DAY PILOT WE FOUND AN EMPLOYEE WHO WAS LOOKING AT INFORMATION THEY WERE NOT SUPPOSED TO – We have to be detective - This situation would be true for heavily regulated applications in financial services as well – Where they are looking to maintain the confidentiality of data between the sell side and buy side.Today Oracle has two offerings that target this relationship – Our Oracle Identity Analytics offering – which provides identity analytics, certification review and role management and our Security Governor that can look at user activity and detect anomaly.
• #19: Why Consider SaskTel for Cloud Computing?SaskTel is the primary provider of Telco services in the Province of Saskatchewan, Canada. With more than a Billion dollars in annual revenue and responsibility for executing critical service delivery for assets including 911, SaskTel has to be operationally efficient and stable. Financial and operational stability are critical elements to consider when evaluating your potential Cloud Computing provider. This consideration becomes even more critical when Identity, Access and related security services are used to compliment an On Premise environment. Core Cloud operational delivery models are nothing new to Oracle and SaskTel. Oracle products have been hosted by SaskTel for nearly a decade. This includes both US and Canada based subscribers. SaskTel and Oracle are taking their relationship to the next by offering Oracle Technology based Cloud Services including Identity Management.SaskTel’s Identity Management Centre of Excellence is very well funded and executes in Tier 2 + data centers owned and operated by SaskTel in Canada. Oracle’s On Demand (Cloud) facilities are being used to launch SaskTel Cloud services in the United States. As a result, you are assured that binding service delivery and service support requirements are safe when partnering with SaskTel for your Identity Program.
• #20: How to get started?Having specific goals in mind when contacting your Oracle License Rep will allow SaskTel and Oracle to quickly position a logical starting point for your Identity Program. It doesn’t really matter where you start. Many tenants are interested in Identity Provisioning while others are only initially interested in Identity Analytics or Access Management. Oracle’s Identity portfolio is engineered to work together. SaskTel’s Identity Cloud is engineered to ensure fast delivery and operational reliability.Most tenants initiate cloud adoption using a Proof of Concept trial model. This approach is executed based on predetermined scope and success criteria. Once the Proof of Concept is successfully executed, business processes and technology configuration elements are quickly refined and promoted to Quality Assurance and Production. Your Identity Program will never truly be done. Continuous improvement allows for agility and “Lean Thinking”. SaskTel prefers to enhance your Identity Program in small batches based on defined business value. You will also benefit from the “tribal knowledge” generated by executing our defined method across all tenants.Get started today by contacting your Oracle License Rep. Ask your License Rep about how the SaskTel Identity Management Centre of Excellence will reduce Time to Value, Operational Cost and mitigate risk for your Identity Management Program.Note:SaskTel and Oracle have a Global License arrangement. This means your local Oracle License Rep anywhere in the world can engage SaskTel’s Identity Management Centre of Excellence.
• #21: Earlier in this presentation we discussed how there is gap in security risk between the enterprise and the public cloud. Oracle Identity Management can bridge the gap by effectively reducing risk and fragmentation for various cloud deployment options.Oracle Directory Services solutions help reduce latency and fragmentation by centralizing and consolidating identity data. With Oracle’s next generation directory server called OUD, organizations can scale their directory servers to billions of identities. Oracle Access Management solutions bridge fragmentation across security silos by centralizing and consolidating security policies. For example, with Oracle Security Token Service identities can be propagated seamlessly from applications to downstream web services via standards based tokens.Oracle Identity Manager and Oracle Identity Analytics reduce latency by consolidating roles and entitlements. With OIA, organizations can meet the challenges for frequent attestations. Finally with Oracle Adaptive Access Manager, we can reduce risk and latency by preventing fraud in real-time. OAAM can layer multi factor authentication on top of existing auth schemes making auth stronger without the use of any additional hardware.
• #22: Recently Aberdeen Research published a brief comparing the benefits of a platform approach vs a point solution approach. Many organizations use an IAM suite to meet their identity and access management requirements and that is refered to as a platform approach. In contrast there are other organizations that use a collection of best of breed solutions from multiple vendors and that is referred to as the point solution approach. In compiling their research report Aberdeen interviewed more than a 100 odd customers and their findings were very interesting. They found that a platform based approach to IAM resulted in a cost savings of 48% over a comparative point solution approach. So in effect using an IAM platform can help organizations using a collection of point solutions to recover their investment with a positive ROI. This paper is available on o.com/identity for download.