identity and access management in the era of digital transformation
Post on 12-Apr-2017
105 Views
Preview:
TRANSCRIPT
Identity and Access Management in the Era of Digital Transformation
Selvaratnam Uthaiyashankar VP – Engineering WSO2
Identity and Digital Business
• Identity is at the heart of Digital Business
Image source: http://coranet.com/images/network-security.png
Identity Centric
• Digital Business is all about “User”– How do we know who is accessing– Things user can access or do– User’s preferences– Rules User has to adhere– Relationship with other entities
Proper identity enforcement is essential for customer experience, security, privacy
Authentication
• Direct Authentication– Basic Authentication– Digest Authentication– TLS Mutual Authentication
Service Providers
Authentication
Service ConsumptionImage Source : http://www.densodynamics.com/wp-content/uploads/2016/01/gandalf.jpg
Digital business requires seamless integration of various systems…
Identity Challenges When Integrating Multiple Systems
• Different username, password (credential) for different systems– Preferred username is already taken– Using same username/password might become a security risk
• Too many username, password• Loosing possible collaborations between applications
Authentication• Brokered Authentication
– SAML– OAuth : SAML2/JWT grant type – OpenID– OpenID Connect
• Single Sign-On
Service ProvidersService ProvidersService Providers
Identity Provider
Service Providers
Authentication
Service Consumption
Trust
Image source: http://savepic.ru/6463149.gif
Users Might Want to Use Their Social Identities
• BYOID
Users Might Want to Use Their Enterprise Identity
• Trust between different Identity Domains• Identity Federation
Service ProvidersService ProvidersService Providers
Identity Provider B
Service Providers
Authentication
Service Consumption
Trust
Identity Provider A Trust
Multi-option Authentication
Identity Bus
Identity links all the systems. You just increased the risk of attack on your identity…
Often, weak link is poor user credential
https://www.infosecurity-magazine.com/news/compromised-credentials-quarter/
Multi Factor Authentication
• What you know• What you have• What you are
Image source: http://it.miami.edu/_assets/images/multifactor1.png
Adaptive Authentication
• Ability to change authentication options based on the context
https://3c1703fe8d.site.internapcdn.net/newman/gfx/news/hires/2013/howdochamele.jpg
Provisioning Users
• Self Service– Complete user management– User Portal
• Approvals and Workflows• Just In Time Provisioning
http://blog.genesys.com/wp-content/uploads/2014/07/Road-Sign-Self-Service.jpg
Provisioning Users in Multiple Systems
Access Control
• Principle of least privilege• Role based access control• Attribute based access control• Fine-grained access control
with XACML
http://findbiometrics.com/assets/iStock_Access-300x225.jpg
Auditing User Activities
• You might not know who will access your system (BYOID)
• Full Audit on user activities are important– Specially on User Management, Admin
operations– Who, What, From Where, When, How
• Accountability, Reconstruction, Problem Detection, Intrusion Detection
http://cdn.gocertify.com/images/Auditing%20team%20going%20over%20report.jpg
Analytics
• Understanding user behavior• Predicting future needs• Fraud detection
http://www.labrechedigital.com/images/analytics.png
API Security
• APIs are powering the Digital Business• Ability to secure the API (OAuth)• Identity delegation
https://edinversity.files.wordpress.com/2013/07/handing-over-car-keys.jpg
IoT is an Essential Element in Digital Business
• Identity Include “Things”• Securing your IoT devices is a must• Consider scalability of your IAM System
https://media.licdn.com/mpr/mpr/shrinknp_400_400/AAEAAQAAAAAAAAWRAAAAJDkwODMwYzIyLTA5MzktNDAwZi05ZmI4LWJkYTAyM2U4MDBlNQ.jpg
Perimeter of Your Digital Business will Increase
• Data is in cloud, mobile devices• Borders across systems don’t work anymore• Your Attack Surface increases
– you can’t remove unused features in the cloud services• Security by obscurity doesn’t work anymore• Expect hacking, DoS attacks, phishing attack• Controlling access, monitoring, analyzing and predicting attacks
are the way forward
Bridging Cloud and Internal Systems
• Connectors to bridge Cloud Systems and Internal Systems– Might not be able to open ports for
outside world
http://www.stratoscale.com/wp-content/uploads/gap-1080x1080.jpg
Digital Business Requires Agility
• Should be able to connect new systems easily
• Frequent changes to external system• Future Proof• Needs some Identity Mediation
Concepts
http://s3-us-west-2.amazonaws.com/abacus-blog/wp-content/uploads/2015/10/dog-agility.png
Digital Business Encourages Innovation
• Often, security strategy is viewed as restrictive for Innovation– Specially, when involving with public services, APIs
• Security should be transparent to the user for better user experience
https://www.gatesnotes.com/~/media/Images/Articles/About-Bill-Gates/Accelerating-Innovation/innovation_2016_article_1200px_v1.jpg
Digital Transformation Requires Cultural Changes
• More and more, business units are in control rather than IT and security teams– Yet you need to know who is
accessing, what they are accessing, etc.
• Understanding this cultural shift will reduce frustrations
http://www.leehopkins.net/wp-content/uploads/2010/11/iStock_000010822711XSmall_thumb.jpg
WSO2 Identity Server
http://cdn.ttgtmedia.com/rms/security/Gartner2014_ASA.jpg
Thank You!
top related