Secure Identity Management

Alan MarkChief Security Strategist

amark@novell.com

Novell, Inc.

Agenda

Identity Management Exposed Account Management Advanced Authentication SecureLogin Services Controlling outbound Access Controlling inbound Access

So many identities

Personica1002

Tracks resume, job openings,offer letters etc.

PeopleSofta1001

New "Regular"Employee

Documents

HR Departm ent Em ployeeT erm ination(T erm )

Notification Process Via E-Mail

(Em T erm )(HR Line 1)

InfoSourcea1008

(W orkForce Data)

Maxim oa1011

(O ld FacilitiesApplicaton)

B IG (Requests byPhone 1-6000(F irst Phase)

Vantive(Help Desk)(HD)

NW Adm in. (Tool that facilitates account

creation, activation etc.)

NDS(Novell D irectory

Services)

G roupW ise

i1001Reg. Employee Inf.

TerminationInf.

InfoSource E-m ailO r

Help Desk(HD)Personnel E-Mail

TerminationInf.

Termination Inf.V ia E-Mail (W eekly Report)

Termination Inf.V ia E-Mail (Daily Notification)

Security Personnel or Access Utah/SJF

E-Mail

Adm inistrators &Managers

Budget Analysts orFinancial Planning

Analysis (FP&A)

Oraclea4001

Request entered intoO racle W ebRequisitions

HardwareRequest

Arc

hib

us D

ata

Syn

c/M

an

ua

l

Request Module for lights, heat, ac,p lum bing, boxes for m ove, furniture

m oves, to ilet p lugs, paper products, SJFkeys, vending requests, equipm ent

service requists

Notification to Que on Web

Call requests to HD forEm ployee Account

T erm ination

Notification to Vantive(Creates Vantive incident)

HD deactivates accountsin Infosource

(No incident is created)

Subscribers T oT erm ination Data

(W eekly Report)FromHum an Resources

Vantive notifies HD foraccount activation/

deactivation

Build ing T echs, CachValley Elect.,

Com puCom , HR &BayQ uality, AccessFor Incidents/W ork

O rders

UNS(Unique Nam e

Search)(Searches NDS,G W & Alliases in SMT P

Agent 86

W estinghouseAccess Control

System

EPI(Security Badgecreation App.)

W orkForce AccessApplication

filled out & approvedby Manager

ID Badge CreatedW ith "AccessRequirements

Number"

Badge created & Bar Coded(Bar Codes are linked to Employee ID,

but said linkage is not being used)

Badge activated with Access R ights

Adm inistrators &Managers

ContingentW orkforceDocuments

Oracle, Equity Edge, Metlife,ADP, Etc.

(401k, Health, Stock etc.)

IS-NDS & G .W .G ateway U tility

T elecom m unications(Telephone # Ext. are

entered into Infosourceby Admins)(Telecom

Personnel sync jack#'sinto Infosource)(Audix# 's& Names entered Man.)

(K1) Single office keys cut(K2) Keys cut w ith Security approval

Facilities Move/Preventive Maintenance/Cushm an & W akefield

Bon Appe'tit

W eb(Browser Access)

Archibus DB(Located in Phoenix AZ )(DB used by BIG)(W ill be

used to house CADdrawings)

Security Approval forK2 (Master Keys)

No Special Approvalfor O ffice Keys

(K1)(Key Info Stored inKeyCode Sybase DB)

K2 Req.Forwarded

T hanksG iving Point (Landscape &G ardening)

PBX

Phone Ext.RetrievedFrom PBX

16411 AuxilliaryPhone System

Extract For16411

Entered

Archer Managem ent(Account Codes, Em p

Status, Pref. Nam e,Adm in Info checked in

InfoSource)(Som em ailstop correctionsm ade to InfoSource)

ARIST O DB(DB used byArcher, m ail

delivery)

O utsourced W ork Flow& W ork O rders for

Contractors w ith BIGw eb queue

W eb(Browser Access For

Incident and W ork O rdercreation in Vantive)

Incidents or W ork Requestsentered via Innerweb

NDSDis. Name, Dep. Name, F irst-Last Name, Phone#,Fax, Job T itle, Mail Stop, Infosource ID , W orkForce ID

CorporateD irectory

i1032 (Mail Stop/Domain, PostOffice,GroupWise User ID 'e-mail name'

Busness phone, Fax#, Full Context)

Preferred Nam e or Legal Nam e(if Preferred is b lank), Business T itle,

Status, Account Code, Manager ID ,W orkforce ID , Regular-T em porary

Identities in the Directory

Simple– White pages– Names in a database

Complex– Identities & Relationships– Roles and responsibilites

Identities in an eDirectoryThe Directory is the key to unified

management of identities and communities

• Digital ID• Management• Single Sign-on

Identity• Business-to-Business • Consumer / Business• Person-to-Person• Enterprise Applications• Communities of interest

Communities

Security in the Directory

The directory provides security, policy and relationship management

Enforces the processes, policies, procedures, and relationships that define and drive the business

policiesrelationships

identitiesDirectory ServicesDirectory

Services

Marketing

Sonja Geir Craig

Directory onNT (secondary)

Live, continuous backup; changes replicated in real-

time

Live, continuous backup; changes replicated in real-

time

Linking Directories

Directory onNetWare (primary)

Directory onSolaris (primary)

Directory onNT (secondary)

Linking Identities

Directory onNetWare (primary)

Directory onSolaris (primary)

User: SonjaName: Sonja JohnsonPhone: 17397Location: PRV-H-133

Name: Johnson, SonjaPhone: +1 801-861-7397Location: PRV-H-133

User: SJohnsonName: Sonja JohnsonPhone: (801) 861-7397Location: Provo, Bldg H, Floor 1,Section 133, USA

Linking Global Identities

The Liberty Conformance and

Interoperability Group is responsible for

defining and supporting a process

of interoperability between systems.

projectliberty.org

Linking identities in applications

Directory Services

SAP

Convergence Creates a New Class of Applications

Digital Signal Processors (DSPs)

Operating Systems

Services

Applications

Physical Network Infrastructure

Hosted TransactionsNew Class of Applications

“Hire an employee”

“Who is the expert on ...”

DIRECTORY

Ap

plicatio

n sh

im

Applicationor

directoryor

database

NDSdatastore

Rules and stylesheets

Rules and stylesheets

DirX

ML

Join engine

DirX

ML

DirXML Architecture

Publisher Publisher

Subscriber Subscriber DirX

ML

Ap

plicatio

n sh

im

Data Shari g

Consolidating Management of Enterprise Data

Multiple directories– HR, PBX, e-mail, ERP, Finance, etc.

Common data between the directories– User data, enterprise data

Authoritative sources must be preserved– One-way data flow

– Bi-directional data flow

– Rules DirXML

solution

is a general purpose

Supporting platforms/interfacesLDAP v3

NDAP

DENActiveX

ADSI

ODBCC/C++

Visual Basic

OS/390

NTNetWare

Solaris

Linux

XMLJavaJava BeansJNDI

Identity- The key to relationships

Offer unique services, privileges and relationships

based upon an identity

• Personalizes the net

• Gives them what they need (but only what they need)

• Empowers individuals to manage important relationships and data

What an identity determines

Who you are Where you are What data you can access How you authenticated

Directory-Linked identities

iClick

PeopleSoft

Personic

NDSInfrastructure

Tree

D irX M L In terface

D irX M L In terface

GroupW ise

D irX M L

Em ployee form sscanned in to

system

PBX

NDSW orkforce

T ree

B.I.GApps

EmployeeAssimilation

Process

TrackApplicantProcess

Self ServiceInform ationforewarded

to PeopleSoft

NDS Customer

Tree

Vantive

D irX M L

D irX M L

NDSAuthentication

Tree

W estingHouse

e-Guide

Oracle/SeibelEtc.

W ITS(Mail Delivery

System )

D irX M L EPI

ManagerSelf

ServiceProcess

Whitepages

PayrollHR

Health careplan

Dental plan Stock planI have a new phone

number

My Company

401k

Changes Are Hard to Manage

Health careplan

Dental plan Stock plan“I have a new phonenumber.”

401k

Using XML to link systems

DirXML

DirXML manages the changing data inside and outside the firewall

Whitepages

PayrollHR

My Company

Account Management

NDS eDirectory

Accounts

AccountManagement Sync

RACF, ACF2, Top Secret

Solaris

Tru64

VMS

HP-UX AS/400AIXMVS

On Sparc & Intel

Linux

Free-BSD

NDSADNT Domains

NAM 3.0

A cross-platform account management system– Management of user accounts in heterogeneous

platform environments

– Based on Novell eDirectory™

– Provides both central and distributed user account management

– Facilitates user authentication across platforms with a single user ID and password

Account Management 3.0 Facts

- A new product. Not based on Account Management 2.1.- Aimed at enterprise-level engagements.- Based on a new paradigm.- Considers goals and strengths of both central IS and platform Administrators.-- Not named “Account Manager”!

Two Problems To Solve

User Account Provisioning – How to automate the process of grants, management and revoking the right accounts to the right systems at the right time, and giving the administrators of those systems ultimate control over the provisioning process on their respective systems?

Password Management – How do you provide a mechanism where the user has the same password for all systems, no matter how he attaches to or uses those systems?

One Product solves both problems

Novell’s Account Management Solution solves both the Account Management and Password Management problems for a wide variety of Operating Systems.

•builds on the scalability of eDirectory, •the cross-platform history of prior versions of Account Management and NDS Authentication Services, •the extensibility of DirXML

Account Management

Account Management

NT 2000 LinuxSolaris(x86)

HPUX

AIXTru64OS/390

AS/400

VMSApp

xSolaris(sparc)

FreeBSD

eDirectory

NetWare …NT/2000Solaris(Sparc)

Linux AIX

Account Management leverages eDirectory identities across a large variety of platforms, independent of Directory storage

location.

Account Management

NDS eDirectory

Accounts

AccountManagement Sync

RACF, ACF2, Top Secret

Solaris

Tru64

VMS

HP-UX AS/400AIXMVS

On Sparc & Intel

Linux

Free-BSD

NDSADNT Domains

Password Sync

NDS eDirectory

NDS ASAMPassword Sync

RACF, ACF2, Top Secret

Solaris

Tru64

VMS

hp-ux AS/400AIXMVS

On Sparc & Intel

Linux

Free-BSD

NDSADNT Domains

NFA Pwd

Account Provisioning to a Target

By permitting a collaborative unit such as a container or a group to a target system, you automate the management of all users that may be associated with the collaborative unit in the future.

OS/390 LPAR 1

AIX Mail Server

Atlanta NT DomainAIX

RACF, ACF2, Top SecretMVS

NT Domain

AM-Outbound

RACFOS/390

eDirectory

AM PlatformServicesReceiver

AM Manager

AMJournal

MutuallyAuthenticated SSL

DirXMLAM Receiver Scripts

Novell Account Management

NAM 3.0 is a cross-platform account management system, that

– Allows life cycle management of user accounts in heterogeneous platform environments

– Is based on Novell eDirectory– Provides both central and distributed user

account management– Facilitates user authentication across platforms

with a single user ID and password

Advanced Authentication Associate clearance levels

depending on how the user authenticates

Set security labels on volumes, directory attributes, and single sign-on applications

Login by - password - token - biometric - combo

Clearance levels - pwd - pwd+token - pwd+token+bio - token - token+bio - bio

Graded Authentication

TokenRequired

FingerprintRequired

Graded Authentication (cont.)

TokenRequired

FingerprintRequired

NMAS Partners

Identities in hard-to-reach places

Most users have too many IDs and passwords to remember

Remembering Passwords

Difficult, so people write them down Forgotten passwords result in

– User and Admin frustration – Help desk calls– Compromised security

Storing passwords

Secure storage of user credentials (login names, passwords)

Allow admins to reset but not see passwords

Sync to desktop/laptop Directory-based policies

for password strength

Login Experience

Authenticate to directory

ApplicationApplicationServerServer

DirectoryDirectoryServicesServices

ClientClientWorkstationWorkstation

Launch Application

Credential Challenge

Recieve Secret

(ID/Password)

Request Secret

(ID/Password)

Provide Credentials

Application Starts

Login ID:

Password:

Only some of the supported apps…

Novell SecureLogin

ACT

AOL IM

Citrix

Entrust

Eudora

Goldmine

ICQ

JUNO

Lotus NotesLotus OrganizerMeeting MakerMicrosoft Internet Gaming Zone Microsoft FrontPage

Microsoft Money 98/99MSN MessengerQuicken

Siebel SalesYahoo! MessengerVisual SourceSafeWindows LogonMS SQL

Microsoft OutlookNovell GroupWise®PeopleSoft

Oracle

SoftFront Track for Win

Clarify

QuickBooks ProRumba 6

Attachmate Extra! 6.3Attachmate Extra! 6.5Reflection 7

HostExplorer

PCOM 4.3, 5.0

Internet Explorer WebInternet Explorer Pop-up

Netscape WebNetscape Pop-up

NeoPlanet Web

Opera Web

AOL

Earthlink

Mindspring

MSN

ProdigyWorldnet

Novell Single Sign-on Reviews

InfoWorld: “Finding a security product that can cut costs, simplify users' lives, and improve system security is rare; Novell SSO 2.0 does all of these well. And we wouldn't be surprised if it made your floors shiny and your desserts tasty.”

Network World:“For users, NSSO eliminates the hassles of remembering multiple passwords and reduces the security risks associated with writing them down. For network administrators and help desk personnel, NSSO will reduce the number of calls from users who have forgotten their passwords.”http://www.nwfusion.com/reviews/2001/0115rev.html

http://www.infoworld.com/articles/es/xml/00/10/02/001002esnsso.xml

Authentication from the inside-out

Security ServerSecurity Server

Web server

Authenticateto Directory

cache

data

Directory

The Business Problems

Employee productivity is impacted by free use of the public Internet

Increasing utilization of finite bandwidth Finding the balance between access

requirements and security Providing secure remote access at a

manageable cost Multiple network identities increase cost of

IT management

Novell BorderManager

Control, accelerate and monitor your users’ Internet activities

Safeguard your network against undesirable Internet content

VPN services, an industry-certified firewall, and a scalable content filtering service

Access Rules

Web Surfing Policies

Where you can surf depends on who you are/where you are

Intranet Internet

Sales.myco.com

Finance.myco.com Whitehouse.com

CNN.com

Novell BorderManager 3.7

ICSA Firewall certifiedNew content filtering solution from SurfControl

– 40X as many URL’s in the database as CyberPatrol– More categories– Actively updated– SurfControl is the market leader for content filtering

by a wide margin

VPN client for Windows Me (LAN client only)Virus pattern filtering at proxy, with auto update

Is There a Problem?

Who Is Causing the Problem?

Authentication from the outside-in

DirectoryDirectory

AIXAIX

DMZ

NetWareNetWare

NT/2000NT/2000

SolarisSolaris LinuxLinux

HP-UXHP-UX

OS/390OS/390

Tru64 UNIXTru64 UNIX

Employees

Partners

Suppliers

cache

Web serversWeb servers

Authenticateto Directory

data

Securely Linking B-to-Everything

iChain

•Joining...•world’s most scalable and widely used directory •fast caching system

•adding...•web Single Sign-on•secure access to and protection of data and applications•flexibility of building customer communities

Employees Partner

s

Customers

iChain

iChain Internet Caching Server• Authentication & quick web page access through reverse proxy service

iChain Authorization Server• Access control & digital communities

Web-based Single Sign-on• Implemented on iChain ICS, managed via Authorization Server

iChain Community Server• Web-based application displaying personalized community content

eDirectory 8.5+• Central repository for profile, policies, rules, etc.

Digital Communities

0

10

20

30

40

50

60

70

80

90

1st Qtr 2nd Qtr 3rd Qtr 4th Qtr

Content for suppliers:Suppliers:

Suppliers Community

Content for dealers:Dealers:

Dealers Community

Model: 550 Maranello Top speed: 199 mphPower output: 480 HPEngine: V12, 334 cu. in.Delivery time: 4 weeksInvoice: $239,000

Forecast by modelPartne

rs

Security Identity Management

Identity provisioning between apps Identity provisioning between OSs Advanced authentication Single Sign-on to web and other apps Access control to external web services Access control to internal web services

Security Identity Management Identity provisioning between apps (DirXML) Identity provisioning between OSs (NAM) Advanced authentication (NMAS) Single Sign-on to web and other apps

(SecureLogin) Access control to external web services

(BorderManager) Access control to internal web services (iChain)