Hitachi ID Identity Manager

1 Hitachi ID Identity Manager

Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications

Entitlement administration and governance: Automation, requests, approvals, recertification, SoD and RBAC.

2 Agenda • • • • • •

Corporate Hitachi ID Identity Manager Recorded Demos Technology Implementation Differentiation

3 Corporate

© 2017 Hitachi ID Systems, Inc. All rights reserved.

1

Slide Presentation

3.1 Hitachi ID corporate overview

Hitachi ID delivers access governance and identity administration solutions to organizations globally.

Hitachi ID IAM solutions are used by Fortune 500 companies to secure access to systems in the enterprise and in the cloud.

• • • • •

Founded as M-Tech in 1992.

A division of Hitachi, Ltd. since 2008.

Over 1200 customers.

More than 14M+ licensed users.

Offices in North America, Europe and APAC. • Global partner network.

3.2 Representative customers

© 2017 Hitachi ID Systems, Inc. All rights reserved.

2

Slide Presentation

3.3 Hitachi ID Suite

4 Hitachi ID Identity Manager 4.1 Compliance / internal controls Challenges

Solutions

• Slow and unreliable deactivation when people leave.

• Orphan and dormant accounts.

• Users with no-longer-needed access.

• Access that violates SoD policies or represents high risk.

• Unreliable approvals for access requests.

• Audit failures and regulatory risk.

• Automate deactivation based on SoR (HR).

• Review and remediate excessive access (certification).

• Block requests that would violate SoD. • Analyze entitlements to find policy violations, high risk users.

• Automatically route access requests to appropriate stake-holders.

© 2017 Hitachi ID Systems, Inc. All rights reserved.

3

Slide Presentation

4.2 Access administration cost Challenges

Solutions

• Multiple FTEs required to setup, deactivate access.

• Additional burden on platform administrators.

• Audit requests can add significant strain.

• Automate access setup, tear-down in response to changes in systems of record (SoRs).

• Simple, business-friendly access request forms.

• Route requests to authorizers automatically.

• Automate fulfillment where possible.

• Help auditors help themselves: – With certification, auditors focus on process, not entitlements.

– Reports and analytics.

4.3 Access changes take too long Challenges

Solutions

• Approvers take too long.

• Too many IT staff required to complete approved requests.

• Service is slow and expensive to deliver.

• Automatically grant access: – Where predicted by job function, location, ...

– Eliminate request/approval process where possible.

• Streamline approvals: – Automatically assign authorizers, based on policy.

– Invite participants simultaneously, not sequentially.

– Enable approvals from smart-phone.

– Pre-emptively escalate when stake-holders are out of office.

• Automate fulfillment where possible.

© 2017 Hitachi ID Systems, Inc. All rights reserved.

4

Slide Presentation

4.4 Access requests are too complicated Challenges • Requesting access is complex: – – – –

Where is the request form?

What access rights do I need?

How do I fill this in?

Who do I send it to, for approval?

• Complexity creates frustration.

Solutions • Auto-assign access when possible.

• Simplify request forms.

• Intercept "access denied" errors: – Navigate lead users to appropriate request forms.

• Compare entitlements: – Help requesters select entitlements.

– Compare recipient, model user rights.

– Select from a small set of differences.

• Automatically assign authorizers based on policy.

5 Features

© 2017 Hitachi ID Systems, Inc. All rights reserved.

5

Slide Presentation

5.1 HiIM features Inputs → • Monitor SoRs (automation).

• Systems and apps - current state.

• Request portal: – Self-service.

– Delegated.

– Access admin.

→ Processes → • • • • •

Request forms.

Approval workflows.

Access certification.

Manual fulfillment.

Analytics.

• Web services API. → Policies → • • • • •

Segregation of duties.

Risk scores.

Role based access control.

Authorizer, certifier selection.

Visibility / privacy protection.

→ Outputs • Connectors to 110 systems and applications.

• E-mail.

• Create/update/close tickets.

• Send events to SIEM.

5.2 Identity and entitlement lifecycle automation • Using Hitachi ID Identity Express, we recommend full automation of identity and entitlement lifecycles out of the gate: – – – –

Joiners, movers, leavers processes.

Password management, strong authentication and federation.

Change requests, approval, review/certification.

Driven by both SoR data and requests.

• No need to "clean up" entitlements before automating access changes.

• Roles can be added later: not a pre-requisite.

• Automate first, clean up afterwards: – – – –

Unlike with competitors, automation is pre-configured and easy.

Start with basic integrations, add connectors over time.

Leverage automation and user knowledge to help clean up.

Add roles and expand automation over time.

© 2017 Hitachi ID Systems, Inc. All rights reserved.

6

Slide Presentation

5.3 Monitoring systems of record • Any target system can function as a system of record (SoR).

• Examples: HR apps, SQL databases, CSV files, ...

• Hitachi ID Identity Manager can monitor multiple SoR’s: – Multinationals: regional HR systems.

– Colleges: students vs. faculty/staff.

• Map attributes to user profiles and prioritize.

• Automatically submit access requests in response to detected changes.

• Users can submit pre-emptive or corrective requests: – New hire not yet in HR. – HR data is wrong.

– Override SoR data until HR updates it.

• Request portal handles users who never appear in SoRs: – Contractors, partners, etc.

5.4 Requester usability • Users rarely know where or how to request access!

• Windows shell extension, SharePoint error page: – Intercept "Access Denied" errors.

– Navigate user to appropriate request URL. • Compare users: – Compare entitlements between the intended recipient and a reference user.

– Select entitlements from the variance.

• Search for entitlements: – Keywords, description, metadata/tags.

• Relationship between requester and recipient: – What recipients can the requester see?

– What identity attributes are visible?

– What kinds of requests are available?

© 2017 Hitachi ID Systems, Inc. All rights reserved.

7

Slide Presentation

5.5 Robust, policy-driven workflow • Workflow invites stake-holders to participate in processes: – – – –

Approve or reject a request.

Review entitlements and recertify or remediate.

Fulfill an approved request.

Extensible. e.g., audit cases.

• Stake-holders are invited based on policy: – No flow-charts or diagrams required.

– Process is simple, transparent and secure.

– Routing may be based on relationships, resource ownership, risk.

• The process is robust, even when people aren’t: – Invite N participants, accept response from M (M<N).

– Simultaneous invitations by default (sequential made sense for paper forms).

– Automatically send reminders.

– Escalate (e.g., to manager) if unresponsive.

– Check out-of-office message, pre-emptively escalate.

– Accessible from smart phone, not just PC.

5.6 Reports, dashboards and analytics • Over 150 reports built in: – Many include multiple modes (e.g,. dormant vs. orphan accounts).

– Identities, entitlements, history, system operation, trends, etc.

– Easy to add custom reports.

• Many dashboards included as well.

• Run interactively or schedule (once, recurring).

• Deliver output (HTML, CSV, PDF): – – – –

Interactively.

In e-mails.

Drop files on UNC shares.

Stream results via web services.

• Actionable analytics: – Feedback from reports to requests.

– Automated remediation.

• Database is normalized, documented – can use 3rd party tools too.

6 Recorded Demos

© 2017 Hitachi ID Systems, Inc. All rights reserved.

8

Slide Presentation

6.1 Intercept Access Denied Dialogs

Animation: ../../pics/camtasia/v10/higm-A-request-folder.mp4

6.2 Authorization of a request for security group membership

Animation: ../../pics/camtasia/v10/higm-B-request-approve.mp4

6.3 Request approved, user can access the folder

Animation: ../../pics/camtasia/v10/higm-C-approved-open-file-nb.mp4

6.4 Mobile request approval

Animation: ../../pics/camtasia/v10/approve-request-group-membership-via-mobile-access-app-1.mp4

6.5 Compare user entitlements

Animation: ../../pics/camtasia/v10/hiim-model-after-ui.mp4

6.6 Application-centric certification

Animation: ../../pics/camtasia/v10/hiac-complete-app-centric-2.mp4

6.7 Add contact to phone

Animation: ../../pics/camtasia/v9/add-contact-to-phone-1/add-contact-to-phone-1.mp4

6.8 Actionable analytics: Disable orphan accounts

Animation: ../../pics/camtasia/v10/report2pdr-disable-orphan-accounts-1.mp4

7 Technology

Š 2017 Hitachi ID Systems, Inc. All rights reserved.

9

Slide Presentation

7.1 Multi-master architecture Native password change

Password synch trigger systems

SaaS apps Mobile proxy

AD, Unix, z/OS, LDAP, iSeries

”

z/OS - local agent

Mobile UI

ud

lo “C

Manage

Validate pw

VPN server

Reverse web proxy

Hitachi ID servers

Load balancers

Managed endpoints with remote agent: AD, SQL, SAP, Notes, etc

Replication

IVR server

MS SQL databases

Notifications and invitations

Various protocols Secure native protocol HTTPS

t

Da Tickets

E-mail system TCP/IP + AES

Hitachi ID servers

r

te en

c ata

d ote

Firewalls

m Re

System of record

Ticketing system

B ter en c a

ter

HR

ta Da

A Managed endpoints

n ce

Proxy server (if needed)

© 2017 Hitachi ID Systems, Inc. All rights reserved.

10

Slide Presentation

7.2 Key architectural features BYOD enabled On premise and SaaS

SaaS apps

”

ud

lo “C Replicated across data centers Horizontal scaling

Load balanced

t

Da

B ter en c a

r

te en

c ata

d ote

m Re TCP/IP + AES Various protocols Secure native protocol

ter

ta Da

n ce

A Reach across firewalls

HTTPS

7.3 Internal architecture • Multi-master, active-active out of the box.

• Built-in data replication between app nodes: – – – –

Fault tolerant.

Secure - encrypted.

Reliable - queue and retry.

App nodes need and should not be co-located.

• Native, 64-bit code: – 2x faster than .NET. – 10x faster than Java.

• Stored procedures: – For all data lookups, inserts.

– Fast, efficient.

– Eliminates client/server chatter.

• Modern crypto: AES-256, SSHA-512

© 2017 Hitachi ID Systems, Inc. All rights reserved.

11

Slide Presentation

7.4 BYOD access to on-premises IAM system

The challenge

Hitachi ID Mobile Access

• Users want access on their phones.

• Phone on the Internet, IAM on-prem.

• Don’t want attackers probing IAM from Internet.

• Install + activate iOS, Android app.

• Proxy service on DMZ or cloud.

• IAM, phone both call the proxy - no firewall changes.

• IAM not visible on Internet.

Internet

Personal device

Firewall

(2) HTTPS request: “Includes userID, deviceID”

Cloud proxy

IAM server

Firewall

DMZ Outbound connections only

(1) Worker thread: “Give me an HTTP request”

Private corporate network

(3) Message passing system

© 2017 Hitachi ID Systems, Inc. All rights reserved.

12

Slide Presentation

7.5 Included connectors Many integrations to target systems included in the base price:

Directories: Any LDAP, Active Directory, NIS/NIS+.

Servers: Windows NT, 2000, 2003, 2008[R2], 2012[R2], Samba.

Databases: Oracle, Sybase, SQL Server, DB2/UDB, Informix, Progress, Hyperion, Cache, ODBC.

Unix: Linux, Solaris, AIX, HPUX, 24 more variants.

Mainframes, Midrange: z/OS: RACF, ACF2, TopSecret. iSeries, OpenVMS.

HDD Encryption: McAfee, CheckPoint, BitLocker, PGP.

ERP: JDE, Oracle eBiz, PeopleSoft, PeopleSoft HR, SAP R/3 and ECC 6, Siebel, Business Objects.

Collaboration: Lotus Notes, iNotes, Exchange, SharePoint, BlackBerry ES.

Tokens, Smart Cards: RSA SecurID, SafeWord, Vasco, ActivIdentity, Schlumberger, RADIUS.

WebSSO: CA Siteminder, IBM TAM, Oracle AM, RSA Access Manager.

Help Desk: ServiceNow, BMC Remedy, SDE, HP SM, CA Unicenter, Assyst, HEAT, Altiris, Clarify, RSA Envision, Track-It!, MS System Center

Cloud/SaaS: WebEx, Google Apps, MS Office 365, Success Factors, Salesforce.com, SOAP.

7.6 Rapid integration with custom apps • Hitachi ID Identity Manager easily integrates with custom, vertical and hosted applications using flexible agents .

• Each flexible agent connects to a class of applications: – – – – – – – –

API bindings (C, C++, Java, COM, ActiveX, MQ Series).

Telnet / TN3270 / TN5250 / sessions with TLS or SSL. SSH sessions.

HTTP(S) administrative interfaces.

Web services.

Win32 and Unix command-line administration programs.

SQL scripts.

Custom LDAP attributes.

• Integration takes a few hours to a few days.

• Fixed cost service available from Hitachi ID.

© 2017 Hitachi ID Systems, Inc. All rights reserved.

13

Slide Presentation

8 Implementation 8.1 Hitachi ID professional services • Hitachi ID offers a complete range of services relating to Hitachi ID Identity Manager, including: – – – – – –

Needs analysis and solution design.

Fixed price system deployment.

Project planning.

Roll-out management, including maximizing user adoption.

Ongoing system monitoring.

Training.

• Services are based on extensive experience with the Hitachi ID solution delivery process.

• The Hitachi ID professional services team is highly technical and have years of experience deploying IAM solutions.

• Hitachi ID partners with integrators that also offer business process and system design services to mutual customers.

• All implementation services are fixed price: – Solution design.

– Statement of work.

© 2017 Hitachi ID Systems, Inc. All rights reserved.

14

Slide Presentation

8.2 ID Express

Before reference implementations:

With Hitachi ID Identity Express:

• Every implementation starts from scratch.

• Some code reuse, in the form of libraries.

• Even simple business processes have complex boundary conditions: – Onboarding: initial passwords, blocking rehires.

– Termination: scheduled vs. immediate, warnings, cleanup.

– Transfers: move mailboxes and homedirs, trigger recertification.

• Start with a fully configured system.

• Handles all the basic user lifecycle processes out of the box.

• Basic integrations pre-configured (HR, AD, Exchange, Windows).

• Implementation means "adjust as required" not "build from scratch."

• Configuration is fully data driven (no scripts).

• Fast, efficient, reliable.

• Complex processes often scripted.

• Delay, cost, risk.

© 2017 Hitachi ID Systems, Inc. All rights reserved.

15

Slide Presentation

8.3 ID Express - Corporate: details • Integrations: – – – –

• Automation: – Onboard/deactivate based on SoR. – Identity attribute propagation.

SQL-based HR SoR. AD domain Exchange domain (mailboxes) Windows filesystem (homedirs)

• Self-service: – Password, security question management.

– Update to contact info.

– Request for application, share, folder access.

• Entitlements: – Login IDs. – Group memberships.

– Roles.

• User communities:

• Delegated admin:

– Employees.

– Contractors/other.

– Same as self-service, plus recert.

• Approval workflows:

• Configuration: – Based on user classes, rules tables and lookup tables.

– Near-zero script logic.

– IT security (global rights).

– HR/managers (approve for each-other).

• Recertification: – Scheduled.

– Ad-hoc.

© 2017 Hitachi ID Systems, Inc. All rights reserved.

16

Slide Presentation

8.4 Services impact of ID Express Documentation (5/5 days) Production migration (2/2 days)

Implement new processes (30/5 days)

Test in prod., feedback, fixes (5/5 days)

Test, debug, fix (15/15 days)

Retest, adjust (10/10 days) Pilot test, adjust (20/15 days)

Test, debug, adjust (15/5 days) Get feedback (15/5 days) Production migration (2/2 days)

Test, debug, adjust (30/10 days)

Basic integrations (5/5 days)

Advanced integrations (30/30 days)

Production migration (2/2 days) Design new processes (30/5 days) Implement new processes (30/5 days) Deploy software (2/2 days) Document old processes (30/5 days) Initial planning (5/5 days)

9 Differentiation

Š 2017 Hitachi ID Systems, Inc. All rights reserved.

17

Slide Presentation

9.1 HiIM differentiation (1/3) Feature

Details

Competitors

Hitachi ID Identity Express • Pre-configured processes, policies.

• Full implementation or menu of components.

• Rich processes.

• Faster deployment.

• Low implementation risk.

• Slow, risky deployment.

• Never get around to J/M/L process automation.

• Intercept "access denied" errors.

• Compare entitlements of recipient, model users.

• Usability aid for requesters.

• Hard to find request portal.

• Users don’t know how to request access.

• Low user adoption.

• Reduced ROI.

• Hierarchy of roles, groups.

• Roles can contain groups, more roles.

• Groups can contain other groups.

• SoD defined at one level, violation may happen at another.

• Hitachi ID Identity Manager reliably detects, prevents violations.

• Fail to detect some violations.

• Users can bypass controls.

• False sense of security.

• Audit failures.

• Regulatory risk.

Requester usability

SoD actually works

© 2017 Hitachi ID Systems, Inc. All rights reserved.

18

Slide Presentation

9.2 HiIM differentiation (2/3) Feature

Details

Competitors

Active-active architecture • Multiple servers.

• Load balanced.

• Geographically distributed.

• No single point of failure.

• Scalable.

• Single points of failure.

• Costly to scale.

• Slow to recover from disasters.

• • • •

• Require a public URL. • Less secure / rarely permitted.

• No viable BYOD strategy.

• Impacts security, approval SLA.

Smart phone access Android and iOS apps.

Cloud-hosted proxy.

No public URL. Approvals, 2FA, contact download, etc.

Actionable analytics • Link report output to request input.

• Automated remediation.

• Immediate or scheduled.

• No coding.

• Fewer reports, analytics.

• No automated remediation.

© 2017 Hitachi ID Systems, Inc. All rights reserved.

19

Slide Presentation

9.3 HiIM differentiation (3/3) Feature

Details

Governance, provisioning in one product

Policies built on relationships

Competitors

• Governance: requests, approvals, certification, SoD, RBAC, analytics.

• Provisioning: connectors, J/M/L process automation.

• Single, integrated solution.

• Some focus on governance (no remediation, no J/M/L process automation).

• Others focus on provisioning (no certification, limited analytics).

• Higher total cost.

• Integration risk.

• Relationships drive all policies in Hitachi ID Identity Manager.

• Who can a user search for?

• What data is visible?

• What changes are requestable?

• Who will be asked to approve?

• Escalation path?

• Hierarchical access controls.

• Script code for exceptions.

• Costly, risky.

• Hard to configure, maintain.

10 Summary An integrated solution for managing identities and entitlements: • • • • • •

Automation: onboarding, deactivation, detect out-of-band changes.

Self-service: profile updates, access requests.

Governance: certification, authorization workflow, RBAC, SoD, analytics.

Automatically manage identities, entitlements: 110 bidirectional connectors.

Other integrations: filesystem, collaboration, SIEM, incident management.

Rapid deployment: pre-configured Hitachi ID Identity Express.

Security, lower cost, faster service.

Learn more at Hitachi-ID.com/Identity-Manager

500, 1401 - 1 Street SE, Calgary AB Canada T2G 2J3 Tel: 1.403.233.0740 Fax: 1.403.233.0725 E-Mail: sales@Hitachi-ID.com

www.Hitachi-ID.com

Date: 2017-03-15 | 2017-03-15

File: PRCS:pres