Building and Implementing An Identity Management Roadmap John

Building and Implementing An Identity Management Roadmap John Taylor Manager, IT Security & Service Continuity Phil Hall Security Consultant Apologies : Russell Mc. Climont IT Security Services Manager, e. Commerce Security

Presentation Overview q Strategic Overview Ø Architectural building blocks and identity management overview q Creating the identity management roadmap Ø Business requirements, principles/blueprint and technical positions q Project implementation Ø A couple of examples

Architectural Building Blocks • Removed

Information Security Framework • Removed

Identity Management – Strategic Overview • Removed

Identity Management – Strategic Overview Business Issues Faced r High administration cost r Inefficient management of user repositories r Numerous authentication points r Various passwords r Disconnect between external and internal facing systems for user access r Security built within each application

Identity Management – Strategic Overview • Removed

Identity Management – Strategic Overview Direction r Move towards reduced sign-on through the linkage of Web based protocols- Tivoli Access Manager and Tivoli Identity Manager (‘legacy’ based and non web based systems). r Centralised user management through corporate Meta Directory services. r User self registration and ‘access’ management for majority of the environment through the use of Tivoli Identity Manager. r Centralised authentication and authorisation services to leverage off existing investments. r Work flow management through Tivoli Identity Manager.

Establishing an Identity Management Roadmap • Removed

Key Components - Overview r Must have a formal identity management architecture. Roadmap is a migration strategy for realising this architecture r Clearly define what identity management is and is not Ø Essential to ‘ring-fence’ architecture and roadmap Ø Directories - always a tricky area to address Ø Vendors have a view that suits their product suite Ø A discrete set of related services r Business objectives and / or issues that identity management services will address r Investment in a set of complimentary technologies that are consistent with overall IT Architecture / Strategy. Minimise duplication! r Four key components, these are….

Principles & Blueprints r Identity Management guiding principles Ø E. g. “Provisioning of IT access will be based on a mix of automatic provisioning of basic services and self-service registration” Ø Limited in number, no more than 20 Ø Must compliment general IT principles and security principles r Architecture blueprints Ø Reflect guiding principles Ø Models of identity management architecture Ø Describes identity management architecture in terms of discrete, yet related services Ø Products are not referred to, keep it generic

Technical Positions & Migration Strategy r Technical Choices and Decisions Ø Describe identity management services in terms of a series of possible options and chosen technology / solution Ø A series of technical positions based on “fitness for purpose” r Migration strategy Ø Describes activities essential to achieving identity management architecture Ø Describes each activity in terms of relationship with other activities and time. . But it is not a project plan! Ø Activities are grouped together to form work streams Ø Must consider external factors, e. g. other projects Ø Should demonstrate a timely return on investment Ø Maximise strategic direction, minimise use of tactical solutions Ø Consider budgets and resource levels / experience

Getting Support from the Business r Map identity management services to business objectives q Link to IT and Security architectures q Demonstrate structured approach to architecture and roadmap development… we know what we are doing! Ø Document Business objectives, issues and requirements Ø Baseline ‘as is’ and perform gap analysis Ø Document principles, blueprints, technical positions and migration strategy r Demonstrate value in short term and at regular intervals thereafter Ø Simple high impact solutions, e. g. integrated login, password synchronization Ø Integrate individual solutions to provide comprehensive infrastructure q Simplify delivery of a critical IT project using an identity management service

• Removed Map business objective to identity management service

Map the identity management product to the identity management service – business requirement. • Removed

Identity Management Implementation Flow • Removed

Migration of ‘Existing’ WAM System • IAG acquired CGU in 2002. • IAG had existing web access management system using Directory Smart as underlying architecture. CGU installed Access Manager. • Gap analysis process against roadmap requirements. • Chose to migrate Directory Smart to Access Manager.

Requirements • Complete delivery by December 2004. • Maintain client self help and single sign-on functionality as provided by Directory Smart. • On going new integration activities to be performed with Access Manager. • Compliance with IT Security Architectural principles and strategy.

Issues • Develop a migration strategy for 40+ applications. • Architectural differences – proxy Vs agent based. • Avoiding additional authentication points. • Introducing a new administration tool to the help desk. • Maintaining existing Q&A functionality.

Achievements • Phase 1 is complete - Access Manager is being used to handle the gatekeeper service for all applications. • Automated account provisioning for intranet clients supplied by HR source (SAP) through IDI connectors. • Password reset service provided by Identity Manager. • Access Manager providing authentication service to Identity Manager interface.

Integrated Single Sign-On Process 5. Webseal Session ID & Creds Cached 1. Initial request ITAM Web. SEAL 2. Post 6. Request + iv_user, tag pwd attribute DSmart Endpoint Application 8. Post DS cookie & caller url etc. 3. Authentication 9. Post cookie 10. Request with client cookie 4. Check user. Extract pwd ITAM IDS 7. Check user. DSMART IDS

TIM Password Synchronisation Requirements • Deliver same sign-on services for non web applications • Support for core system repositories – ACF 2, RACF, TAM IDS & various Windows domain controllers (AD, 2000, NT) • Reduce help desk workload by simplifying password management • Reduce risk of exposure by strengthening and standardising password policies

Issues • Impact of password policy change – bringing endpoint systems in line, & client educational process • Scalability of domain account synchronisation solution – local agents or agent server • Limitations of RACF agent

Achievements • Reduced password reset tasks for the help desk • Stronger password policy for core systems • Consolidation of three separate passwords to one – domain, intranet & mainframe.

Se t RACF Agent ACF 2 Agent Q &A TSC Password Reset ITIM RACF 2 2 3 d or sw as 5 Domains NT Agent t. P d s Lo HR F ee Windows NT SAM W 2003 Agent IDI Sync Reverse PW sync Pr ov HR Feed IDI Sync Password Sync SAP Directory OID Directory isi on ing Password Sync TAM Directory TAM Agent Reverse PW sync Windows 2003 AD Password Change

Next Steps • Phase two of the TAM migration exercise – applications ported from Directory Smart • Spengo – Integrated Sign-On for Active Directory clients • Roll out password synchronisation service to the organisation • Rollout of account provisioning service to the organisation • Rationalising disparate source HR feeds through IDI/TIM • Association of existing ‘un-owned’ accounts to an enterprise identity – reduce the number of orphans • Automated provisioning & termination cycle for basic access…. .