Hitachi ID Identity Manager

1

Hitachi ID Identity Manager

Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications

User provisioning, RBAC, SoD and access certification.

2

Agenda • • • • • •

Introductions.

Hitachi ID corporate overview.

ID Management Suite overview.

Identity problems and Hitachi ID Identity Manager benefits.

The HiIM solution.

Software demonstration.

© 2012 Hitachi ID Systems, Inc.. All rights reserved.

1

Slide Presentation

3

Hitachi ID Corporate Overview

Hitachi ID is a leading provider of identity and access management solutions.

• • • • •

Founded as M-Tech in 1992.

A division of Hitachi, Ltd. since 2008.

Over 900 customers.

More than 11M+ licensed users.

Offices in North America, Europe and APAC. • Partners globally.

4

Representative Hitachi ID Customers

© 2012 Hitachi ID Systems, Inc.. All rights reserved.

2

Slide Presentation

5

ID Management Suite

6

Identity and Access Problems For users • • • • •

How to request a change?

Who must approve the change?

When will the change be completed?

Too many passwords.

Too many login prompts.

For IT support • Onboarding, deactivation across many apps is challenging.

• More apps all the time!

• What data is trustworthy and what is obsolete?

• Not notified of new-hires/terminations on time.

• Hard to interpret end user requests.

• Who can request, who should authorize changes?

• What entitlements are appropriate for each user?

• The problems increase as scope grows from internal to external.

© 2012 Hitachi ID Systems, Inc.. All rights reserved.

3

Slide Presentation

7

Identity and Access Problems (continued) For Security / risk / audit

For Developers

• Orphan, dormant accounts.

• Too many people with privileged access.

• Static admin, service passwords a security risk.

• Weak password, password-reset processes.

• Inappropriate, outdated entitlements.

• Who owns ID X on system Y? • Who approved entitlement W on system Z? • Limited/unreliable audit logs in apps.

8

• Need temporary access (e.g., prod migration).

• Half the code in every new app is the same: – – – – –

Identify.

Authenticate.

Authorize.

Audit.

Manage the above.

• Mistakes in this infrastructure create security holes.

User Provisioning

User provisioning is defined as: • Software to create, modify and delete users on different systems.

• It must include connectors: – Directories.

– Operating systems.

– Applications.

• It also has to implement business process: – Data synchronization from one system to another.

– Self-service requests.

– Authorization workflows.

• Finally, it should enforce policy rules: – Login ID assignment.

– Approvals rules.

– Segregation of duties.

© 2012 Hitachi ID Systems, Inc.. All rights reserved.

4

Slide Presentation

9

ID Management Suite Component Overview Hitachi ID Identity Manager

Create, manage and delete users and entitlements.

Automation, self-service and delegation.

Hitachi ID Access Certifier Hitachi ID Group Manager Hitachi ID Password Manager

Periodic review and cleanup of users and entitlements.

Self service, resource-centric management of AD group membership.

Synchronize, reset passwords.

Manage RSA tokens, security questions, voice prints, PKI certs.

Periodically randomize and control access to sensitive passwords.

Addons

Hitachi ID Org Manager Hitachi ID Phone PW Manager Hitachi ID Login Manager

Periodic updates to data mapping users to their managers.

Turn-key IVR for password reset and token management.

Auto-populate login IDs and synchronized passwords for users.

Š 2012 Hitachi ID Systems, Inc.. All rights reserved.

5

Slide Presentation

10

ID Management Suite

Š 2012 Hitachi ID Systems, Inc.. All rights reserved.

6

Slide Presentation

11

ID Management Suite in the User Lifecycle Lifecycle stage

Automation

Self service / request workflow

Policy enforcement

Onboarding • From HR (employees).

• Web UI (contractors).

• Role-based setup.

• Standardized IDs, OU, mail store, etc.

• Identity synchronization.

• Automatic role changes.

• Applications.

• Group membership.

• Profile updates.

• SoD enforcement.

• Authorize changes.

• ID mapping.

• Password reset.

• Resolve access denied errors.

• Password strength.

• Password expiry.

• Access certification.

• Scheduled terminations.

• Archive mailboxes, home dirs, etc.

Management

Support

Deactivation • Autotermination.

© 2012 Hitachi ID Systems, Inc.. All rights reserved.

7

Slide Presentation

12

HiIM Features Automation: • Provision joiners, deactivate leavers.

• Multiple HR feeds.

Requests portal: • Self-service profile updates.

• Delegated security change requests.

Security controls: • Access certification.

• RBAC and SoD. • Reports on current entitlements, history.

Workflow process: • Authorizers.

• Implementers.

• Certifiers.

Integrations: • 110+ connectors, included.

• Incident management, SIEM, e-mail interfaces.

• Manage building access, physical assets.

Identity synchronization: • Consistent data among apps.

© 2012 Hitachi ID Systems, Inc.. All rights reserved.

8

Slide Presentation

13

Closed Loop IAM

Integrated Systems of Record

Hitachi ID Management Suite List people

Auto discovery

Detected changes Auto-provisioning Identity synch.

Updates

Manual request

Requests Web UI

Updates

Invitations

Authorizers

Approve, reject, delegate

Approvals Web UI

- Validate requests - Route for approval - Invite authorizers - Send reminders - Escalate - Delegate Request Queue

Autofulfillment Work Queue

Manual fulfillment

Connectors

Review, certify, correct

Transaction Manager

Create, delete, update accounts

Invitations

Invitations

Certifiers

Non-integrated Systems

Create, delete, update accounts

Identity Cache

Automatic request

Requesters

Integrated Target Systems

List accounts

Certification Web UI

Workflow Manager

Implementer Web UI

Accept, confirm

Implementers

Š 2012 Hitachi ID Systems, Inc.. All rights reserved.

9

Slide Presentation

14

Competitive Differentiation Consistency • • • •

Full featured

Manage all identities and entitlements On-premise and SaaS. Accounts, entitlements and resources.

110+ connectors included.

Scalability • • • •

15

• Administration and governance in a single product.

• Triggers: automation and request portal.

• Controls: policy, authorization workflow, certification.

Usability

Multi-master architecture.

Load balanced, replicated.

Deploy across data centers.

Multi-lingual.

• Business-friendly request process using roles, PDRs. • Simple e-mail/web authorization.

• Windows shell extension.

• Fulfillment by both connectors and humans.

The Hitachi ID Solution is Flexible Customize:

Every aspect of the user interface

Integrate with:

110+ target system types Call tracking systems HR systems Authentication hardware Meta directories

Enforce:

Password policy Authentication rules Change authorization rules User naming standards

© 2012 Hitachi ID Systems, Inc.. All rights reserved.

10

Slide Presentation

16

Scalability and Fault-Tolerance • • • • • • •

17

Multiple Hitachi ID Identity Manager servers can be configured for load balancing.

Data is automatically replicated between servers in real time.

Built-in high performance identity cache accelerates system response.

A service monitors the health of each server and may restart it or take it out of circulation.

A proxy server compensates for slow or insecure connectivity to remote target systems.

There are production customers with up to 300,000 users on just two servers.

Replication has been scaled to 20 servers.

Included Connectors

Many integrations to target systems included in the base price:

Directories: Any LDAP, AD, WinNT, NDS, eDirectory, NIS/NIS+.

Servers: Windows NT, 2000, 2003, 2008, Samba, Novell, SharePoint.

Databases: Oracle, Sybase, SQL Server, DB2/UDB, Informix, ODBC.

Unix: Linux, Solaris, AIX, HPUX, 24 more.

Mainframes, Midrange: z/OS: RACF, ACF2, TopSecret. iSeries, OpenVMS.

HDD Encryption: McAfee, CheckPoint.

ERP: JDE, Oracle eBiz, PeopleSoft, SAP R/3 and ECC 6, Siebel, Business Objects.

Collaboration: Lotus Notes, Exchange, GroupWise, BlackBerry ES.

Tokens, Smart Cards: RSA SecurID, SafeWord, RADIUS, ActivIdentity, Schlumberger.

WebSSO: CA Siteminder, IBM TAM, Oracle AM, RSA Access Manager.

Help Desk: BMC Remedy, SDE, HP SM, CA Unicenter, Assyst, HEAT, Altiris, Track-It!

Cloud/SaaS: WebEx, Google Apps, Salesforce.com, SOAP (generic).

© 2012 Hitachi ID Systems, Inc.. All rights reserved.

11

Slide Presentation

18

Simple Integration with Custom Apps • Hitachi ID Identity Manager easily integrates with custom, vertical and hosted applications using flexible agents .

• Each flexible agent connects to a class of applications: – – – – – – – –

API bindings (C, C++, Java, COM, ActiveX, MQ Series).

Telnet / TN3270 / TN5250 / sessions with TLS or SSL. SSH sessions.

HTTP(S) administrative interfaces.

Web services.

Win32 and Unix command-line administration programs.

SQL scripts.

Custom LDAP attributes.

• Integration takes a few hours to a few days.

• Fixed cost service available from Hitachi ID.

19

Multi-Master Architecture , nix , U 90, D 3 A S/ P, O DA 0 d e L S40 tiv or Na assw ge A p han Password c Synch Trigger Systems

User

IVR Server

VPN Server

Reverse Web Proxy

lid Va

Load Balancer

SMTP or Notes Mail

Various Protocols Secure Native Protocol HTTPS

PW

Hitachi ID Application Server(s)

Target Systems with local agent: OS/390, Unix, older RSA

Target Systems with remote agent: AD, SQL, SAP, Notes, etc

s ce rvi Se b We

SQL DB

ails Em

TCP/IP + AES

ate

SQL DB

SQL/Oracle

ts ke Tic

& Incident up ok Management Lo System System of Record

Firewall

g Tri

d, ste o s -h ud app Clo aaS S

ca Lo

ork w t e lN

Target Systems

r ge

m Re

Firewall

ot

n Ce a t a eD

ter

Proxy Server (if needed)

© 2012 Hitachi ID Systems, Inc.. All rights reserved.

12

Slide Presentation

Integrations List, Inspect, Create, Delete, Modify: Users, Groups

Connector

Core Services

IDTM Transaction Manager

Exits Hitachi ID Proxy Server

Business Logic Native API, Protocol Target System

Plugins

Hitachi ID Encrypted Protocol

Execute

Target System

IIS or Apache

IDWFM Workflow Manager

Secure RPC

Remote Site

User Interface

HTTPS

Server Internal Architecture Execute

20

User Web Browser

End User

PSUPDATE Auto-Discovery Admin/Config IDTRACK Automation Engine IDDB Database Manager

Local Agent

Oracle or MSSQL

Target System Real-Time Encrypted Replication

Hitachi ID Server

21

Stored Procs

Identity Cache Requests Configuration History

IDM Database

Hitachi ID Server: Internal Components

Rapid Deployment and Low TCO Optimized to minimize effort: • User provisioning with HiIM: – Initial deployment: 6 – 9 months.

– Ongoing maintenance: 0.5 – 1.0 FTE.

Using Hitachi ID Identity Manager technology: • Built-in nightly auto-discovery of IDs, entitlements.

• Both attribute-based and self-service ID mapping.

• Request, approvals screens and processes are built-in.

• Implementer infrastructure for non-integrated apps is built-in.

• Powerful authorization workflow is built-in.

• Deployment does not depend on role engineering.

• 110 connectors out of the box.

• Rapid integration with custom, vertical apps.

• Easy customization of GUI, business logic.

© 2012 Hitachi ID Systems, Inc.. All rights reserved.

13

Slide Presentation

22

Competitive Advantages Unique features

Rapid deployment

• Self-service password/PIN reset from anywhere.

• Workflow to refresh OrgChart data.

• Request for resources mapped to AD groups.

• Detect/block effective SoD violations.

• Key features built-in, not custom: – – – –

Change request forms.

Authorization process.

Access certification UI. Auto-discovery.

• Self-service ID mapping.

• Unique approach to workflow.

Scalable platform • • • •

23

Integrations

Real-time data replication.

Multi-master architecture.

Proxy server to cross firewalls.

Stored procedures, native code for speed.

• • • •

110+ included connectors.

Flexible connectors.

Built-in implementers workflow.

Integrated with incident management, SIEM, etc.

Hitachi ID Professional Services • Hitachi ID offers a variety of services relating to Hitachi ID Identity Manager, including: – – – – – –

Needs analysis and solution design.

Fixed price system deployment.

Project planning.

Roll-out management, including maximizing user adoption.

Ongoing system monitoring.

Training.

• Services are based on extensive experience with the Hitachi ID solution delivery process.

• The Hitachi ID professional services team is highly technical and have years of experience deploying IAM solutions.

• Hitachi ID partners with integrators that also offer business process and system design services to mutual customers.

© 2012 Hitachi ID Systems, Inc.. All rights reserved.

14

Slide Presentation

24

25

Hitachi ID Solution Delivery Approach Fixed-price:

All work is delivered on a fixed-price, fixed-deliverables basis. The "meter" is never running.

Phases, milestones:

Hitachi ID recommends breaking up long projects into phases of 1–3 months. Work is reviewed and payment is due when milestones are met.

Open assignment:

Each phase may be undertaken by Hitachi ID, the customer, a systems integrator or a combination of the participants.

Templates:

Template documents and sample business logic are used to expedite work.

Customer portal:

A self-service portal supports discovery, client/partner/vendor interaction, document distribution and more.

AdMax: Maximizing User Adoption • Successful implementation of an identity and access management system must be supported by an effective user adoption program.

• AdMax is an Hitachi ID professional services program, used to plan for and execute effective user enrollment projects.

• AdMax is designed to maximize adoption of and ROI from Hitachi ID identity management solutions, using: – – – – – – –

Best practices, case studies and industry norms.

Enrollment, user adoption and ROI measurement.

Incentive and disincentive programs.

Presentations and training materials for users and HD staff.

Project roles and responsibilities.

Sample project plans, promotional materials, e-mails, graphics and other user communications.

Workbooks for project implementation.

© 2012 Hitachi ID Systems, Inc.. All rights reserved.

15

Slide Presentation

26

Summary

Hitachi ID Identity Manager enables automated, self-service and policy-driven management of identities and entitlements: • • • • • • •

Automation: onboarding, deactivation, identity synchronization.

Self-service: profile updates.

Delegated administration: access requests, approvals workflow.

Policy engines: RBAC, SoD, standard setup for new users.

Reports: who-has-what, change history.

Integrations: 110 connectors built-in.

Rapid deployment: built-in screens, processes, features minimize custom coding.

More secure infrastructure, lower IT management costs and faster user service.

Learn more at Hitachi-ID.com/Identity-Manager

27

Getting an IAM Project Started • • • •

Build a business case.

Get management sponsorship and a budget.

Discovery phase, capture detailed requirements.

Assemble a project team: – – – –

security system administration user support etc.

• Try before you buy: Demos, POCs, pilots.

• Install the software, roll to production.

• Enroll users, if/as required.

500, 1401 - 1 Street SE, Calgary AB Canada T2G 2J3 Tel: 1.403.233.0740 Fax: 1.403.233.0725 E-Mail: sales@Hitachi-ID.com

www.Hitachi-ID.com

File: PRCS:pres Date: March 1, 2012