©2011 quest software, inc. all rights reserved. patrick hunter emea idam team lead 7 th february...
TRANSCRIPT
©2011 Quest Software, Inc. All rights reserved.
Patrick Hunter
EMEA IDAM Team Lead
7th February 2012
Creating simple, effective and lasting IDAM solutions
Identity and Access Management
2
©2011 Quest Software, Inc. All rights reserved.
To explain the major differences between Africa and Europe – Let
me illustrate...
3
©2011 Quest Software, Inc. All rights reserved.
Africa
4
©2011 Quest Software, Inc. All rights reserved.
Europe (England)
5
©2011 Quest Software, Inc. All rights reserved.
But...
The problems with Identities remain the same
©2011 Quest Software, Inc. All rights reserved.
Telling the Quest One Story
Quest One Identity Solutions
7
©2011 Quest Software, Inc. All rights reserved.
Complexity ComplianceSecurity
• Internal and external threats
• Increased risk of internal breach
• Orphaned accounts
• Too many have access to privileged accounts
• Users have too much access
• Too many separate user stores
• Anomalous activity goes unnoticed
• Managing user access rights is resource-intensive
• Number of regulations continue to grow
• New requirements add more administrative tasks
• Proving compliance is labor-intensive
• Reviewing activity logs only during audits is often too late
The Challenges Fact: 96% of breaches were avoidable through simple or intermediate controls.
Source - 2011 Data Breach Investigations Report, Verizon RISK Team with cooperation from the US Secret Service
and the Dutch High Tech Crime Unit
Fact: On average, a typical enterprise end-user has 6 enterprise-issued passwords.
Source - Aberdeen Group research
Fact: 48 percent of respondents rated the odds of experiencing a compliance risk within the next 18 months as “high” or “very high.
Source – State of Compliance 2011, PWC
8
©2011 Quest Software, Inc. All rights reserved.
Improve visibility into who has access to business critical information, automate provisioning and enforce access controls.
Centrally manage privileged accounts and provide granular control of administrator access.
Simplify the environment and user experience with centralized account management.
Audit what the users are doing with the access they have been granted.
Access Governance
Privileged Account Management
User Activity Monitoring
Identity Administration
What Quest One Delivers
9
©2011 Quest Software, Inc. All rights reserved.
Quest One Customer Examples
Access Governance
User Activity Monitoring
Privileged Account Management
Identity Administration
10
©2011 Quest Software, Inc. All rights reserved.
Broad Portfolio that is Modular & Integrated Granular Access
Controls
Business-Driven
The Quest One Advantage
simpleRapid Time-to-ValueSolution Simplicity
Access Governance
Privileged Account Management
User Activity Monitoring
Identity Administration
11
©2011 Quest Software, Inc. All rights reserved.
Manage Access to Business Critical InformationAccess Request and CertificationFine Grained Application SecurityData Access ManagementRole EngineeringAutomated Provisioning
Access Governance
Access Governance
12
©2011 Quest Software, Inc. All rights reserved.
Understand and Control Administrator ActivityGranular DelegationEnforce Separation of Duty Enterprise Password VaultSession ManagementKeystroke Logging
Privileged Account Management
Privileged Account
Management
13
©2011 Quest Software, Inc. All rights reserved.
Identity Administration
Simplify Account Management Directory ConsolidationAD AdministrationVirtual Directory ServicesSingle Sign-onStrong Authentication
Identity Administration
14
©2011 Quest Software, Inc. All rights reserved.
User Activity Monitoring
Audit User ActivityGranular AD AuditingPermissions ReportingLog ManagementEvent AlertingCrisis Resolution
User Activity
Monitoring
15
©2011 Quest Software, Inc. All rights reserved.
Simplify Account Management
Manage Access to Business Critical Information
Audit User
Activity
Privileged Account
Management
AccessGovernance
Access Governance
Privileged Account
Management
Complete Identity & Access Management
Understand &Control
Administrator Activity
Identity Administration
User Activity
Monitoring
16
©2011 Quest Software, Inc. All rights reserved.
Easier accountability and greater transparency throughout your business!
We simplify identity and access management.
©2011 Quest Software, Inc. All rights reserved.
A closer look at the building blocks!
18
©2011 Quest Software, Inc. All rights reserved.
Challenges
• Who runs IAM? Who should run it?
• Audits are time consuming and expensive
• You can’t trust everyone (even your administrators)
• An IAM solution should:• Reduce risks
• Reduce the cost of audit
• Empower the business
• IAM should benefit both IT and the Business
19
©2011 Quest Software, Inc. All rights reserved.
Quest One is….
• Simpler
• Broad portfolio
• Modular & integrated
• Rapid time-to-value
• Use existing investments
• Business driven
20
©2011 Quest Software, Inc. All rights reserved.
Improve visibility into who has access to business critical information, automate provisioning and enforce access controls.
Audit what the users are doing with the access they have been granted.
Simplify the environment and user experience with centralized account management.
Centrally manage privileged accounts and provide granular control of administrator access.
Where It Affects The Real World…
Access Governance
User Activity Monitoring
Privileged Account Management
Identity Administration
21
©2011 Quest Software, Inc. All rights reserved.
Simplify Account Management
Manage Access to Business Critical Information
Understand &Control
Administrator Activity
Privileged Account
Management
AccessGovernance
Access Governance
Privileged Account
Management
Complete Identity & Access Management
Audit User
Activity
Identity Administration
User Activity
Monitoring
©2011 Quest Software, Inc. All rights reserved.
Use Cases
23
©2011 Quest Software, Inc. All rights reserved.
Use Case: Access Entitlement Review, Attestation, & Recertification
We need to understand who has access to what across our environment. And, we need to involve the business managers, but they need to understand what the access entitlements actually mean.
Topics:• Discovery of entitlements, orphaned data, & unstructured data
• Attestation/recertification at the business level
• Eliminate “blind” attestation
• Visibility of all entitlements an employee or group has and how they got them
24
©2011 Quest Software, Inc. All rights reserved.
Use Case: Closed Loop Compliance
We need to establish a continuous process to make sure we stay on top of compliance. We need to show our auditors that every person has only the access they need to do their jobs, and nothing more.
Topics• Applies to users and administrators
• Clear, easy to understand dashboard displays
• Establish regular scheduled attestations to occur going forward
• Automation and control of high-impact tasks
• Easy and complete attestation / recertification
• Policy enforcement – execute / remediate / take action when necessary to complete fulfillment
25
©2011 Quest Software, Inc. All rights reserved.
Closed Loop Compliance with
Review/Interpret
Discover/Compile
Certify/Attest
Resulting Action
1001011000101101
Customer Database
Automated Access Governance Cycle
26
©2011 Quest Software, Inc. All rights reserved.
Use Case: Privileged Account Management
Centrally manage privileged accounts and provide granular control and complete visibility of administrator access
Topics:• Policy-based enterprise-wide
• Tightly controlled release and audit of shared credentials
• Least-privilege access – across systems
• Session audit / keystroke logging
27
©2011 Quest Software, Inc. All rights reserved.
Who knows what?
Can you be sure?
28
©2011 Quest Software, Inc. All rights reserved.
How strong is a strong password?
29
©2011 Quest Software, Inc. All rights reserved.
Best Practices for Identity
• Strong password policy
• Procedure enforcement
• Privileged Account Management
• Multi-factor authentication
• User-to-shared account linking
• Identity management solutions
• Audited Automation
• Moving processes – account history (SoD)
• Tamper resistant audit trail
30
©2011 Quest Software, Inc. All rights reserved.
31
©2011 Quest Software, Inc. All rights reserved.
Use Case: Automate Administrative Tasks
We need to automate common administrative tasks and reduce the burden on IT without adding complexity, or maintaining our reliance on inconsistent practices and disparate tools.
Topics• Active Directory account, password and group creation, and
modification
• Single sign-on
• Self-service password resets
• Reducing complexity – “Get to One”
©2011 Quest Software, Inc. All rights reserved.