pre-con ed: how to iam-enable your office 365 environment

World®’16

IAMforOffice365Environment

JohnZebrowskiSr.PrincipalConsultant,CATechnologies

SCX10E

SECURITY

2 ©2016CA.ALLRIGHTSRESERVED.@CAWORLD#CAWORLD

©2016CA.Allrightsreserved.Alltrademarksreferencedhereinbelongtotheirrespectivecompanies.

Thecontentprovidedinthis CAWorld2016presentationisintendedforinformationalpurposesonlyanddoesnotformanytypeofwarranty. The informationprovidedbyaCApartnerand/orCAcustomerhasnotbeenreviewedforaccuracybyCA.

ForInformationalPurposesOnlyTermsofthisPresentation


Abstract

BusinessesaremovingawayfromthetraditionalimplementationofMicrosoft®Officeandmigratingtothenew,cloud-basedOffice365™,whichoffersincreasedaccessibilityandsignificantcostsavings.However,thecloudalsointroducessignificantchallenges.Inthissession,we’lldiscusshowidentityandaccessmanagementsolutionsfromCAcanhelpenableandprotectthisenvironment.

JohnZebrowskiCATechnologiesSr.PrincipalConsultant


Agenda

OFFICE365IMPACT

SINGLESIGNONTOOFFICE365

STRONGAUTHENTICATIONFOROFFICE365

PROVISIONINGTOOFFICE365

1

2

3

4


TheImpactofOffice365

§ Businessesmigratingtocloud-basedOffice365

§ Adoptionrateisfastandaccelerating

§ Buttherearechallenges

1out of 5corporate employees uses an Office 365 cloud service, up from less than 7% just nine months ago1

1. https://www.skyhighnetworks.com/cloud-security-blog/7-charts-reveal-the-meteoric-rise-of-office-365/


SingleSignOntoOffice365

§ Background– Asbusinessesmovefromclient-basedMicrosoftOfficeandtocloud-basedOffice

365,theyneedasimplewayforuserstoaccesstheseapplicationswithoutadditionallogins.

§ OneOption– Office365supportsADFS2.0claims-basedfederation,butifthisisbuiltwithAD,

youareforcedtoaccepta“loosecoupling”andlosecontroloftheuser’ssession.

§ TheCAAlternativeOption– CASSSOcansupportlooseortightcoupling,asneeded,andcansupportsingle

sign-ontohundredsofon-premise andcloud-basedapplications.


AuthenticationtoOffice365ProcessFlow

Step1:UserlogsintonetworkandisauthenticatedbyActiveDirectory

EndUser Workstation ActiveDirectory



CASSOleveragesIntegratedWindowsAuthenticationtologuserintoportal.

Step2:UserclickslinktoopenIntranetPortal,whichisprotectedbyCASSO.


CASingleSign-OnIntranetPortal



CASingleSign-OnIntranetPortal

Office365


Step3:UserclickslinktoopenOffice365,whichisprotectedbyCASSO.

CASSOfederatesuserintoOffice365usingADFS.




CASingleSign-On

Office365

CASSOalsosupportsdirectaccesstoOffice365.




CASingleSign-On

Office365

LoginPage

Step1:UserwouldberedirectedtoCASSO,whichwouldpromptUsertoLogin.

CASSOwouldcollectCredentialsandValidatethemagainstActiveDirectory.



CASingleSign-On

Office365


Step2:CASSOfederatesuserintoOffice365.


SummaryofCASSOSupportforOffice365

§ ProfilesSupported– WS-FederationPassiveRequestorProfile– WS-FederationActiveRequestorProfile

§ UseCasesSupported– Browser-basedSSOtoOffice365– Thickclient-basedSSOtoOffice365– IWA-basedSSOtoOffice365

§ BrowsersSupported– InternetExplorer,Safari


Whataboutadditionalauthenticationsecurity?

MicrosoftExcel29%

Other23%AdobePDF

19%

MicrosoftWord17%

MicrosoftPowerPoint10%

MicrosoftOutlook(MSG/PST)2%

58%of sensitive data stored in the cloud is stored in OFFICE DOCUMENTS1

1. https://www.skyhighnetworks.com/cloud-security-blog/7-charts-reveal-the-meteoric-rise-of-office-365/


EndUser MultipleDevices ActiveDirectory

IntranetPortal

Office365

AuthenticationtoOffice365TheSecurityRisk

SensitivedatastoredinOffice365cloudisprotected,inmostcases,byapassword

LoginwithUserID&Password

Acredentialthatcanbeeasilycracked,stolen,orgivenaway



IntranetPortal

Office365

CAAdvancedAuthentication

AuthenticationtoOffice365TheSecuritySolution

Butwhatifyoucouldenhancethepasswordwithoutimpactingtheuserexperience

WithCAAdvancedAuthentication,youcan!



IntranetPortal

Office365

AuthenticationtoOffice365TheSecurityOptions

ThreeOptionstoenhancethepasswordloginprocesstoOffice365

Option3– CombinationofBoth2FACredentialsandRiskEvaluation

Option2RiskEvaluation

Option12FACredentials



IntranetPortal

Office365

CAAdvancedAuthentication

AuthenticationtoOffice365TheDeploymentOptions

CAAdvancedAuthenticationcanbedeployedasstandalonesolution,or…

ItcanbedeployedwithCASingleSignOn!EndUser MultipleDevices ActiveDirectory

IntranetPortal

Office365

CASingleSign-On CAAdvancedAuthentication


SummaryofCAAASupportforOffice365

§ ProfilesSupported– WS-FederationPassiveRequestorProfile– WS-FederationActiveRequestorProfile

§ UseCasesSupported– Browser-basedSSOtoOffice365– Thickclient-basedSSOtoOffice365

§ AuthenticationMechanismsSupported– CAAuthID,CAMobileOTP,knowledge-basedsecurityquestions,OATH

tokens,out-of-bandOTP,andrisk-basedadaptiveauthentication.


ProvisioningtoOffice365

§ UserProvisioning– CAIdentitySuitecanautomaticallyprovisionandde-provisionusers

andaccessrightstoOffice365basedonchangessubmittedtoitfromanAuthoritativeSource.

§ IdentityGovernance– CAIdentitySuitecancertifyuseraccesstoOffice365toensurethat

onlytherightpeoplehaveaccesstosensitivedocumentsanddata.


CAIdentityService

§ SSOtoOffice365– ProfilesSupported

§ WS-FederationPassiveRequestorProfile§ WS-FederationActiveRequestorProfile

– UseCasesSupported§ Browser-basedSSOtoOffice365§ Thickclient-basedSSOtoOffice365

§ ProvisioningtoOffice365– Automateduserprovisioningandde-provisioningtoOffice365


HowCAIAMSolutionsWorkTogether

Add-OnPossibilities

Product OutoftheBox CAAA CAIDM CAIDMService CASSO

CASingle SignOn FederatedSSOtoO365

CAIdentityManager UserProvisioningtoO365

CAAdvanced Auth StrongAuthtoO365

CAIdentityServiceSSO&

ProvisioningtoO365


RecommendedSessions

SESSION# TITLE DATE/TIME

SCX09E CASSO:AccessModels 11/14/2016at1:00pm

SCT44TWAM&Federation:TwoGreatTastesthatTasteGreatTogether 11/16/2016at11:30am

SCX20S CASSO&AARoadmap 11/17/2016at1:45pm


Don’tMissOurINTERACTIVESecurityDemoExperience!

SNEAKPEEK!



Questions?


Thankyou.

Stayconnectedatcommunities.ca.com

pre-con ed: how to iam-enable your office 365 environment

Technology