Identity and Access Management PMI Westchester Quality SIG

  • Slides: 20
Download presentation
Identity and Access Management PMI Westchester Quality SIG Presentation September 12 th 2017 1

Identity and Access Management PMI Westchester Quality SIG Presentation September 12 th 2017 1

Identity and Access Management is Everyone’s Responsibility What is Identity & Access Management (IAM)?

Identity and Access Management is Everyone’s Responsibility What is Identity & Access Management (IAM)? A set of tools & services used to manage access to systems or resources used by personnel as well as our customers Why is Managing Access Important? Controlling access = Controlling risk How Do We Manage Applications? Centrally-Managed applications – you ask IT to do it. • Use one or more centrally-managed IAM services Business-Managed applications – you ask some in business to do it. • Applications the business manages locally. The business owns and creates the access to application. The owner has responsibility for and the timely removal of access when someone terminates or transfers jobs. • Who Is Responsible for Managing Access? Everyone who manages employees or contractors in the organization 2

Identity and Access Management is Everyone’s Responsibility What Do I Need To Do As

Identity and Access Management is Everyone’s Responsibility What Do I Need To Do As A Manager? 1 Request Access For Your Personnel • Contact your Role Profile Owner • Visit the IAM Support Central Site 2 Review Access When Prompted 3 Remove Access When People Leave • High-risk applications reviewed quarterly, all others annually Common Misperceptions 1. The IAM team can/will manage access on my behalf 2. Eventually all applications will be centrally managed 3. When someone leaves the company, HR makes sure their access is terminated • Submit requests within 24 hours of a job change • Go to Workday for full-time employees • Go to IAM Portal for contract workers 3 Request, Review, Remove 3

Identities IAM Program – Strategic Goals Credentials Entitlements Identity & Credentials: 1. Move towards

Identities IAM Program – Strategic Goals Credentials Entitlements Identity & Credentials: 1. Move towards a culturally aware business climate around IAM and enforce the use of a common identifier for all personnel utilizing Organization assets, both employee and non-employee. 2. Centralize identity flows and the on/off-boarding experience wherever possible to reduce risk, improve consistency, and minimize cost. 3. Implement a robust privileged user management program to identify, manage, and monitor access of privileged accounts on the Organization network. 4. Automate the provisioning and de-provisioning of core credentials and roles tied to identity events. Entitlements and Access Control: 1. Implement a business application on-boarding paradigm (aka “adoption”) that enables targeted applications to integrate to IAM and minimizes the amount of re-work as the maturity of the overall IAM solution grows. 2. Target high-risk applications (e. g. SOX/PCI), to be fully integrated to IAM with identity-event-driven workflow to ensure full lifecycle automation and management (request, grant, review, remove, term, transfer). 3. Integrate high-risk physical and logical assets into program that have weak IAM controls and present risk to firm (e. g. local admin, laptops, badging system, etc. ). Audit and Compliance: 1. Enable the business to perform scheduled or ad-hoc access reviews of any group of assets on Organization across all users and the access they hold (i. e. “Who has access to what ? ”). 2. Provide accurate and timely compliance / auditing reports as well as metrics to operational teams, business areas, and other interested parties. Audit & Compliance Access Control

Application Classification: Functional Service Characteristics Functional service characteristics are determined based upon maturity level

Application Classification: Functional Service Characteristics Functional service characteristics are determined based upon maturity level and are cumulative. They will be implemented for each application where technically feasible. Target Level Highest Functional Service Characteristics ü ü ü Event-Driven Account Lifecycle Event-Driven Certification Entitlement integrity enforced through programmatic reconciliation High Functional Service Characteristics ü ü Birthright-based Account Lifecycle Access request and fulfillment automated Closed-loop Certification Privileged Account usage tracked; Session Recorded; Active Discovery of Privileged Accounts Medium Functional Service Characteristics Low Functional Service Characteristics ü Access Request Centralized ü Workflow Routing ü Single or Reduced Sign-On ü Assisted Certifications ü Privileged Accounts inventoried quarterly ü User populations identifiable ü Logs sufficient to illustrate IAM transactions Highest 4 High 3 Medium 2 Low 1 Evidence required is dependent on Service Characteristics 5

n IAM Capability Overview Department Mission: Programs: Technical Developm ent Technical Operations Identity and

n IAM Capability Overview Department Mission: Programs: Technical Developm ent Technical Operations Identity and Access Management Business Operations To align Organization’s identity and access management capabilities closer to the industry and its peers by reengineering business processes, enabling the business with technology, and introducing automation wherever possible in a cost-effective and efficient manner. Program Services: Technical Operations: • Level 1 team to support the • • primary On/Off. Boarding processes for core credentials and logical assets. Primary support for provisioning and de-provisioning of any IAMintegrated applications (~80+) Level 2 -3 core engineering support for Unix, AS 400, Mainframe, and Active Directory. RSA/MFA & VPN support including Secur. ID hard/soft token deployment. Project-based core technical support specific to both small (new app) and large (Blue, Orange) projects. Business Operations: Technical Development: • Design, Development, and • • Deployment of in-house, COTS, and cloud-based solutions supporting the overall IAM program. Technical leadership on all existing as well as new IAM projects. SME of all existing and new IAM products, services, and tools. External IS project support wherever IAM SME experience is needed. Ownership and design of IAMdeployed architecture supporting all Organization internal and external customers. • Role and Entitlement Engineering • • • and the support of existing RBAC models. Enterprise Business Support for existing services as well as new projects. Oversight of Quarterly and Yearly reviews of end-user and privileged accounts. IAM solution on-boarding and deployment. User Acceptance Testing oversight and coordination with Testing COE. Program communications, including metrics and reporting. 6

General IAM Services / Technical Portfolio IAM – Current Services Component Unix LDAP (Temporary)

General IAM Services / Technical Portfolio IAM – Current Services Component Unix LDAP (Temporary) Description Unix User Store for UNIX Authentication and replicated with GE Unix LDAP (Permanent) Unix User Store for UNIX Authentication/ Prepopulated with existing Synchrony Financials employees AS 400, AD, Mainframe Critical care of core assets for account provisioning, PA mgmt. , and Role Mgmt. SSO LDAP Infrastructure for SSO Authentication, and VPN user configuration SSO Ping Federation & CA Federation Infrastructure to provide Single Sign On / Authorizations Federation infrastructure for External Federation partners – SAML 2. 0 Component Lifecycle Management Description Managing the lifecycle of user access (Joiner, Mover, Leaver, Converter, Rehire) Access Requests User interface to request access to systems for both normal and Privileged Access (PA) Access Provisioning Add, modify, remove user accounts on target applications through an (Resource Adapter/RA) or Admin notification (Virtual Resource Adapter/VRA) Role Lifecycle Management Manage the lifecycle of Roles (Role Profiles/RP and System Access Profiles/SAP) Access Review user access to applications, as well as privileged access, on a periodic basis. Component Description Privileged Identity Management PA Credential Management Solution for Vaulting and Managing Access Control for Windows and *NIX OS Server Shared Accounts and *NIX Super User Accounts RSA Secur. ID / RADIUS (Permanent Production Environment) Base Infrastructure Setup for Future Integration with IAM for User Creation, Self Service Features and integration with Active Directory and Ongoing User Migrations 7

Identity and Access Management Portal 8

Identity and Access Management Portal 8

IAM Portal Overview q The IAM Portal is the Identity & Access Management tool

IAM Portal Overview q The IAM Portal is the Identity & Access Management tool for Provisioning and Certifications q The main benefits include: ü Automated access provisioning / deprovisioning ü Requestor workflow transparency (“track my requests”) ü Enhanced certification / attestation processes ü Closed loop remediation ü “So. D” prevention & detection ü Centralized password reset ü Contingent Worker creation / management ü Delegation ü VPN management ü Distribution List management 9

Application Onboarding Onto Portal The application onboarding focuses on integrating business managed applications classified

Application Onboarding Onto Portal The application onboarding focuses on integrating business managed applications classified as IAM 1 & 2 onto the IAM Portal for centralized access management. In addition, applications will be enabled with Single-Sign-On, Privileged Access, and Logging capabilities. q Full Automation (wherever possible) § Eliminates manual provisioning errors § Nightly aggregations ensure the user base remains in sync and current § Terminations and removals are processed immediately q Centralized Certifications § Application access is certified within IAM Portal using current data § Multi-level review starting with user managers § Ability to delegate individual roles or users to another certifier q Transparency § Current user access (roles / entitlements) § User attributes (manager, dept. , job function, etc. ) § Ad hoc reporting & metrics 10

IAM Portal High Level Architecture (How it Works) IAM Portal Auto Provisioning CW Management

IAM Portal High Level Architecture (How it Works) IAM Portal Auto Provisioning CW Management Lifecycle Manager (Employees) CSV Access Provisioning Compliance Manager VPN, DL, Delegation, etc. Man ual Reporting & Metrics 11

Application Certifications and Attestations 12

Application Certifications and Attestations 12

User Access Management is an On-going Process throughout the entire User’s lifecycle 13

User Access Management is an On-going Process throughout the entire User’s lifecycle 13

Attestation Landscape – How do we determine “who has access to what” in an

Attestation Landscape – How do we determine “who has access to what” in an application ? Centrally Managed Apps Connected IAM automatically creates or modifies the access needed Manual 1. IAM team manually creates or modifies the access needed 2. IAM team would load the file of “who has access to what” Automated Attestations • • • Business Managed Apps Manual Business Owner works with IT Owner to get a file of “who has access to what” for loading to the Excel Template Manual Attestations Evidence of Certification performed by Manager (new model) or RPO Metrics: Revocations vs. Keeps, Time to Revoke, Time to Complete, etc. Must complete process – only acceptable bar is 100% completion, every time Attestation principles are the same whether Centralized or Business Managed 14

IAM Attestations: The Attestation Lifecycle Assess • Certification Type & Scope: Regular, or targeted

IAM Attestations: The Attestation Lifecycle Assess • Certification Type & Scope: Regular, or targeted sub-group • Frequency: SOX/PCI and Privileged Access = Quarterly, all others Annually Define Govern Define Remediate Assess • Retrieve access information into Attestation Templates • Educate on Review & Remediation • Provide Training; Kick-off review cycle Review Govern • • • Establish enterprise standards/principles Requirements & Controls for review Set Roles & Responsibilities for user access review Perform Quality Assurance / Spot Checking Secure Sign-off’s from IT and Business Owners • • Conduct user access reviews: Manager-based Continuous Progress Reports weekly up to ELT RPO support & assistance to Business where needed 4 week cycle for reviews Remediate • Remediate user access where noted within 48 hours after closure of review • Ticket/Closure or Evidence of remediation required for Audit • Additional access pulls might be required to provide evidence of removals 15

Privileged Identity Management 16

Privileged Identity Management 16

Who Are Privileged Access Users who have access to do the following activities are

Who Are Privileged Access Users who have access to do the following activities are considered to have privileged access: • • Provision users Reboot servers System level administration access System administrator level access within an application security module that allows individuals to override the controls of the application • IDs provided as part of third party software solutions used to complete installation of the software. • IDs that are used to run applications. • Administrators with the ability to grant access or elevate privileges on an in scope device 17

PA Program: Objectives Account Administration Governance Monitoring Operational Account Administration Procedures Reporting Criteria Definition

PA Program: Objectives Account Administration Governance Monitoring Operational Account Administration Procedures Reporting Criteria Definition of Risk Criteria Staffing Model Exception & Violation Procedures PA Metrics Criteria Alert Configuration Roles and Responsibility Enforcement Standard Operating Procedures PA Awareness Training Policy, Standard and Procedures Tool Configuration Data Feed Inventory PA Account Inventory Roles and Responsibility Reporting PA Account Reduction Strategy Compliance Validation Efforts Metrics Technology Onboarding Procedures PA Logging Validation 18

PA Program: Summary What needs to be done What is Needed • • •

PA Program: Summary What needs to be done What is Needed • • • • • • Dedicated PA monitoring team Daily alert reconciliation Password vaulting for NPA accounts Updated PA policies and Job Aid Manual quarterly PA review Alert tracking workflow Violation tracking data form Continuously working with teams to tune alerts Manual IAM Feeds Developed training for PA users More robust Nix monitoring Automation between IAM and Splunk Real Time Monitoring IAM quarterly PA reviews Restricting of service account logon Management of service accounts Removal of PA from personal ids Ability to discover PA accounts Solution for root/super user access Session recording Access to IAM data to verify user access CDI/SSO lookup tools File level monitoring (Windows) Challenges • • • Technology not in place Immaturity of IAM platform Incorporation of PA requirements within IAM 19

PIM Tool Rollout Strategy Privileged Identity Management (PIM) Project Overview: Release to Production and

PIM Tool Rollout Strategy Privileged Identity Management (PIM) Project Overview: Release to Production and deployment of Enterprise Random Password Manager Include deployment to Applications, Databases, Appliances and Devices across Production environments that use non-personal accounts. ERPM will provide Privileged Identity Management (PIM) with the means to randomize and manage passwords for non-personal accounts on target systems High-level Deployment Plan q Deployment of all in-scope Applications, Databases, Appliances and Devices in subsequent phases § Migrate Class PXX/SOX § Migration of accounts, LDAP and Local accounts § Migrate Unix/Linux accounts q IAM Portal and Help Desk Integrations with PIM Tool q Develop End User support models for Implementation and Ongoing BAU Impact q Technology: § Platforms, Appliances, Mainframe, AS 400, Unix (Solaris & RHEL), Windows Database, Accounts: Shared Service q People: § Enterprise Architecture, Security, Architecture, Security Ops, § Infrastructure Teams: Compute and Build teams, Servers Admins, DB & Run teams, Networking, Mainframe/AS 400 Application Teams 20