Lower Cost, Improve Service and Strengthen Security with Password Synchronization and Reset. See more at: http://hitachi-id.com/documents/

1. 1 Hitachi ID Password Manager
Managing the User Lifecycle
Across On-Premises and
Cloud-Hosted Applications
Integrated credential management:
Passwords, security questions, certificates, tokens, smart cards and biometrics.
2 Agenda
• Corporate
• Hitachi ID Password Manager
• Recorded Demos
• Technology
• Implementation
• Differentiation
3 Corporate
© 2017 Hitachi ID Systems, Inc. All rights reserved. 1

2. Slide Presentation
3.1 Hitachi ID corporate overview
Hitachi ID delivers access governance
and identity administration solutions
to organizations globally.
Hitachi ID IAM solutions are used by Fortune
500
companies to secure access to systems
in the enterprise and in the cloud.
• Founded as M-Tech in 1992.
• A division of Hitachi, Ltd. since 2008.
• Over 1200 customers.
• More than 14M+ licensed users.
• Offices in North America, Europe and
APAC.
• Global partner network.
3.2 Representative customers
© 2017 Hitachi ID Systems, Inc. All rights reserved. 2

3. Slide Presentation
3.3 Hitachi ID Suite
4 Hitachi ID Password Manager
4.1 Too many passwords
Challenges Solutions
• Users have too many passwords.
• Write them on sticky notes.
• Forget and call the help desk.
• Pick trivial, insecure values.
• Synchronize passwords.
• Reduce to 1 or a few.
• Easier to remember.
• Less likely to write down.
• Opportunity to mandate stronger
passwords.
© 2017 Hitachi ID Systems, Inc. All rights reserved. 3

4. Slide Presentation
4.2 Help desk call volume
Challenges Solutions
• Users forget their passwords.
• Lock themselves out.
• Highest volume incident type.
• Peak volume at start of week.
• Self-service password reset.
• Clear intruder lockouts.
• PIN resets and emergency pass-codes for
tokens.
4.3 Automated user enrollment
Challenges Solutions
• Self service depends on non-password
credentials:
– Security questions.
– Mobile phone number.
– Personal e-mail address.
– App on smart phone.
• This data rarely exists prior to
deployment.
• New hires must enroll too.
• ROI depends on user adoption:
– Users tend to ignore invitations.
• Identify users with incomplete profiles.
• Invite them to sign up. Send reminders
with increasing urgency:
– E-mail.
– Open browser at login time.
– Forced enrollment (full screen,
locked browser.)
• Throttle invitations:
– Per user (e.g., once a week).
– Overall (e.g., 500/day).
© 2017 Hitachi ID Systems, Inc. All rights reserved. 4

5. Slide Presentation
4.4 Password reset from difficult contexts
Challenges Solutions
• Users have trouble logging in:
– Forget their password.
– Trigger an intruder lockout.
• User context can complicate assistance:
– Pre-boot? No OS yet!
– Login screen? How to navigate to
self-service?
– Off-site? Locally cached password.
• Pre-boot:
– Smart phone app or voice call to
access service.
– Mediate filesystem unlock.
• Windows login screen:
– Credential Provider extends the
Windows login UI.
– Smart phone app or voice call.
– Secure kiosk account if client
software is a problem.
• VPN integration:
– Update locally cached password for
off-site users.
4.5 Need consistently strong authentication
Challenges Solutions
• Few apps natively support multi-factor
logins.
• Mandate strong authentication before
self-service password reset.
• Offer 2FA to all users:
– PIN to phone/email.
– Smart phone app.
– Existing OTP.
– Browser fingerprint (reduces the
nuisance of 2FA).
• Built into Hitachi ID Password Manager
– Leverage existing 2FA if available.
– Introduce zero-cost 2FA otherwise.
• Extend 2FA to other apps via federation:
– HiPM includes a built-in SAML IdP
© 2017 Hitachi ID Systems, Inc. All rights reserved. 5

6. Slide Presentation
4.6 SaaS apps demand stronger security
Challenges Solutions
• SaaS apps expose a public URL.
• Unlike on-premises, they can be attacked
by anyone with an Internet connection.
• Offload login screens to a federated
access manager.
• Require 2FA at the consolidated login
screen.
• Fingerprint browsers to reduce the
nuisance of a two-step login.
4.7 Users want to manage their own passwords
Challenges Solutions
• Users sign into a variety of non-corporate
services.
• Insurance, banking, e-mail, social
network, e-commerce, ...
• They sometimes ask IT for help managing
these too.
• Offer them a secure alternative.
• Improves customer satisfaction with IT.
• Acts as an inducement to installing a 2FA
mobile app.
© 2017 Hitachi ID Systems, Inc. All rights reserved. 6

7. Slide Presentation
5 Recorded Demos
5.1 Off-site, Locked-out Password Reset
Animation: ../../pics/camtasia/v9/hipm-self-service-anywhere-nb/hipm-self-service-anywhere-nb.mp4
5.2 Activate Hitachi ID Mobile Access app
Animation: ../../pics/camtasia/v10/enable-mobile-device-1.mp4
5.3 Unlock pre-boot password
Animation: ../../pics/camtasia/v10/mcafee-drive-encryption.mp4
5.4 Add contact to phone
Animation: ../../pics/camtasia/v9/add-contact-to-phone-1/add-contact-to-phone-1.mp4
6 Technology
© 2017 Hitachi ID Systems, Inc. All rights reserved. 7

8. Slide Presentation
6.1 Multi-master architecture
“Cloud”
Reverse
web
proxy
VPN server
IVR server
Load
balancers
E-mail
system
Ticketing
system
HR
Hitachi ID
servers
Hitachi ID
servers
Firewalls
Proxy server
(if needed)
Mobile
proxy
SaaS apps
Managed
endpoints
Managed endpoints
with remote agent:
AD, SQL, SAP, Notes, etc
z/OS - local agent
MS SQL databases
Password synch
trigger systems
Native password
change
Manage
Mobile UI
AD, Unix, z/OS,
LDAP, iSeries
Validate pw
Replication
System of
record
Tickets
Notifications
and invitations
Data center A
Data center B
Remote data center
TCP/IP + AES
Various protocols
Secure native protocol
HTTPS
© 2017 Hitachi ID Systems, Inc. All rights reserved. 8

9. Slide Presentation
6.2 Key architectural features
“Cloud”
SaaS apps
Data center A
Data center B
Remote data center
TCP/IP + AES
Various protocols
Secure native protocol
HTTPS
Reach across firewalls
Load balanced
On premises and SaaS
BYOD enabled
Replicated across data centers
Horizontal scaling
6.3 Internal architecture
• Multi-master, active-active out of the box.
• Built-in data replication between app nodes:
– Fault tolerant.
– Secure - encrypted.
– Reliable - queue and retry.
– App nodes need and should not be co-located.
• Native, 64-bit code:
– 2x faster than .NET.
– 10x faster than Java.
• Stored procedures:
– For all data lookups, inserts.
– Fast, efficient.
– Eliminates client/server chatter.
• Modern crypto: AES-256, SSHA-512
© 2017 Hitachi ID Systems, Inc. All rights reserved. 9

10. Slide Presentation
6.4 Authentication chains
• An authentication chain is a defined
series of steps.
• Special type:
interactively choose a chain.
• Special type:
programmatically limit available chains.
• Risk-analysis:
VPN? admin user?
¡
¢£
¤
¥£
£
¦
£
£
§
¦
¨
©
¥
©
¢
¨
¦
¨
©
¢
©
¥
©
©
¢
©
¦
£
¢
¨
¥
¨
©
£
!
#
$
%
'
!
!(
)0
1
)
0
2
$
3
4
3
)0
'
5
)
6
$
'
3
)7
8
(
#
#
9
3
@
A
6(
3
'
(
3
@
B
8
C
D
8
(
#
#
9
3
@
A
$
7
3
)
'E
F
$
#
'
)
0
#
G
H
8
8
(
#
#
@
$
A
$
0
@
8
D
I
'
A
P
A
Q
A
$
7
3
)
'
E
F
$
#
'
)
0
#
A
%
P
R
%
#
#
$
3
'
)
0
6.5 User classes
User classes define sets of individual users
or types of relationships between users:
• Sets of users:
– By group membership
– In an OU
– Having certain attributes
• Types of relationships:
– Shared attributes (e.g.,
department, location).
– Group membership of participants
(e.g., security team).
– Direct or indirect manager.
User classes are a natural way to define
security policy:
• Route requests
(requester+recipient/authorizer).
• Invite reviewers (user/certifier).
• Escalate requests (old/new
participants).
• Limit visibility (viewer/user profile).
• Define what is requestable
(requester/recipient).
© 2017 Hitachi ID Systems, Inc. All rights reserved. 10

11. Slide Presentation
6.6 BYOD access to on-premises IAM system
The challenge Hitachi ID Mobile Access
• Users want access on their phones.
• Phone on the Internet, IAM on-prem.
• Don’t want attackers probing IAM from
Internet.
• Install + activate iOS, Android app.
• Proxy service on DMZ or cloud.
• IAM, phone both call the proxy - no
firewall changes.
• IAM not visible on Internet.
Outbound connections only
DMZ Private corporate
network
Personal
device
FirewallFirewall
Internet
(3)
Message passing system
(1)
Worker thread:
“Give me an HTTP
request”
(2)
HTTPS request:
“Includes userID,
deviceID”
IAM server
Cloud
proxy
© 2017 Hitachi ID Systems, Inc. All rights reserved. 11

12. Slide Presentation
6.7 Included connectors
Many integrations to target systems included in the base price:
Directories:
Any LDAP, Active Directory,
NIS/NIS+.
Servers:
Windows NT, 2000, 2003,
2008[R2], 2012[R2], Samba.
Databases:
Oracle, Sybase, SQL Server,
DB2/UDB, Informix, MySQL,
Hyperion, Cache, ODBC.
Unix:
Linux, Solaris, AIX, HPUX, 24
more variants.
Mainframes, Midrange:
z/OS: RACF, ACF2,
TopSecret. iSeries,
OpenVMS.
HDD Encryption:
McAfee, CheckPoint,
BitLocker, PGP.
ERP:
JDE, Oracle eBiz,
PeopleSoft, PeopleSoft HR,
SAP R/3 and ECC 6, Siebel,
Business Objects.
Collaboration:
Lotus Notes, iNotes,
Exchange, SharePoint,
BlackBerry ES.
Tokens, Smart Cards:
RSA SecurID, SafeWord,
Vasco, ActivIdentity,
Schlumberger, RADIUS.
WebSSO:
CA Siteminder, IBM TAM,
Oracle AM, RSA Access
Manager.
Help Desk:
ServiceNow, BMC Remedy,
SDE, HP SM, CA Unicenter,
Assyst, HEAT, Altiris, Clarify,
RSA Envision, Track-It!, MS
System Center
Cloud/SaaS:
WebEx, Google Apps, MS
Office 365, Success Factors,
Salesforce.com, SOAP.
6.8 Rapid integration with custom apps
• Hitachi ID Password Manager easily integrates with custom, vertical and hosted applications using
flexible agents .
• Each flexible agent connects to a class of applications:
– API bindings (C, C++, Java, COM, ActiveX, MQ Series).
– Telnet / TN3270 / TN5250 / sessions with TLS or SSL.
– SSH sessions.
– HTTP(S) administrative interfaces.
– Web services.
– Win32 and Unix command-line administration programs.
– SQL scripts.
– Custom LDAP attributes.
• Integration takes a few hours to a few days.
• Fixed cost service available from Hitachi ID.
© 2017 Hitachi ID Systems, Inc. All rights reserved. 12

13. Slide Presentation
6.9 SAMLv2 Federated IdP
• Externalize login process from third party web apps.
• Cloud: Google Apps, Office 365, Salesforce.com, WebEx, Concur, etc.
• On-premise: SharePoint (via ADFS), HCP Anywhere, etc.
• Basically respond to SAMLv2 requests with assertions.
• Leverage user classes for authorization control, authentication chains for 2FA/MFA.
6.10 Hitachi ID Mobile Access authentication factor
• Leverage Hitachi ID Mobile Access on user phones as a soft token.
• Zero extra cost: organizations have no excuse to revert to just QA or just a password on Extranet
logins.
• More secure password reset.
• 2FA for all Hitachi ID Privileged Access Manager logins, even if the network is down, AD or RADIUS
unreachable.
© 2017 Hitachi ID Systems, Inc. All rights reserved. 13

14. Slide Presentation
6.11 HiTPM: self-service via phone call
Self-contained: Flexible:
• Hitachi ID Phone Password Manager runs
on a Windows server with a Dialogic
phone card or with HMP software Dialogic
solution.
• No IVR software is required.
• Fully scriptable and can implement any
call logic.
• Multi-lingual: just record more voice
prompts.
• The default call logic is powerful and easy
to customize.
Integrated with Hitachi ID Password
Manager:
Scalable:
• Manage user enrollment.
• Map network login ID to digits.
• HiPM ties to target systems.
• Multiple load balanced HiTPM servers.
• Multiple load balanced HiPM servers.
6.12 Language support
The Hitachi ID Password Manager UI can be rendered in many languages:
Languages are easy to add. Hitachi ID will do it for a nominal fee and customers can do it themselves.
7 Implementation
© 2017 Hitachi ID Systems, Inc. All rights reserved. 14

15. Slide Presentation
7.1 Hitachi ID professional services
• Hitachi ID offers a complete range of services relating to Hitachi ID Password Manager, including:
– Needs analysis and solution design.
– Fixed price system deployment.
– Project planning.
– Roll-out management, including maximizing user adoption.
– Ongoing system monitoring.
– Training.
• Services are based on extensive experience with the Hitachi ID solution delivery process.
• The Hitachi ID professional services team is highly technical and have years of experience deploying
IAM solutions.
• Hitachi ID partners with integrators that also offer business process and system design services to
mutual customers.
• All implementation services are fixed price:
– Solution design.
– Statement of work.
8 Differentiation
© 2017 Hitachi ID Systems, Inc. All rights reserved. 15

16. Slide Presentation
8.1 HiPM differentiation
The most features
• Manage all credentials:
– Passwords on directories, servers,
apps, DBs.
– On-premise and SaaS.
– Pre-boot passwords.
– Smart cards and tokens.
• 2FA for all users.
• Personal password vault.
• Federated access (SAML IdP).
• 110+ connectors included.
Always available
• Corporate PCs:
– Pre-boot unlock screen.
– Windows/MacOSX login screen.
– Desktop browser.
• Smart phone app.
• Voice call to IVR.
• At work and off-site.
Scalable
• Multi-master, active-active.
• Load balanced, replicated.
• Geographically distributed.
• Multi-lingual.
The best ROI
• Reduce problem frequency
– Address root cause.
– Don’t just download problem
resolution to users.
• Managed enrollment to maximize
adoption.
• Rapid deployment, minimal maintenance.
8.2 The leading vendor
Innovation Ongoing support Low cost
• Self-Service, Anywhere.
• HDD unlock via call,
smart phone app.
• Integrated password
wallet.
• Integrated federated
access.
• 2FA for everyone.
• Responsive and skilled
customer support.
• Unattended operation:
– Auto-discovery.
– Managed
enrollment.
– Metrics and trend
analysis.
– SIEM, help desk
integration.
• Fixed-price
implementation.
• Minimal need for
ongoing maintenance.
© 2017 Hitachi ID Systems, Inc. All rights reserved. 16

17. Slide Presentation
9 Summary
An integrated solution for managing credentials:
• Immediate security benefit: password policy, help desk caller authentication.
• Low deployment cost, minimal ongoing investment, significant IT support savings.
• Always accessible:
– Web browser on PC, phone or tablet.
– Windows login prompt.
– Pre-boot encryption password prompt.
– Apps on iOS, Android.
– Phone call / IVR.
– Available at work and while off-site.
• 110+ connectors included.
Learn more at Hitachi-ID.com/Password-Manager
www.Hitachi-ID.com
500, 1401 - 1 Street SE, Calgary AB Canada T2G 2J3 Tel: 1.403.233.0740 Fax: 1.403.233.0725 E-Mail: sales@Hitachi-ID.com
Date: 2017-05-25 | 2017-05-25 File: PRCS:pres