#MFSummit2016 Secure: Introduction to identity, access and security
•
1 like•1,207 views
Understanding and managing identity is behind effective Information security. It enables control of internal and external threats. Our solutions can help you understand and better manage these threats. Find out how. Presenter: Dave Mount, UK Solutions Consulting Director
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to #MFSummit2016 Secure: Introduction to identity, access and security
Similar to #MFSummit2016 Secure: Introduction to identity, access and security (20)
More from Micro Focus
More from Micro Focus (20)
Recently uploaded
Recently uploaded (20)
#MFSummit2016 Secure: Introduction to identity, access and security
- 1. Introduction to Identity, Access & Security David Mount | Director – IAS Solutions Consulting | 24 February 2016
- 2. Landscape is becoming more complex Cloud Mobile BYOD Social
- 3. Walking the Risk Tightrope Mobile Is our use of mobile devices secure? Service Delivery Are we doing enough to ensure availability and data security? Network Are we ensuring the security of the network? Third Party Risk Are we doing enough to manage partner, contractor, and customer access? IoT How do we securely take advantage of IoT? Data Breach Are we doing enough to control access to sensitive information? Do we understand our threat landscape? Compliance Are we complying with all applicable mandates? How do we reduce the cost of compliance?
- 4. Balancing Act Organisations face a fundamental problem they must overcome. It is the balancing of two directly divergent needs: - Provide access to everything - Restrict access to the minimum necessary
- 5. Primed for Failure Too Open Data breach occurs Too Restricted IT is marginalised and ignored
- 6. A Fundamental Problem There are too many users, with too much access
- 7. Understanding Identity & Relationships Identity & relationships of Users, things, services etc
- 8. Who / What has access • Employees • Contractors • Partners and suppliers • Customers • Services • “Things” • etc
- 9. How do we respond?
- 10. Identity Powered Security Minimise Rights Enforce Access Controls Monitor User Activity
- 11. Manage Rights Managed rights across employee lifecycle Minimise the number of privileged users Minimise the rights users are granted
- 12. Enforce access controls regardless of access point Use common controls across enterprise and cloud apps Leverage adaptive, multifactor authentication Enforce Access Controls Source: “Privileged User Abuse & The Insider Threat”, Ponemon Institute Research Report 5/2014
- 13. Monitor User Activity How are users leveraging the rights granted? Is activity outside defined controls/policies? Is activity associated with a known person or service?
- 14. How does Micro Focus help… …now & in the future
- 16. 16 Cloud/SAAS Privileged Legacy IoT Data “Things” Social Internal Mobile External WhatisbeingaccessedDifferenttypesofidentity Secure Governed Access Activity Monitoring & Analytics Identity Governance & Administration Privilege Management Adaptive Risk-based Access
- 17. Identity Governance & Administration Enforcing the Least-Privilege Principle • Self-service access request/review for SaaS and enterprise apps • Anomaly-based and risk-prioritised “adaptive certifications” • Closed-loop, automated remediation of entitlement creep • Data governance – certify access to data, not just apps • Privilege management – ensure privileges are not misused Activity Monitoring & Analytics Identity Governance & Administration Privilege Management Adaptive Risk-based Access
- 18. Access Management & Authentication Enforcing the Least-Privilege Principle • Invisible end user experience providing access across cloud, enterprise, and hybrid applications and resources • Adaptive, risk-based access makes authentication as convenient as possible for users • Step-up privileged access when risk indicates a need • Tie multi-factor authentication to step-up authentication to further reduce risk of outsider credential abuse Activity Monitoring & Analytics Identity Governance & Administration Privilege Management Adaptive Risk-based Access
- 19. Access Management & Authentication Enforcing the Least-Privilege Principle • Invisible end user experience providing access across cloud, enterprise, and hybrid applications and resources • Adaptive, risk-based access makes authentication as convenient as possible for users • Step-up privileged access when risk indicates a need • Tie multi-factor authentication to step-up authentication to further reduce risk of outsider credential abuse Activity Monitoring & Analytics Identity Governance & Administration Privilege Management Adaptive Risk-based Access
- 20. Activity Monitoring & Analytics Identifying Risks and Threats, Enabling Decisions • Real-time user and entity activity monitoring and response • Policy-based change monitoring including file integrity monitoring • Access metrics: know what users are doing with their access • Identify “things” on the network through integration with Cisco ISE for IoT security Activity Monitoring & Analytics Identity Governance & Administration Privilege Management Adaptive Risk-based Access