Overview Oracle Identity Management tijdens AMIS Simplified Security seminar
•
2 likes•1,299 views
Presentatie van Maurice Luizink van Oracle over Oracle's Identity Management oplossingen tijdens het AMIS Simplified Security seminar op 18 juni 2015.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Overview Oracle Identity Management tijdens AMIS Simplified Security seminar
Similar to Overview Oracle Identity Management tijdens AMIS Simplified Security seminar (20)
More from Getting value from IoT, Integration and Data Analytics
More from Getting value from IoT, Integration and Data Analytics (20)
Recently uploaded
Recently uploaded (20)
Overview Oracle Identity Management tijdens AMIS Simplified Security seminar
- 5. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Accelerated Pace of Change Rapidly Evolving Opportuni7es in Business and Society 80% OF USER ACCESS WILL BE MOBILE BY 2020 44% OF ORGANIZATIONS PLAN TO SOCIAL ENABLE APPLICATIONS CLOUD COMPUTING WILL BECOME THE BULK OF NEW IT SPEND BY 2016 THERE WILL BE 26 BILLION CONNECTED DEVICES BY 2020
- 7. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Challenges of the New Digital Economy • More applica?ons to onboard and manage • Outdated Request & Fulfillment processes • Limited visibility across Enterprise, Mobile & Cloud applica?ons • Manual access cer?fica?on processes • Delays revoking unauthorized access Enabling Users and Maintaining Access Controls – Iden7ty Governance
- 8. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Requirements for the New Digital Economy • Business Friendly Access Request & Approval Interfaces • Scalable & Flexible Access Cer?fica?on • Automated Provisioning & Closed Loop Remedia?on • Management of standard and privileged user accounts • Common Connector Framework Unified Iden7ty Governance
- 10. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | 10 Mobile Security Iden7ty Governance Directory Services Access Management Encryp7on & Redac7on Privileged User Control Key Management Ac7vity Monitoring Configura7on Management Database Firewall SECURING ACCESS TO APPS & DATA IDENTITY MANAGEMENT DATABASE SECURITY
- 11. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Mobile Security – Mobile Applica?on Management – Mobile Device Management – Mobile Access Management – API Security – Mobile Authen?cator Iden7ty Governance – Access Request – Access Governance – Automated Provisioning – Privileged Account Management Access Management – Authen?ca?on – Authoriza?on – Audit – Federa?on Directory Services – Enterprise Directory – Cloud/Mobile App Directory – Virtual Directory Oracle Iden?ty Management
- 12. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Oracle Iden?ty Management 11gR2 PS3 – Highlights • Mobile Security – Supports corporate-owned devices using Mobile Device Management (MDM) – Integrates with exis?ng Iden?ty Management solu?ons for simplified opera?ons and ?ghter security • Iden7ty Governance – Converged role management, SoD, and closed-loop remedia?on – Windows session recording for privileged accounts – Simplified and intelligent self-service and access request • Other Key Improvements – Con?nued suite simplifica?on via automated patching and upgrades – Mobile Authen?cator enhanced to allow PIN-less 2-factor authen?ca?on – Convergence of virtualiza?on into Oracle Unified Directory (OUD)
- 14. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Oracle’s Mobile Security Strategy Comprehensive Enterprise Mobility Management 14 • Secure Container • Application Management • Device Management • Content Management • Web and Native App SSO • Enterprise App Store • Productivity Apps • Unified Self-Service Console Secure Device & Data Simplify User Experience Restore Control • Governance & Compliance • Strong Authentication • API Security • Unified Delegated Admin Console
- 17. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Oracle Mobile Security Suite 11gR2 PS3 – New Features • Mobile Device Management • Integrated Administra?on & Self-Service with OAM & OIM • Risk Based Step-up authen?ca?on • Support for Android 5 incl. secure storage using NDK API • Support for kiosk mode • Support for addi?onal LDAP directories
- 18. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Oracle Secure Mobility Secure BOTH consumer and containerized apps Corporate DMZ Corporate Network HTTP/REST/SOAP/OAUTH SOAP/REST and Legacy Web Services Oracle Mobile Access Server Oracle API Gateway Corporate Resources Oracle IDM Stack Oracle Mobile Security Manager Oracle Identity Governance Oracle Access Management Unified Registry
- 19. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | API Management and Security • Extend Access Management to REST APIs • Context aware • Authen?ca?on • Authoriza?on • Fraud detec?on • Security tokens • Data redac?on • Audit 19 Secure mobile access to corporate informa7on Transforma7on API Control & Governance API Management & Monitoring Threat Protec7on Secure REST API’s OAUTH 2.0 Client & Server Client Thro[ling Native JSON & XML Processing < XML > {“JSON”} API Key Management OracleAccessManagement
- 20. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | 20 Fine grained authoriza7on for Mobile Apps Exposing Secure APIs /customer/get /customer/update /customer/delete Customer Service REST API Request “User”: Bob Doe “Org”: Acme Corp “Grade” : Marketing Manager “Customer”: “ID”: 12345
- 21. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | /customer/get /customer/update /customer/delete Customer Service REST API Request 21 Fine grained authoriza7on for Mobile Apps Exposing Secure APIs API Gateway En7tlements Server PEP PDP isAuthorized(user = Bob Doe, userOrg = Acme Corp userRole = Marketing Manager resource = Customer Service action = /customer/get customerID = 12345)
- 22. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | /customer/get /customer/update /customer/delete Customer Service REST API Request 22 Fine grained authoriza7on for Mobile Apps Exposing Secure APIs API Gateway En7tlements Server PEP PDP isAuthorized(user = Bob Doe, userOrg = Acme Corp userRole = Marketing Manager resource = Customer Service action = /customer/get customerID = 99999)
- 23. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Fine grained authoriza7on for Mobile Apps Exposing Secure APIs /customer/get /customer/update /customer/delete Customer Service REST API Response “Customer”: “ID”: 99999 “Name”: Sally Smith “Phone”: 01323 232125 “NI”: AB 12 34 56 B “CreditCard”: 1122 3344 5566 “Purchase History”: …
- 24. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Fine grained authoriza7on for Mobile Apps Exposing Secure APIs /customer/get /customer/update /customer/delete Customer Service REST API Response API Gateway En7tlements Server PEP PDP isAuthorized(user = Bob Doe, userOrg = Acme Corp userRole = Marketing Manager resource = Customer Service action = /customer/get customerID = 99999) “Customer”: “ID”: 99999 “Name”: Sally Smith “Phone”: 01323 232125 “NI”: @^*%&@$#%! “CreditCard”: **** **** 5566 “Purchase History”: …
- 27. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Key focus areas for PS3 Simplified Iden7ty Governance 27 • Clean UI with a Cloud look and feel, with faster performance • End-users get easy access to business func?ons without requiring customiza?on • Collabora?ve cer?fica?on process • Intelligent Access Catalog
- 28. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Oracle Iden?ty Governance 11gR2 PS3 – New Features • Business Friendly Interfaces & Intelligent Catalog • Comprehensive Role Management & Con?nuous Compliance • SOD Detec?on & Closed Loop Remedia?on • Iden?ty Services for Mobile & Extranet (REST API - SCIM 2.0) • Enhanced Privileged Access • Enhanced Audi?ng (synchronous) • Temporal grants for new and exis?ng access
- 29. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Iden?ty Administra?on • Self Service – Self Registra?on, Self profile management – Self Password management – Reset/Forgot Password, Challenge Ques?ons • User Management – User Life Cycle Mgt, Delegated Administra?on, Proxy User – Configurable policies for UserName and Password genera?on • Password Policy – Global – Organiza?on Scoped • Support for REST, SPML and Remote APIs • Orchestra?on engine for extensibility – Plug-in and Event Handlers Oracle Solu7on
- 30. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Access Provisioning • Provisioning framework and data model for modeling target applica?ons • Role Based Access Controls • Iden?ty Connectors • Reconcilia?on • Disconnected Applica?on Framework Oracle Solu7on
- 31. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Access Provisioning • Common Connectors for all Governance needs • Supports mul?ple target versions and mul?ple instances of a target simultaneously • Flexible deployment op?ons – local and remote deployment • Extensible – Administrators can extend the capabili?es without coding • Connector for Web Services Identity Connector Framework Access Request Access Certification Privileged Access Identity Connectors Cloud Applications Enterprise Applications Directories Databases Custom Applications and Mainframes P R O V I S I O N I N G E N G I N E SOD Evaluation Iden7ty Connectors
- 32. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | • Control and provide informa?on for ac?vi?es, such as: • Crea7on of roles. • Modifica7on of role a[ributes. • Modifica7on of role members. • Dele7on of roles. • Business users can request crea?on of new roles and changes to exis?ng ones • Role requests can leverage the same request and approval framework available for Access Requests and Cer?fica?on • Role owners can see comprehensive audi?ng and prior versions Role Life Cycle Management Oracle Solu7on
- 33. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | • Comprehensive role analy?cs allows business users to see the impact of new roles and changes to exis?ng ones • Role owners can reduce role explosion by review the effec?veness of the roles and consolidate new roles with exis?ng ones • Business users can create roles using “model users” Comprehensive management func7onality Role Life Cycle Management
- 34. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Access Request Management • Access Catalog provides ability to browse and search • Smart search forms allow users to navigate the Catalog in a guided manner • Catalog search results indicate relevance • Access Catalog can recommend access based on pre-defined and user-defined criteria • Support for Start/End Dates for Access Grants • Preventa?ve SoD Analysis Intelligent Access Catalog
- 35. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Access Request Management • Administrators can define custom security roles to control who can do what at an aoribute level • Users can be assigned security roles via rules reducing administra?on burden • User ac?ons and the context that they used to perform the ac?on are audited • SOA based approval workflow Simplified yet granular security
- 36. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | • Configurable risk defini7on and periodic risk aggrega7on • Four Types of Iden?ty Cer?fica?on (User, Role, App Instance, En?tlement). • Schedule, monitor, delegate and audit cer7fica7ons • Online and offline user cer?fica?on • Mul7 Phased Review • Closed-loop remedia7on • Generate user/applica?on cer?fica?ons • Generate cer?fica?on reports Oracle Solu7on Access Cer?fica?on Access Certification JDOE Accounts Payable JDOE Accounts Receivable
- 37. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | • SOD Rule and Policy Defini?on • Define rules across users, applica?ons, roles and en?tlements • Detec?ve SOD Analysis • Detec?ve Policy Enforcement – Closed Loop Remedia?on • Access History to audit all viola?ons and decisions • Review High Risk policy viola?ons in Cer?fica?ons • Preventa?ve SOD Analysis • Enforce SOD policies during access requests • Review policy viola?ons during approvals and launch excep?on workflows Oracle Solu7on Iden?ty Audit / Segrega?on of Du?es
- 38. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Oracle Identity Manager Database Metadata Audit/Compliance BI Publisher Reads Oracle Identity Manager database to provide Identity Management reports Conducts Identity Management while saves/audits information – Embedded BIP, No separate BIP infrastructure required – New Lightweight Audit Engine – Supports new entities and processes Audit and Repor7ng Iden?ty Audit / Segrega?on of Du?es
- 39. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | • Ac?onable dashboards for risk analysis and compliance • 80+ OOTB reports providing a 360 deg. view of users’ access • Flexible deployment op?ons, including ability to schedule report runs • Publicly available schema Reports and Dashboards Iden?ty Audit / Segrega?on of Du?es
- 40. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Oracle Privileged Account Management 40 Control access to high privileged accounts • Managed targets • Unix/Linux • Windows Local Account • HyperVisor and Network Devices • SAP • Scripted Connector (SSH) to speed up integra?on with network devices • Session Management control policies • Windows (DVR-like) session recording
- 43. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Oracle Access Manager 43 Simplified Converged Complete Access Solu7on • Single pla]orm to secure on- premise, Cloud, and mobile access • Support seamless mul?-channel access with modern user experience • Fully Converged Federa?on Solu?on • Intelligent Context Aware Authen?ca?on – Na?ve OTP Via: SMS, Email, Mobile – Step Up Based on post auth Rule or auth level • Seamlessly integrate with Oracle and third-party enterprise applica?ons
- 44. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Oracle Access Manager Cloud Access Portal • Deliver User Single Sign-on To Cloud Apps From Launchpad Portal • Provide Seamless Access From Smart Phone, Tablet and PC • Support For Federated and Unfederated Apps • Switly Remove Unauthorized Access 44
- 45. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Oracle Access Manager • Push no?fica?on and one-buoon verifica?on • Support for mul?ple account registra?on • Custom Branding (modify the app name, font, icons, etc) • Integrated into Access Management • Client app downloaded from corporate app store Oracle Mobile Authen7cator
- 46. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Oracle Access Manager Integrated Support for OAuth 46 • Enable User To Authorize 3rd Party Apps to Access and Leverage User Data • Avoid storing iden?ty data in unnecessary loca?ons • Provide Support for both server and client, 2 and 3 legged, profile services • Connect support with enterprise iden?ty management systems
- 49. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | OUD Virtualiza7on Storage Synchroniza7on Cloud Apps Databases Enterprise Apps Servers Mobile Apps HR DB DSEE Ac7ve Directory OUD – The All in One Directory 49 • Storage, virtualiza?on and Sync • High performance • Extreme scalability • REST support
- 50. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Licensing Iden?ty & Access Management Solu?ons • Models – Employee and Non-Employee – CPU and NUP • Iden?ty & Access Management Licensing Guide – hop://docs.oracle.com/cd/E55108_01/doc.1213/e56762/toc.htm • Products and Suites – API Gateway – En?tlements Server Security Module – Iden?ty Manager Connectors 50
- 51. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | Licensing Iden?ty & Access Management Solu?ons • Suites – Iden?ty & Access Management Suite Plus • Iden?ty Manager, Access Manager, Iden?ty Federa?on, and Directory Services Suite Plus – Iden?ty Governance Suite • Iden?ty Manager, Privileged Account Management, Iden?ty Analy?cs, and various Connectors – Access Management Suite Plus • Access Manager, Adap?ve Access Manager, En?tlements Server, Iden?ty Federa?on – Directory Services Suite Plus • Internet Directory, Unified Directory, Virtual Directory 51