Sydney Identity Summit presentation by Andrew Latham, Director, Customer Engineering, ForgeRock and Warren Strange, Director, Customer Engineering, ForgeRock

1. © 2016 ForgeRock. All rights reserved.
Continuous Security
Andrew Latham
Director, Customer Engineering
Sydney Identity Summit

2. © 2016 ForgeRock. All rights reserved.

3. © 2016 ForgeRock. All rights reserved.

4. © 2016 ForgeRock. All rights reserved.

5. © 2016 ForgeRock. All rights reserved.

6. © 2016 ForgeRock. All rights reserved.
Context

7. © 2016 ForgeRock. All rights reserved.
Dynamic

8. © 2016 ForgeRock. All rights reserved.
• Iden0ty A2ributes
• Trusted
Creden0als
• Knowledge
• Variables
• Perceived Risk
• Incen0ve

9. © 2016 ForgeRock. All rights reserved.
Digital

10. © 2016 ForgeRock. All rights reserved.

11. © 2016 ForgeRock. All rights reserved.

12. © 2016 ForgeRock. All rights reserved.

13. © 2016 ForgeRock. All rights reserved.

14. © 2016 ForgeRock. All rights reserved.

15. © 2016 ForgeRock. All rights reserved.

16. © 2016 ForgeRock. All rights reserved.

17. © 2016 ForgeRock. All rights reserved.
Iden0ty’s Unique Role
User Experience Security

18. © 2016 ForgeRock. All rights reserved.
Iden0ty’s Unique Role

19. © 2016 ForgeRock. All rights reserved.
Func0on
Experience
Efficiency
Privacy
Integrity
Availability
User Experience Security

20. © 2016 ForgeRock. All rights reserved.
Availability
Experience
Func0on
Efficiency
Privacy
Integrity
Integrity
Availability
Privacy
Func0on
Experience
Efficiency
User Experience Security

21. © 2016 ForgeRock. All rights reserved.
The Thing about Things…

22. © 2016 ForgeRock. All rights reserved.
Gartner Strategic Planning Assump0on
Enterprises to employ mobile biometric authentication methods
Organizations to use contextual, adaptive techniques with multi-factor authentication
35%
30%
5%
5%Today
Today
End 2016
End 2017

23. © 2016 ForgeRock. All rights reserved.
Connec0ng the Dots

24. © 2016 ForgeRock. All rights reserved.

25. © 2016 ForgeRock. All rights reserved.
Strong Authen0ca0on

26. © 2016 ForgeRock. All rights reserved.
Mobile Biometrics
• Plugs directly into
OpenAM
• Can be used with
Adaptive Risk
module

27. © 2016 ForgeRock. All rights reserved.
Adap0ve Risk
• Assesses risk based on
pre-configured
parameters
• Requires additional
authentication factors
depending on risk score
• Includes over 20
parameters including IP
address, IP history,
cookie value, login
history, Geo location
etc.

28. © 2016 ForgeRock. All rights reserved.
Authen0ca0on: Modules and Chains
• 20+ out-of-box modules including
device ID, OTP, adaptive risk,
Google, Facebook, MS
• Authentication methods can be
chained together for enforcing
different levels or strength of
security
• Scripted AuthN modules extend
functionality on client side and
server side using Groovy and
Javascript

29. © 2016 ForgeRock. All rights reserved.

30. © 2016 ForgeRock. All rights reserved.
ForgeRock DevOps /
Cloud Strategy
Warren Strange
Director, Cloud / DevOps Engineering
Sydney Summit 2016

31. © 2016 ForgeRock. All rights reserved.
Why DevOps?
Expectations for time to value are changing
• Months -> Weeks -> Days
The rise of “12 factor” apps & Continuous Integration
• Before: Deploy new features yearly
• Now: Deploy new features weekly / daily
Shift towards cloud deployments and containers
• AWS, Azure, Google, OpenStack, etc.
• Docker / Kubernetes
31

32. © 2016 ForgeRock. All rights reserved.
ForgeRock DevOps Goal
The agility of an IDaaS, with the flexibility of a custom solution
Flexibility / Power
SpeedofDeployment
IDaaS
Legacy
IDaaS in
a box
32

33. © 2016 ForgeRock. All rights reserved.
What is “DevOps” Friendly?
• Installation / management is easily automated
• Products self tuning / self configuring
• Infrastructure as code
• Repeatable and automated deployments
• Configurations versioned. Code reviews / PRs for configuration
• Useful configuration file formats
• Toolable / templatable
• Human friendly (not a dump of an internal data structure)
• Don’t just automate, eliminate complexity
33

34. © 2016 ForgeRock. All rights reserved.
ForgeRock DevOps Focus
• Core engineering work required to make products more
“12Factor” like
• Requires deep & intimate knowledge of internals of OpenAM /
OpenDJ / OpenIDM / OpenIG
• Where ForgeRock can have the most impact
• Container friendly
• Reduced file system dependencies
• Externalize state
• More “cattle” like
34

35. © 2016 ForgeRock. All rights reserved.
Containers
• Phase 1
• ForgeRock will support customers deploying with
Docker
• Provide sample Dockerfiles / Kubernetes
Manifests
• Phase 2
• Provide reference Docker images
• Distribution mechanism TBD
35

36. © 2016 ForgeRock. All rights reserved.
Feedback Wanted!
• What are your biggest challenges in deployment / management?
• Help us prioritize our efforts
• What is your application AuthN / AuthZ strategy?
• Reverse proxy + HTTP headers - AuthZ at proxy
• Policy Agents (Java EE or .Net)
• OpenID Connect / SAML
• Directly consume OIDC tokens
• AuthZ - use scopes plus custom logic?
• Application landscape
• Java, .Net, NodeJS, Ruby, other?
36

37. © 2016 ForgeRock. All rights reserved.
Container Questions
• What are your plans for Docker?
• Orchestration frameworks such as Mesos /
Kubernetes / Docker Swarm / Amazon ?
• What is your desired Docker support model?
• Would you run ForgeRock curated & tested Docker
images, or is your preference to create your own
Docker images?
37

38. © 2016 ForgeRock. All rights reserved.
Resources
Links to ForgeRock Dockerfiles, Kubernetes manifests, etc.
https://wikis.forgerock.org/confluence/display/DC/ForgeRock
+DevOps+and+Cloud+Resources
Short version of above: https://goo.gl/DOD9pv
Pull Requests are Welcome!
Email me: warren.strange@forgerock.com
38

39. © 2016 ForgeRock. All rights reserved.