Modern Web Access Management ‐ Zero Trust Security ‐ from on‐premises to the Cloud Single Sign On, Access Controls, Session Management and how to use Access Management to protect applications both on premises and in the Cloud
Agenda 1.Zero Trust Web Access Management 2.The Access Management Transformation – moving applications from the data center to the Cloud with Zero Trust Security 2 www.idfconnect.com
Part 1 – Zero Trust Web Access Management 3 www.idfconnect.com
Why Web Access Management? Ensure EVERY request is vetted and scored before Ensure EVERY request is vetted and scored before ever touching your application ever touching your application (Use a “Zero Trust” Architecture) (Use a “Zero Trust” Architecture) Central enforcement and audit of access policies Central enforcement and audit of access policies and activity and activity Continuous Authentcation, Single Sign On, Session Continuous Authentcation, Single Sign On, Session Management,and across all apps EVERYWHERE Management,and across all apps EVERYWHERE 4 www.idfconnect.com
Applications in the Traditional Data Center SSO‐ Access Integrated Mgmt Access Management Agent / Proxy Apps Traffic (vendor‐specific) Active Directory SSO‐ Access Database, etc. Integrated Mgmt Local Users Agent / Proxy Apps SSO‐ Access Integrated Mgmt Agent / Proxy LDAP Apps Access Local Users Manager 5 www.idfconnect.com
5 Modern Access Management Challenges Applications in the Cloud "Agent‐less" Infrastructure AJAX / Mobile / Thick Client Application Integration Use Cases Server‐side Application Access Management Integration as‐a‐Service 6 www.idfconnect.com
A Complete Zero Trust Access Management Solution 01 06 Authentication Centralized Management Audit 05 02 Web Access Session Management Access Control Management Enforcement Risk Scoring Single 04 03 & Analytics Sign On 7 www.idfconnect.com
Common Access Management Gaps in the Cloud 01 06 Authentication Centralized Centralized Management Audit Audit 05 02 Web Access Management Session Session Access Control Access Control (Gaps in the Management Maximum Enforcement Enforcement Time‐to‐Live Cloud) Risk Scoring Idle Session Single 04 03 & Analytics Timeout Sign On 8 www.idfconnect.com
The IDF Connect Solution – SSO/Rest A Rest based‐ lightweight Modern engineering – SSO/Rest combines existing B orchestration, metrics, analytics and emerging technologies to extend the perimeter of your Easy to use, handles latency, C transparent…. IAM solution safely and securely into your public Cloud D Risk scoring, strong platforms authentication SSO/Rest! 9 www.idfconnect.com
But… is this just Federation? NO! Ticket Continuous authentication or Claims‐ Perimeter access management based approaches Block attacks before they touch your applications are not enough: Application security alone is not enough 10 www.idfconnect.com
Remember: Federation is NOT the Same as Web Access Management Federation Web Access Management (WAM) future business www.yourwebsite.com future business www.yourwebsite.com Policy Enforcement Point (PEP) Authentication Policy Decision Point (PDP) One‐time handoff from partner IDP Perimeter Defense Access control Limited logout capability Session lifecycle Audit management 11 www.idfconnect.com
Proven Success Stories Seamless and Secure Integration Fortune 50 retail company makes an acquisition, and has HTML5 js CSS3 seamlessly and securely integrated the new web apps with its XML eCommerce portal, without having to bring the apps in‐house PHP Cloud or creating a VPN to the new company Acquired Company Existing Web Apps eCommerce Portal Successfully Moving .Net applications to Microsoft Azure ASP.NET .NET Fortune 50 finance company successfully moves its .Net C# IIS applications to Microsoft Azure while preserving all of its SSO integrations, authentication and access policies, and audit capabilities .Net Applications Microsoft Azure 12 www.idfconnect.com
You should be interested in this technology if… • You have an existing SSO/WAM solution and are moving applications to the Cloud • You want or need the assurance that every request is VETTED and SCORED before ever touching your application • You require fine grained access controls and centralized policy management • You require a complete audit trail of end‐user activity within a given session • You need a web access management solution that is modern and leverages today’s tools and capabilities (e.g. ELK, Docker, Kubernetes) • You are interesting in offering Web Access Management as a managed service • You have an API Gateway and want a modern Policy Decision Point for its Auth & Auth requirements • You are building rich applications (mobile, AJAX) and require web services for all manner of seamless access management integrations 13 www.idfconnect.com
Part 2 The Access Management Transformation Moving applications from the data center to the Cloud with Zero Trust Security 14 www.idfconnect.com
Zero Trust Security in any Cloud Data Center Application SSO integration requests to SSO/Rest (optional) External Firewall IDF Connect SSO/Rest Gateway Application IDF Connect 1 in the SSO/Rest SSO/Rest Plugin Plugin (JSON over HTTPS) Cloud Browser HTTP(s) requests to application Internal Firewall PEP to PDP Browser AJAX SSO integration Traffic requests to SSO/Rest (optional) • SSO/Rest w/ XACML engine • CA SSO • Oracle AM Policy Decision • OpenAM Point 15 www.idfconnect.com
Data Center IDF Connect SSO‐ SSO/Rest IDF Connect SSO/Rest Plugin Integrated Gateway SSO/Rest (JSON over HTTPS) Apps Plugin SSO‐ Policy Active Directory Integrated Enforcement Database, etc. Point Apps Local Users SSO‐ Policy Integrated Enforcement LDAP Point Apps Policy Decision Local Users Point 16 www.idfconnect.com
Cloud Platform Data Center SSO/Rest Plugin IDF Connect (JSON over HTTPS) SSO/Rest SSO‐ Gateway IDF Connect Integrated SSO/Rest Apps Plugin SSO‐ Policy Active Dir, Integrated Enforcement Database etc. Point Apps Local Users SSO‐ Policy Integrated Enforcement LDAP Point Apps Policy Decision Local Users Point 17 www.idfconnect.com
Data Center SSO‐ IDF Connect IDF Connect Integrated SSO/Rest XACML SSO/Rest SSO/Rest XACML Apps Plugin SSO/Rest Plugin Policy Store Gateway queries (JSON over HTTPS) Policy Evaluation SSO‐ IDF Connect Integrated Active Dir, SSO/Rest Apps Plugin Database etc. Local Users SSO‐ Policy Integrated Enforcement LDAP Point Apps Policy Decision Local Users Point 18 www.idfconnect.com
Data Center SSO‐ SSO/Rest XACML IDF Connect IDF Connect queries Integrated SSO/Rest XACML SSO/Rest Apps Plugin SSO/Rest Plugin Authentication Policy Store Gateway (JSON over HTTPS) Session tokens only! SSO‐ IDF Connect Policy Active Dir, Integrated SSO/Rest Evaluation Databases, etc. Apps Plugin Local Users SSO‐ Policy Integrated Enforcement LDAP Point Apps Policy Decision Local Users Point 19 www.idfconnect.com
Data Center Authentication Cloud Multi‐Factor Authentication SSO‐ IDF Connect IDF Connect Integrated SSO/Rest XACML SSO/Rest SSO/Rest XACML Apps Plugin SSO/Rest Plugin Policy Store queries Gateway (JSON over HTTPS) Session tokens only! SSO‐ IDF Connect Active Dir, Integrated SSO/Rest Database, etc. Cloud Directory / Apps Plugin IDaaS Provider Local Users Policy Evaluation SSO‐ Policy Integrated Enforcement LDAP Point Apps Policy Decision Local Users Point 20 www.idfconnect.com
Data Center Authentication Cloud Multi‐Factor Authentication SSO‐ IDF Connect IDF Connect Integrated SSO/Rest XACML SSO/Rest SSO/Rest XACML Apps Plugin SSO/Rest Plugin Policy Store queries Gateway (JSON over HTTPS) Session tokens only! SSO‐ IDF Connect Active Dir, Integrated SSO/Rest Database, etc. Cloud Directory / Apps Plugin IDaaS Provider Local Users Policy Evaluation SSO‐ IDF Connect Integrated SSO/Rest LDAP Apps Plugin Policy Decision Local Users Point 21 www.idfconnect.com
Data Center Authentication Cloud Multi‐ Factor Authentication SSO‐ SSO/Rest Plugin IDF Connect (JSON over HTTPS) IDF Connect Integrated SSO/Rest SSO/Rest SSO/Rest XACML Apps Plugin queries Gateway SSO‐ Policy Cloud Directory / IDF Connect Integrated Evaluation IDaaS Provider XACML SSO/Rest Policy Store Apps Plugin SSO‐ IDF Connect Integrated SSO/Rest Apps Plugin 22 www.idfconnect.com
Complete enterprise‐grade IAM‐as‐a‐Service! Cloud Multi‐ Cloud Directory / Factor IDaaS Provider Authentication Data Center SSO‐ IDF Connect Integrated SSO/Rest SSO/Rest Plugin Cloud Access Apps Plugin (JSON over HTTPS) Management Service SSO‐ IDF Connect Integrated SSO/Rest Apps Plugin SSO‐ IDF Connect Integrated SSO/Rest Apps Plugin 23 www.idfconnect.com
Platform support Web Servers: App Servers: Web services for all manner of integrations App Platforms: …and other thick clients! 24 www.idfconnect.com
Recommend
More recommend
