Ping Identity solutions for Customer Identity and Access Management

Transcription

1 KuppingerCole Report WHITEPAPER by John Tolbert March 2017 Ping Identity solutions for Customer Identity and Access Management Customer Identity and Access Management systems and services provide new technical capabilities for organizations to know their customers better. Implementing Ping Identity s solutions for CIAM can provide better user experiences, generate additional revenue, and enhance brand loyalty. by John Tolbert jt@kuppingercole.com March 2017 Commissioned by Ping Identity

2 Table of Contents 1 Executive Summary Highlights Consumer Identity Management Business Drivers One IAM / SSO Know Your Customer (KYC) Revised Directive on Payment Services (PSD2) Consent Management Consumer Identity Management Challenges IAM and CIAM: When both are needed IT Modernization Architecture The Ping Identity approach to Consumer Identity and Access Management Each component is described below PingFederate for SSO PingID for Multi-Factor Authentication PingDirectory for customer profile storage PingDataGovernance for policy-based access control to resources PingAccess for policy-based access control Recommendations Recommendations for those contemplating a CIAM technology insertion Recommendations for current CIAM tenants and operators Copyright Page 2 of 15

3 List of Figures Figure 1: Co-existence: employee IAM and consumer IAM... 9 Related KuppingerCole Research Documents Advisory Note: Access Governance Architectures Advisory Note: Entitlement & Access Governance Leadership Compass: Access Governance Advisory Note: Sustainable Infrastructures through IT Compliance Page 3 of 15

4 1 Executive Summary Customer Identity and Access Management (CIAM) is the fastest growing specialty in Identity and Access Management (IAM) that has emerged in the last few years to meet evolving business requirements. Many businesses and public sector organizations are finding that they must provide better digital experiences for and gather more information about the consumers who are using their services. Enterprises want to collect, store, and analyze data on consumers to create additional sales opportunities and increase brand loyalty. For example, to reduce money laundering, cyber-crime, terrorist financing, and fraud, regulators are requiring banks and financial service providers to put into place mechanisms for Knowing Your Customer (KYC). Having IAM systems dedicated to hosting consumer identities and their associated profiles is a necessary first step toward KYC. Customer Identity solutions Provide self-registration for customers Alternatively, provide options for bulk import of customer identities from existing systems Give users consent mechanisms to control the use of their data Enable Single Sign-On (SSO) across all digital properties Present multiple authentications options for customers, depending on policies, risks, and mechanisms available Manage unified customer profiles Facilitate fine-grained access control to resources and data Can be deployed on-premise, in the cloud or both Scale to support millions of consumers, peak usage scenarios, and ensure performance and availability SLAs are met. This paper explores CIAM concepts, business drivers, challenges of designing CIAM solutions, and the entry points into solution architectures. The paper will further show how Ping Identity s suite of products can help meet both the business requirements and challenges of customer identity by providing customers with a robust, scalable, and future-embracing solution set. Page 4 of 15

5 2 Highlights Creating new ways to engage customers online is a mandatory business strategy. Customers want a pleasant, consistent digital experience when interacting with brands across all channels and devices. Customers do not tolerate painful site registration processes, difficult authentication, or slow system response times. Customers who abandon laborious registration processes or who repeatedly encounter slow systems will look to the competition. Businesses need CIAM solutions that can be white labelled, permitting tenants and operators to present a seamless, consistently branded user experience. CIAM systems facilitate gathering a full view of the consumer. Previously, information about customers was usually distributed amongst different systems. In many other industrial sectors, IT and Marketing departments are working together to deploy CIAM services to better understand what their customers want, create personalized marketing campaigns, offer loyalty discounts, and much more. CIAM technology needs to be flexible to handle differing regulatory schemes in many countries and regions, as well as changes to the regulations themselves. Privacy compliance and fine-grained consent management are top concerns for organizations doing business with or within the EU today. Page 5 of 15

6 3 Consumer Identity Management Business Drivers Digital transformation is an objective that many organizations have on their agendas today. Businesses are finding that they need to learn more about their customers and provide better online experiences for customers, for a variety of reasons. The following is a description of some emerging business requirements that can best be satisfied by CIAM solutions. 3.1 One IAM / SSO Let s use a hypothetical scenario to illustrate the need for a coherent identity management solution for customers. Acme is a financial institution with multiple business lines encompassing mortgages, auto financing, banking, and business loans. Acme s business units have operated autonomously, and silos of support systems, including distinct IAM instances have been built. Many of Acme s customers have multiple products, such as mortgages and car loans. Thus, they have accounts in multiple systems. Acme wants to prevent the proliferation of more usernames and passwords, unify the existing accounts, and offer new methods for authentication to improve the customer experience. Moving to a single CIAM solution would allow Acme to consistently brand their sites, move to a single customer identity, promote SSO across all their digital properties, provide new authentication options, and collect better information about the different types of customers to be able to better market to them. Furthermore, having a single identity and SSO will reduce help desk calls for password resets, thereby decreasing support costs while improving customer experiences. 3.2 Know Your Customer (KYC) Knowing your customer is an e-commerce imperative. Companies that gather and utilize information about their customers are able to offer discounts, targeted marketing, special deals, and reward programs for frequent buyers or users of their services. CIAM operators can collect basic data about customers at registration, and use progressive profiling to acquire more information as the customer s relationship with the company extends over time. Additional customer information can be acquired through other apps and channels. Most CIAM products can harvest and transform the data into business intelligence, and/or make it available to a variety of 3 rd party marketing analytics and automation programs via APIs for additional processing. Knowing Your Customer is not just a competitive advantage, but is also a necessary strategy for increasing revenue and complying with regulations. 3.3 Revised Directive on Payment Services (PSD2) Within 2 years of 25 November 2015, the Revised Directive on Payment Services (PSD2) comes into effect across the EU 1. PSD2 defines the business entities Payment Initiation Service Providers (PISPs), which will have the ability to start payment processes directly between consumers and merchants; and 1 Page 6 of 15

7 Account Information Service Providers (AISPs) that will have the ability to aggregate account information about consumers and businesses. These business functions have historically been performed by banks or related banking services. Competition in the financial sector within these newly defined roles could emerge from non-traditional, non-banking types of businesses. Both these new PISPs and AISPs as well as traditional banks and financial service enterprises will increasingly utilize CIAM technologies for KYC. PSD2 will create new competition for as well as business opportunities for financial institutions, and direct customer engagement will be essential As discussed above, banks and other financial service companies have an AML responsibility that can be facilitated by CIAM. With a potential for increased competition in the financial services market, CIAM, employed for the purposes of increasing brand loyalty among and marketing additional financial services to consumers, will likely become an important differentiator and competitive advantage for those businesses which implement CIAM. 3.4 Consent Management Through registration to CIAM systems and subsequent usage of sites, customers create a lot of data. While the information processed by these systems is inherently useful, provisions must be made to give individual customers control over the types of data collected and the usages for which it is permitted. Customers data usage is governed by various laws and regulations across many legal jurisdictions. CIAM solutions must provide their tenants with the ability to comply with these different consumer privacy regulations and to offer consumers the ability to review and limit how their information is used and distributed. When consumers register with sites, they are given the opportunity to provide requested information, or in many cases, pull additional attributes from existing social network profiles. Individuals should be given very specific choices about which attributes can be used for which purposes. Requiring people to give a lot of personal information at registration that seems unnecessary to the primary function of the site will cause users to abandon the registration attempt. If users are allowed to point the registration process to a social media site, attributes can be provisioned into CIAM, with consent. When regulations change, or when CIAM tenants enter into agreements with other sites to share data, customers need to be notified and given an opportunity to opt-in or opt-out; moreover, their choices should propagate across the entire enterprise application portfolio. The European Union s General Data Protection Regulation (GDPR) defines personally identifiable information (PII), and sets out strict rules for processing and handling PII with which businesses must comply, or face hefty penalties. For more information about GDPR compliance, other reports at KuppingerCole. For the full text of the GDPR, visit Page 7 of 15

8 4 Consumer Identity Management Challenges Customer identity management solutions can help solve real business problems. However, there can also be challenges associated with procuring, architecting, and deploying these platforms. IT departments are not always the first point of contact that CIAM vendors hear from in organizations. In fact, sometimes the marketing department makes first contact, searching for solutions for their own business objectives. In these cases, IT groups may have been slow to react to the wider enterprise goals, putting them a little behind. In the recent past, IT departments are working closely with other groups within their enterprises to define the requirements, search for the right vendor product or service for their particular needs, and implement the solution. 4.1 IAM and CIAM: When both are needed Traditional IAM systems are designed to provision, authenticate, authorize, and store information about workforce users. User accounts are defined; users are assigned to groups; users receive role or attribute information from an authoritative source. They are generally deployed in an inward-facing way to serve a single enterprise. Over the last decade, many enterprises have found it necessary to also store information about business partners, suppliers, and customers in their own enterprise IAM systems, as collaborative development and e-commerce needs have dictated. Many organizations have built extensive identify federations to allow users from other domains to get authenticated and authorized to external resources. Traditional IAM scales in well-defined environments of hundreds of thousands of users. Customer IAM systems are designed to provision, authenticate, authorize, collect and store information about customers from across many domains. Unlike regular IAM systems though, information about these consumers often arrives from many unauthoritative sources. CIAM systems generally feature password-based authentication, but also support social logins, mobile authentication, and other MFA methods. Information collected about customers can be used for many different purposes, such as authorization to resources, or for analysis to support marketing campaigns, or Anti-Money Laundering (AML) initiatives. Moreover, CIAM systems must be able to manage millions of identities, and process potentially billions of logins and transactions per day. CIAM solutions are generally designed for very high-scale utilization Almost every company with more than a couple of employees has some sort of IAM solution. Enterprises often have LDAP directories and/or Microsoft Active Directory (AD) that contain user information. Other options include using Identity-as-a-Service (IDaaS) providers. For companies with extensive IAM infrastructures, determining how to add robust, customer-facing IAM is an important consideration. At a high level, the two major options include extending the internal IAM to cover customers, or deploying a focused CIAM solution, and then federating between the workforce IAM and CIAM solutions. Page 8 of 15

9 Extending internal IAM for customers may work for the following conditions: Number of anticipated customers are between hundreds to hundreds of thousands Other customer-facing systems (portals, online stores, etc.) have access to internal IAM Authentication and authorization traffic from inside won t impact external usage (and vice versa) Customer data can fit neatly into LDAP or SQL schemas If these conditions cannot or are unlikely to be met over the long-term, deploying a separate CIAM solution would likely be the best approach. Creating a distinct CIAM system for customer-facing environments has the following advantages: More scalable in terms of number of users that can be supported number of authentication and authorization events transaction capacity customer profile data storage Unstructured data can be accommodated in customer profiles Versioning and maintenance do not have to be tied to production infrastructure schedules Unencumbered by legacy system/application requirements and IT architectures Organizations that choose the second route (new CIAM with IAM) can always establish identity federations between the customer and employee environments. Figure 1: Co-existence: employee IAM and consumer IAM Page 9 of 15

10 4.2 IT Modernization During the planning stage, or even as late as the implementation stage, some organizations find that their current on-premise IT infrastructure is in some ways insufficient for handling the projected needs of the CIAM solution. As early in the planning stage as possible, try to get realistic estimates for numbers of consumers, average traffic, peak traffic, storage requirements, etc. If the numbers seem low, increase the estimate. Compare the peak traffic and maximum storage requirements to the capacity of the network and server resources that will be dedicated to CIAM. An on-premise CIAM installation may require additional infrastructure and/or upgrades. Consider if any of the following components need to be modernized, upgraded, or expanded: Network: bandwidth, Quality of Service (QoS) in Service Level Agreement (SLA) with provider(s), routing DMZ: firewalls/web application firewalls capabilities Data center: server capacity, power, cooling Web tier: web server versions, operating systems, virtualization, load-balancing configuration Application tier: application versions, operating systems, virtualization 4.3 Architecture There are two major entry points to consider from an architectural perspective: on-premise or cloud. Your organization may favor an on-premise installation if you have already been accommodating customers in your current IAM system. If the projected number of customers, profile storage, network bandwidth, and server utilization will allow it, then consider expanding your current IAM infrastructure. This option maximizes the use of current infrastructure, and creates immediate return on investment. If your organization decides to expand an on-premise IAM solution, then create a separate instance of web tier, application tier, and CIAM tier of servers to handle the consumer demand. Plan for utilization, and deploy accordingly. Setting up a CIAM service in the cloud is usually faster If your organization decides to start anew or encounters difficulties with its current systems, then moves to develop a fresh cloud-based customers IAM solution, then the same planning and capacity issues must be addressed by the cloud service provider. A cloud-based approach offers some advantages over an on-premise installation. In general, setting up a CIAM service in the cloud is faster. If IT modernization is deemed too costly or too labor intensive to be undertaken in conjunction with CIAM, then establishing a hosted CIAM presence will allow you to meet identity management and marketing goals independently of your internal infrastructure upgrades. Page 10 of 15

11 5 The Ping Identity approach to Consumer Identity and Access Management Ping Identity offers a rich and robust set of services to corporate tenants and encompasses all the necessary features of a CIAM solution, such as self-registration and maintenance, authentication, user profile storage, and identity analytics reports and APIs. Internal administrators and other employees will need to have access to consumer-facing properties. PingFederate s federation and SSO functions will assist in connecting the internal and customer-facing environments. PingFederate can provide a bridge between internal AD, LDAP, or even other IDaaS repositories and their cloud-hosted identity service, PingOne Cloud. Each component is described below. 5.1 PingFederate for SSO PingFederate was Ping Identity s original flagship product for SSO. For identity federation, it supports all the relevant protocols, including SAML, OpenID, OpenID Connect, OAuth, WS-Federation, and WS-Trust. It can connect identities from Microsoft Active Directory, Azure AD, LDAP, RADIUS, and x.509. PingFederate has integration kits for Microsoft IIS, Apache Web Server, Apache Tomcat, IBM WebSphere, and Oracle Weblogic. PingFederate also integrates with the following WAM systems: CA Siteminder, Oracle Access Manager, Tivoli Access Manager, and SAP NetWeaver. Users can federate into IaaS platforms such as Amazon Web Service and Citrix XenApp, as well as thousands of SaaS applications. Examples of SaaS apps supported are Salesforce, Office 365, and Dropbox. Developers can utilize PingFederate functionality directly from.net, Java, PHP, Perl, and Python. For authentication, PingFederate interoperates with PingID (detailed below), RSA SecurID, Google Authenticator, and Symantec VIP. It also supports social logins via Facebook, Twitter, Google, and LinkedIn. By using the federation protocols, PingFederate facilitates connections between on-premise identity repositories and CIAM instances in PingOneCloud. PingFederate can enable SSO to CIAM instances by internal and external administrators Whether installed locally or in the cloud, PingFederate is easy to manage, with an intuitive administrative interface. Administrators can define test configurations and promote the configurations into production. Page 11 of 15

12 5.2 PingID for Multi-Factor Authentication PingID provides a large number of MFA options. Administrators can choose to implement the following authenticators: Mobile apps for Android and ios RSA SecurID Biometric apps on Android and ios Google Authenticator Phone, , and SMS OTP SafeNet Mac or Windows desktop app OTP Symantec VIP Apple Watch Yubikey Administrators can create policies that determine when MFA is required. Factors that can be used in policies for triggering MFA include group membership, target application, geo-fencing, IP address ranges, and root/jailbreak status. Policies can be written to use the PingID mobile app via push notification as a second factor authenticator for access to desktop and SaaS apps. PIngID integrates with VPN via RADIUS. It can be configured to serve as second factor authentication for access to Checkpoint, Cisco, Citrix, F5, Fortinet, Juniper, Microsoft UAG, Palo Alto Networks, and Sonicwall VPNs. 5.3 PingDirectory for customer profile management PingDirectory is the identity repository, and can scale to handle millions of identities, billions of attributes associated with those identities, and up to 2.5 billion transactions per day. It also provides storage for customer profiles, which can include both traditional structured data (LDAP, for example) as well as unstructured data such as text, audio, video, and photos. PingDirectory can import and synchronize user data to/from other directories via LDAP and SCIM. PingDirectory encrypts data in transit and while stored for maximum security. It also encrypts log files, and can interoperate with 3 rd party SIEM/RTSI applications. PingDirectory can be configured to alert administrators when elevated privileges are employed by users in the system. It supports policy-based access control to Personally Identifiable Information (PII). 5.4 PingDataGovernance for administering policy-based access control to resources PingDataGovernance works with PingDirectory to manage customer profiles, secure access to customer profiles, enforce customer preferences, and enforce privacy settings. PingDataGovernance allows users to set their data sharing preferences very granularly: at the attribute level. It is designed to work across multiple privacy regulatory regimes. PingDataGovernance uses REST APIs for reading and writing attributes, and has an SDK for developers to customize programmatic access. Consent management is critical for GDPR compliance Page 12 of 15

13 PingDataGovernance presents a portal for customers to manage their own identity data. It allows users to set their privacy preferences, and opt-in or opt-out of data sharing. The portal is fully customizable, and can integrate seamlessly with customer sites, for a consistent look-and-feel. PingDataGovernance supports delegated administration. For example, consider the case where customer service representatives (CSRs) need to access customer records. PingDataGovernance allows for account searching, Create/Read/Update/Delete rights to be assigned to CSRs by policy, and automatic obfuscation of sensitive data, such as Social Security Number, in the CSR view. 5.5 PingAccess for enforcing policy-based access control to resources PingAccess can work in conjunction with WAM systems, as a policy-based access control gateway (proxy or agent architecture) within or between federated WAM instances. In a consumer-facing setting, PingAccess serves as the rules and risk engine that evaluates user access requests in accordance with policies. Factors which are parsed in PingAccess decisions include identity (role-based or attributebased), network ranges, time ranges, authentication levels, session information, OAuth scopes and attributes. PingAccess can store identity and session information in JSON Web Tokens (JWTs) to provide stateful-like functionality using stateless mechanisms. PingAccess can sign JWTs for higher security, and maintain and act upon session revocation lists. Page 13 of 15

14 6 Recommendations Customer Identity management has become a fast-growing market segment. It has evolved to meet specific requirements that businesses are encountering in an increasingly competitive e-commerce environment. In many cases, CIAM solutions have begun to diverge substantially from traditional IAM stacks. Their purposes are different; and purposes dictate features. KuppingerCole recommends investigating and deploying customer-oriented identity management solutions where appropriate. Bear in mind that many organizations will likely need both a CIAM and IAM solution. Below are some concrete recommendations for considering and also proceeding with a CIAM implementation. 6.1 Recommendations for those contemplating a CIAM technology insertion IT teams should welcome the opportunity to work with Sales and Marketing to transform IT into a revenue producing service. Inventory existing IAM infrastructure; determine best course of action between on-premise or cloud deployment model. Work between IT, Marketing, and Legal departments to create a comprehensive list of requirements. Determine which consumer attributes need to be tracked; plan accordingly for user profile storage. 6.2 Recommendations for current CIAM tenants and operators Utilize APIs and 3 rd party tools to extend functionality where needed. For financial services businesses, use CIAM tools to KYC, comply with AML, and gain competitive advantage for PSD2. Consider migrating away from password based authentication where possible. Prepare your CIAM solution to comply with EU General Data Protection Regulation (GDPR). Focus on user profile storage locations and consent management features. Use a risk-based management approach to CIAM. Use step-up or adaptive authentication for high-value transactions. 7 Copyright 201/ Kuppinger Cole Ltd. All rights reserved. Reproduction and distribution of this publication in any form is forbidden unless prior written permission. All conclusions, recommendations and predictions in this document represent KuppingerCole s initial view. Through gathering more information and performing deep analysis, positions presented in this document will be subject to refinements or even major changes. KuppingerCole disclaim all warranties as to the completeness, accuracy and/or adequacy of this information. Even if KuppingerCole research documents may discuss legal issues related to information security and technology, KuppingerCole do not provide any legal services or advice and its publications shall not be used as such. KuppingerCole shall have no liability for errors or inadequacies in the information contained in this document. Any opinion expressed may be subject to change without notice. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them. Page 14 of 15

15 The Future of Information Security Today KuppingerCole supports IT professionals with outstanding expertise in defining IT strategies and in relevant decision making processes. As a leading analyst company KuppingerCole provides first-hand vendor-neutral information. Our services allow you to feel comfortable and secure in taking decisions essential to your business. KuppingerCole, founded in 2004, is a global Analyst Company headquartered in Europe focusing on Information Security and Identity and Access Management (IAM). KuppingerCole stands for expertise, thought leadership, outstanding practical relevance, and a vendor-neutral view on the information security market segments, covering all relevant aspects like: Identity and Access Management (IAM), Governance & Auditing Tools, Cloud and Virtualization Security, Information Protection, Mobile as well as Software Security, System and Network Security, Security Monitoring, Analytics & Reporting, Governance, and Organization & Policies. For further information, please contact clients@kuppingercole.com Kuppinger Cole Ltd. Sonnenberger Str Wiesbaden Germany Phone +49 (211) Fax +49 (211)