SUNSERVERS. Enterprise Computing. Sun Microsystems,

Transcription

1 SUNSERVERS Thecurity Newand Standard in Se Auditing Enterprise Computing Elias Elias Alagna Alagna Systems Systems Engineer Engineer Sun Microsystems, Sun Microsystems, Inc. Inc. 1 1

2 So laris Basic Security Module BSM enables Sun to pass Evaluated Assurance Level 4 (EAL4) of the Controlled Access Protection Profile (CAPP) of the Common Criteria IT security evaluation Not enabled by default Available on Solaris 8, 9 and

3 So laris Security Auditing Enabled by the BSM Audit logs are binary files and can reside in a local or remote filesystem The log files are read with native Solaris commands Output can be to browser based XML 3 3

4 Co nsiderations fo r Auditing Audit logs can be large Auditing can record an event but does not prevent it from happening Auditing can be disabled by super users 4 4

5 RBACx The Role Management & Identity Compliance Solution 5 5

6 Vaau Introduction Vaau is a software development and systems integration firm that was formed in 2001 Thought leader in the areas of role engineering, role management and identity compliance Vaau currently employees 90 professionals and is headquartered in Los Angeles, CA RBACx is Vaau s Flagship Solution Vaau is a premier Sun software and services partner 6 6

7 Market Needs Determine who has access to what if people have the right access for their job Demonstrate compliance to auditors RBAC Model Recertification of Entitlements Efficient User Access Process Assign access based on business roles Simplified process for creating and managing roles Clean up orphaned accounts, legacy system accounts and access outside roles Audit critical access rights on existing systems 7 7

8 Certification and Role Engineering Traditional Methods Traditional methods of role engineering have been very time consuming and ineffective! 8 8

9 RBACx Functionalities Identity Warehouse User & Entitlement Information Detailed hierarchical attributes Identity Compliance Entitlement & Role Certification Audit & SoD violation monitoring Role Engineering Role & Rule Mining Hybrid (top down & bottom up) Role Management Certification & Workflow Temporary Role Assignment 9 9

10 Vaau Methodology Identity Warehouse Identity Manager Employee / Contractor Info Identity Certification Identity Audit Role Engineering Role Management Role Tuning Granular Entitlement Certification SoD Analysis Hybrid approach Role Certifications Tune roles based on usage Data Cleanup Compliance Direct Management Involvement R B A C x Preventative Controls Role Discovery / Mining Role Approvals Detective controls Entitlement Discovery Temporary Roles Rule Discovery Temporary Assignment Continuous Monitoring Risk Matrices Tune roles for re-orgs Role vs. Actual 10 10

11 Identity Warehouse Support for hierarchical organizational units-organizational structure, reporting structure or functional units Application Metadata Definition Simplified user and entitlements import process Import from csv, xml, txt and other format files Import directly from some ldap & odbc sources Import from Identity Management Systems Import using RBACx ETL processor Flexible User Entitlements Correlation Engine Import existing roles & policies from applications Support for any platform/database/application Support for hierarchical attributes Groups Files and Folders Read/Write/Modify Access 11 11

12 Organization Hierarchy 12 12

13 User-Manager Relationship 13 13

14 Cross-platform Support 14 14

15 End User Accounts 15 15

16 Sample Report User Entitlements 16 16

17 Identity Warehouse Benefits Ability to answer the questions Detailed repository that contains Organizational Hierarchy User and User Account Associations Deep User Entitlement Information Detailed Reporting Who has access to what? Do people have the right access for their job? Entitlements by Namespace Entitlements by User Users by Business Unit (Organization) Ability to import entitlements from any platform/database/application 17 17

18 Identity Compliance User Entitlement Certifications Certify High Privileged Entitlements Managers certify users, user entitlements, entitlements outside what was assigned Data Owners certify users access to data components Workflow process for approvals on assignment/removal Reports on approvals/revoke requests Maintains historical information on users access to various applications SoD violation scans User access audit policies creation and monitoring Regular scans Actual vs. Assigned Exceptions Exception Lifecycle Management Compliance Dashboard for Executives/Auditors 18 18

19 Identity Certification - Attestation 19 19

20 Identity Certification Entitlement Review 20 20

21 Identity Certification - Signoff 21 21

22 Identity Certification - Dashboard 22 22

23 Identity Compliance SoD Policies 23 23

24 Identity Compliance SoD Rules 24 24

25 Identity Compliance Violation Monitoring 25 25

26 Identity Audit - Dashboard 26 26

27 Identity Compliance Benefits Demonstrate compliance to auditors Time-Based Certifications Granular Entitlements Certify Contractors on Unique Schedules Monitor/Track Segregation of Duty (SoD) Violations RBAC Model Recertification of Entitlements Detective Scanning Inter & Intra-Application SoD Enforcement Terminated users with active accounts exceptions Enterprise level compliance dashboard 27 27

28 Questions? Contact Information: Joe Towne (650) cell

29 Role Engineering Multiple Hierarchies Role Discovery Ability to define multiple business hierarchies Support for Top Down and Bottom Up Role Engineering Ability to mine roles on user entitlements in any platform / database or application Ability to define roles based on representative / template user Role Design Support for hierarchical roles Support for multiple role hierarchies Support for enterprise and auxiliary roles Support for Role level Segregation of Duty definition Support for Roles for Identity Management, Access Management, Federation, Asset Management, etc 29 29

30 Role Engineering Cont. Role Entitlement Discovery Mine / discover entitlements for a role based on the users that have access to the role Entitlements can be discovered for roles defined by RBACx, defined by some other solution or defined manually Discover entitlements for any platform / databases or application Create child roles to manage exceptions Send s to administrators to remove unwanted entitlements from users based on the analysis Extend the existing role structure to encompass new applications Rule Engineering Mine for Rules to assign to roles Discover correlations between user s HR attributes and their roles Define rules manually Configure existing roles behavior (future expiry) when new roles are assigned to users Create child roles to manage exceptions Send s to administrators to remove unwanted entitlements from users based on the analysis Extend the existing role structure to encompass new applications 30 30

31 Role Management Role Certification Role Approval Approval on Role Entitlement updates Role impact analysis Role security policy violation analysis Roles Expiration Certification of Role Membership (Role Users) Certification of Role Entitlements Certification by BU Managers and Role Owners Role vs. Actual certification Ability to create temporary roles Ability to assign roles to users on a temporary basis Ability to remove roles from users on a future date when new roles are added Role Segregation of Duty Definition (SoD) Role SoD support Preventative and Detective controls for roles 31 31

32 Role Management Cont. Role vs. Actual Analysis Delegated Management Detection of Role vs. Actual discrepancies Sign off on discrepancies by the compliance group Role vs. Actual certification Ability to update Role Entitlements by Role Owners Ability to update Role Membership by BU Managers Ability to delegate roles at any level Ability to delegate Role to HR attribute (Job Code, Location etc) mapping Roles Tuning Tune roles based on user usage Tune roles based on user access 32 32