Interagency Advisory Board Meeting Agenda, May 27, 2010

Transcription

1 Interagency Advisory Board Meeting Agenda, May 27, Opening Remarks 2. PIV-I Status (Judy Spencer, GSA) 3. PIV Test Requirements (Dave Temoshok, GSA) 4. ICAM Progress at USDA (Owen Unangst, USDA) 5. PIV-I Discussion Panel (Jim Hatcher, Mike Mestrovich, Chris Louden, Rebecca Nielson) 6. FIWG Status Update (Corinne Irwin, NASA) 7. LAWG Status Update (Bill Erwin, GSA) 8. Closing Remarks

2 USDA Identity, Credential and Access Management What We re Doing; Where We re Going June, 2010 Simplifying Business Delivery Improving Our Security Posture Enabling Trust & Privacy Reducing Costs & Increasing Efficiency

3 Defining Ownership Identify & Implement the Technical Architecture Supplemental Two Factor HSPD DM epacs OCIO ITS AD WCTS AD AgLearn Course Status Completion Goal: March, 2011 FSA Application? NFC? NITC? HR Systems Person Model EIDS Enterprise Financial Application? 44 Active Directories FSA Application FS Adam eauthdb XeGov AD? AgLearn RISO Pilot Readiness Rollout

4 Defining Ownership Improve the Access Control Processes Applications Enterprise aplications Agency applications... Role Management Entitlement Provisioning Access Management Systems Mainframes Servers Workstations Blackberry devices... Access Enforcement Authorization Authentication Facilities Access Administration Facilities Buildings Rooms Quarantine Areas... Compliance, Auditing and Reporting 22

5 Defining Ownership Don t Quit Until You Really Improve Something User Joe Carl Joe Alice Tom Betty HR System Manual Process: - Over 200 persons to manage roles - 73 to handle audit issues Enterprise Entitlement Management System Organization Position/Role USDA Emp FSA Emp County Director FSA Supervisor Application Roles (Examples) AgLearn User AD User PACS User WebTA User EmpowHR Emp DCP Approver CRP Approver AgLearn S visor WebTA S visor EmPowHR S visor Application Function (Examples) AgLearn Create LP Approve LP Take Courses AD Domain Acct epacs Access to xyz WebTA Create T&A Create Leave Approve T&A Approve Leave EmPowHR Create Perf Plan Approve P-Plan DCP Approve App CRP Approve App One More Thought: If Joe changes position, what happens? If Joe retires, what happens? 23

6 Back Room Critical Success Factors Recognize Organizational Maturity/Culture & Plan For It Page 1 of 2 v1 Projects will touch virtually every individual and user in the organization Get a Sponsor who is an allowance holder and has access to no less than the Deputy Secretary Charter an Executive Steering Team with: IT Sr. Execs. Cyber Security, Data Center Ops, SOC Other Sr. Execs. Finance, HR, Audit Compliance, Corporate Risk Management, Physical Security, Personnel Security Find a World-Class Team with Creative but Realistic People Communicate Use Carrots, but when necessary, a Stick Recognize organizational change concepts 24

7 Back Room Critical Success Factors Recognize Organizational Maturity/Culture & Plan For It Page 2 of 2 v1 Don t automate broken/cumbersome processes Understand organizational readiness before introducing changes Introduce services early that add most value to processes with minimal change (low hanging fruit, quick wins) Understand and Utilize PMBOK s Knowledge Areas 25

8 A General Description of the Technologies FS/DOI Federation 9/10 NFC Elevated Privilege 1/11 FS Elevated Privilege 1/11 AgLearn 9/1 FSA App Radiant Logic ICS Done Role and Compliance Manager (RCM) Access Control 9/1 9/1 Enterprise Single Sign On (ESSO) FY11 9/1 F.S. App 9/1 Identity Manager (IdM) Done eauth 9/1 Done Enterprise Directory (edir) Done 7/1 EEMS AC/NAC Done Agency AD s 3/11 SOA Security Manager FY12 eauth (Site Minder) FY11 Federation Manager FY11 eauth Future Apps

9 Identity Manager (IdM) IdM is the core product of EEMS Administrative interfaces Provisioning and deprovisioning of identities and entitlements Rule-based policy management Role-based access control Monitoring and reporting capabilities

10 Radiant Logic Identity Correlation and Synchronization Server (ICS) Provides bidirectional data synchronization and abstracted directory virtualization services Greatly simplify the management of identity across disparate data stores. Detects changes in data sources and transforms and propagates them to consuming systems

11 Role & Compliance Manager (RCM) Provides support to quickly and accurately develop, maintain, and analyze role models Manage centralized compliance policies Uses advanced pattern recognition analysis to prevent improper privilege escalation and separation of duties (SOD) policy violations Also used to map roles and entitlements in existing data stores during IdM integration

12 Enterprise Directory Provides a comprehensive view of predefined authoritative data managed by IdM for all users across the USDA enterprise Allows enterprise-class applications to leverage the Enterprise Directory for authentication and authorization services Bypasses reliance upon 75+ non-trusted Active Directory forests for authentication and authorization

13 Access Control Provides host access control and privileged user management Manage heterogeneous servers, applications, and devices through a single pane of glass using a PIV Card Privileged User Password Management (PUPM) One-time password (OTP) scheme (integrated with PIV) for privileged accounts Also allows agencies to eliminate hard-coded passwords from code and scripts

14 Enterprise Single Sign-On (ESSO) Allows agencies to integrate difficult legacy applications AS/400 Mainframe Custom built and legacy programs Provides central administration of application access privileges, audit capabilities, and strong authentication Improves user convenience and reduced helpdesk support Leverages a client-side utility that proxy s username/password synchronization with the target application

15 Federation Manager A bolt-on service to the existing USDA eauthentication service Supports SAML assertions Allows eauth to perform Identity Provider (IdP) services for USDA users to external agency services Accept assertions from external IdPs for access to eauthprotected services USDA applications and eauthentication are freed from the cost and effort of identity-proofing and credential issuance and management for non-usda users

16 SOA Security Manager (SOA-SM) Delivers comprehensive standards-based SOA/WS security platform Enables identity-centric Web Services security including authentication and fine-grained authorization based on the requestor s identity (person or application) Provides XML security and centrally managed security policy administration and enforcement Supports identity and context-aware security services Tightly integrated with Directory, Federation Manager, Site Minder, and Identity Manager

17 Questions? 35