OIC LLC is our Oracle Partner name. It stands for Oracle Independent Consultants (OIC) LLC.

Transcription

1 OIC FAQ This document contains some of our Frequently Asked Questions (FAQ). We also include links to Oracle resources, which may require you to log in Oracle Partner Network (OPN). All OIC Contractors have access to our OPN Account. We grouped (classified) our Frequently Asked Questions (FAQ) into the following groups: General Questions Enterprise Role Management (ERM) o ERM Benefits o ERM Functional Aspects o ERM Features and Benefits o ERM Roles o ERM Role Types o ERM Types of Users o ERM Static Business Role Identity Management (IdM) o IdM Benefits o IdM Functional Aspects o IdM Features and Benefits Oracle Enterprise Security and Best Practices Mapping Requirements to Oracle Solutions Integration Library General Questions What is OIC? OIC LLC is our Oracle Partner name. It stands for Oracle Independent Consultants (OIC) LLC. What Services does OIC Provide? OIC provides our contractors with Oracle Enterprise Security and Governance, Risk and Compliance (GRC) Professional Development services. Similarly, we use our contractors to provide our customers with Oracle Enterprise Security and GRC resources and services. Effective August 2009 Page 1 of 17 Rev 1

2 Is an OIC Contractor a Permanent Employee? OIC Contractors are not permanent employees of OIC. Our contractors free to work anywhere and for anyone; however, we do have an incentive to place our OIC Contractors on our projects as an independent contractor. What is OIC Oracle Professional Development Program We leverage our Oracle Partner Network (OPN) training resources such as Oracle Guided Learning Paths (GLPs) and Oracle By Example (OBE) Step by Step Instructions to develop an Oracle Professional Development Program, which is designed specifically to help you achieve your training objectives. Do I have to pay for the courses included in a GLP or OBE? Oracle Guided Learning Paths Many of the courses included in an Oracle Guided Learning Path are FREE online self-paced courses. If Oracle recommendations an instructor led course that can cost $2,000 to $3,000, we find and substitute the equivalent FREE Oracle online selfpaced courses. There will be times when we are unable to find the FREE equivalent or Oracle will require that you attend an instructor led course. However, we design your Oracle Professional Development Program using a GLP that contains all FREE Oracle online self-paced courses. What are the characteristics of a Team Member? A Team Member is a highly Talented Oracle Professional. He or she has very good or excellent oral and written communication skills. Similarly, they have extensive business and "hands on" Oracle Enterprise Security and GRC experienced. Moreover, they have advanced degrees, OPN Credentials such as OCP and/or OPN Champion. They also earned other professional credentials such as CPA, CISA, CISM, CITP and CISSP. They understand internal control frameworks such as COSO and CobiT. They configure technology products and applications using Oracle and Industry best practices. Our Team Members are also committed to our core values. As a company, and as individuals, we value quality, integrity, honesty, continual self-improvement, and mutual respect. We are committed to our consultants, customers and partners and have a passion for Oracle technology and applications, excellence and support. Finally, a Team Member is an Oracle Enterprise Security and GRC Professional that I (i.e. Roger Drolet, Founder and President, OIC) would personally recommend to a client. Effective August 2009 Page 2 of 17 Rev 1

3 Why become a Team Member? Our goal is to become the go to Oracle Enterprise Security and GRC Consulting firm for companies that need Oracle Enterprise Security and/or GRC resources and services. We need highly Talented Oracle Professionals to achieve these goals. We will only place our members on projects. We aggressively promote, market and sell the services of our Team members. Roger Drolet, Founder and President, of OIC personally recommends our Team members to Oracle Consulting, Oracle Partners, and Oracle customers that need these resources. Moreover, he writes you a recommendation that you can post on your personal profile on LinkedIn.Com. We also feature you on our website. Similarly, we send our recommendation to hundreds of recruiters and hiring managers. When you apply for a position, we ensure that you prepare a cover letter that summarizes the experience provided on your resume that satisfies the specific requirements for that position. OIC also has direct contact with recruiters and hiring managers and we highly recommend your services. Moreover, we provide the recruiter or hiring manager with the information that he or she needs to effectively sell your services to the end user. Who are your customers? We have two major categories or classes of customers. We have customers who purchase our services. We also have customers (i.e. our contractors) who provide those services. Which Oracle Technology Products and Services are included in Oracle Enterprise Security and GRC? Oracle Security Solutions Governance, Risk & Compliance Solutions Why focus on Oracle Enterprise Security and GRC? "Governance, risk and compliance spending will reach US$29.9 billion in 2007, an increase of 8.5 percent over In 2008, this number will increase an additional 3.6 percent to US$31 billion." -Source: AMR Research, John Hagerty and Eric Klein, "Market Demand for GRC " - February, 2007 In the aftermath of continued failures of corporate control, standards bodies are developing and governments are imposing strict governance, risk and compliance (GRC) requirements that cover Effective August 2009 Page 3 of 17 Rev 1

4 data security, financial reporting, records retention, business processes and product liability. To satisfy customer demand for solutions that enable and ensure enterprise security and sustainable regulatory compliance, risk management and corporate governance, Oracle is creating a complete ecosystem of partners with solutions and services that complement Oracle's enterprise security and GRC offerings to meet customer needs. Learn More Where can I find Oracle Guided Learning Paths? Oracle Guide Learning Paths What is an Oracle Champion? The OPN Champion Certificate is proof of partner accreditation as an Oracle Champion, specializing in the ORACLE product. In order to access this certificate the partner must have a score of 80% or greater on the assessment. Effective August 2009 Page 4 of 17 Rev 1

5 Enterprise Role Management ERM Benefits What is the Security Benefit of Enterprise Role Management? This benefit of enterprise role management improves the accuracy of provisioning resources to users and organizations based on role memberships and policies. What is the Accuracy Benefit of Enterprise Role Management? With this benefit of enterprise role management, companies can implement a role management solution accurately. In addition, tools for role mining provide a jump start for role management deployments. What is the Cost Containment Benefit of Enterprise Role Management? With this benefit of enterprise role management, companies can provision their resources to users based on role memberships. This also improves IT productivity. What is the Authorization Benefit of Enterprise Role Management? Authorization enables companies to have a single, authoritative source for creating roles and policies, determine access rights, entitlements, and privileges users have with their companies' resources. What is the Responsiveness Benefit of Enterprise Role Management? With this benefit of enterprise role management, companies can update memberships to roles quickly, based on changes to users, organizations, and resources. ERM Functional Aspects What are the Functional Aspects of Enterprise Role Management? These functional aspects include role mining, a polyarchy-enabled role engine, an authoritative role and entitlement repository, a role and relationship model, and role delegation. Effective August 2009 Page 5 of 17 Rev 1

6 What are the Functional Aspects of Role Mining? With this functionality of enterprise role management, a company can: Take existing data about users and privileges Analyze and cleanse the data Look for candidates in the data to suggest role hierarchies What are the Functional Aspects of the Polyarchy-Enabled Role Engine? This functionality of enterprise role management enables a company to traverse relationships between users and organizations (or polyarchies) to derive accurate, real-time role memberships. What are the Functional Aspects of the Authoritative Role and Entitlement Repository? This functionality of enterprise role management helps to aggregate and manage a company s contextual relationship) into a comprehensive role repository. Serving as the central source of information for roles, these complex relationships supply authoritative entitlement data to Oracle Identity Manager. What are the Functional Aspects of the Role and Relationship Model? With this functionality of enterprise role management, a company can create and implement a configurable and extensible role and relationship model. As a result, this model is flexible enough to reflect a company s unique business structures and relationships. What are the Functional Aspects of Role Delegation? This functionality of enterprise role management enables a company to delegate administration of its roles. As a result, administrators can delegate access rights, entitlement, and privileges users have with the company s resources without violating existing business policies. ERM Features and Benefits What are the Features and Benefits of Oracle Role Manager? Features and benefits include: role and rule mining (importing existing data about users, resources, and entitlements to discover candidate roles and membership policies), a polyarchyenabled role engine (traversing relationships between users and organizations to derive accurate, Effective August 2009 Page 6 of 17 Rev 1

7 real-time role memberships), an authoritative role and entitlement repository (supplying trusted entitlement data to enterprise systems), a configurable and extensible role and relations model (modeling enterprise structures and relationship, and providing tools for customizing the user interface), and role delegation (delegating user access and privileges without violating existing business policies). ERM Roles What are some examples of Roles? Examples of roles are approver, business, IT, and system roles. What is an Approver Role? An approver is a user who authorizes a workflow request or single step within a multiple-step workflow request in Oracle Role Manager. An approver role is a collection of approvers. That is, an approver role is a container that holds approvers. Approval roles are defined using approver rules. Approver rules are used to determine who is to receive the company s approver roles. What is a Business Role? A business role is a collection of business duties or responsibilities to be granted to users in an organization. Business roles are defined using membership rules. Membership rules are used to determine who is to receive the company s business roles. For example, a system administrator can create a business role for the partners of Oracle Corporation. Then the system administrator can create a membership rules that gives all Oracle Role Manager user with a job title of Manager access rights to the associated business role. When this rule is run, Oracle Role Manager retrieves these users from its database. What is an IT Role? An IT Role is a collection of rights that must be mapped to business roles to grant users a set of privileges. Any privilege for an external application that associates itself with an IT resource is an IT Privilege. For example, a system administrator can map an IT role for restarting server applications to the business role for the managers of Oracle Corporation. As a result, before the managers can receive access rights to the company s server applications, these applications must be restarted. Effective August 2009 Page 7 of 17 Rev 1

8 What is a System Role? A system role is a collection of privileges related to the installation of Oracle Role Manager. This role also defines the type of access a user has with Oracle Role Manager. These access rights are system privileges. An example of a system role is the collection of privileges assigned to the Oracle Role Manager system administrator. ERM Role Types What are the Types of Roles? There are dynamic roles and static roles. What is a Dynamic Role? A dynamic role depends on criteria, known as a membership rule, to determine which users should have access rights to the role. For example, a business user can create a membership rule to grant the role, Senior Accountant, to all users in the Accounting reporting hierarchy with a job title of Manager. All users who meet the condition of the membership rule are automatically added to the Senior Accountant role. What is a Static Role? Static roles determine role membership through manual role grants. Unlike dynamic roles that use membership rules, static roles must be granted manually to one user at a time. They do not depend on rules that define who should have access to a particular role. For example, consider the static roles of Accounting Clerk. If John, an Accounting Manager, decides to grant this role to team member David, John must manually grant this role to David. Similarly, when David moves to a different team or role, John must manually revoke this role from David. Effective August 2009 Page 8 of 17 Rev 1

9 ERM Types of Users What are the Types of Users Associated with Oracle Role Manager? There are four types of users associated with Oracle Role Manager: Approvers are responsible for authorizing entire workflow requests or individual steps within a multiple-step workflow request. Business users handle business-related activity in an organization. Examples of these users are manager and team leaders. IT administrators handle information technology (IT)-related activity in an organization. System Administrator has read-access and write-access rights to all records in Oracle Role Manager. They control permissions of other users, administer Oracle Role Manager from the highest level, and ensure the application is operable. ERM Static Business Role What is a sphere of control? A sphere of control is a way to limit the granting of a static role to a user, based on the user s organization (for example, the user s cost center, location, or parent organization). As a result, the user has access to the role as long as the user is a member of the organization. When the user leaves the organization, access rights to the role are removed. What is the significance of checking the box for the field called Can Be Delegated? By delegating the static role, it enables the system administrator to grant the role manually to one user at a time. This differs from a sphere of control, which limits the granting of a static role to a user, based on the user s organization. Effective August 2009 Page 9 of 17 Rev 1

10 Oracle Identity Management What is Identity Management? Identity Management is a collection of processes and strategies a company uses to manage the complete security life cycle of resources for its internal and external users and organizations. These resources can include Web access control applications, database servers, operating systems, legacy systems and directory services. Why is an Identity Management Life Cycle Solution Important? As a company grows, so does the number of organizations and users it has, as well as resources associated with these users and organizations, Therefore, an identity management solution is necessary for a company so that it can: Manage its user and organizational base Handle the creation, modification, and deletion of resource-related accounts for these users and organizations. Regulate access rights users and organizations have with their accounts (for audit and compliance purposes). This occurs through attestation, a process of authorizing established internal controls, processes, and policies for use and organization related data. Enforce security policies for these accounts. Why is Identity Management Attestation Important? Attestation also provides an audit trail of people who sign off on data or processes that exist in a company's environment, particularly: Users and organizations that have access to resources (the "who") The reason these users and organizations can access their resources (the "why") The date and time these users and organizations can access their resources (the "when") IdM Benefits What are the Benefits of Identity Management? Effective August 2009 Page 10 of 17 Rev 1

11 These benefits include business agility, compliance, cost containment, improving the end user's experience, and security What is the Business Agility Benefit of Identity Management? This benefit of identity management enables companies to deploy new applications quickly and easily, and connect partners, supplies, customers, and teams to leverage these relationships. What is the Compliance Benefit of Identity Management? This benefit of identity management enables companies to define and enforce security policies more easily, and document the enforcement of these policies for audit, regulatory, and compliance purposes. What is the Cost Containment Benefit of Identity Management? With this benefit of identity management, companies can operate more efficiently and reduce administrative overhead. What is the End-User Benefit of Identity Management? This benefit of identity management uses features, such as single sign-on (SSO), policy-based access control, and automation of login functionality and password modification, to allow internal and external users to transition seamlessly between related applications and improve productivity. What is the Security Benefit of Identity Management? This benefit of identity management helps reduce the risks of unauthorized access to data and resources by providing the framework and tools to better manage user and organizational populations and access rights associated with these users and organizations. IdM Functional Aspects What are the Functional Aspects of Identify Management? These functional aspects include directory services, reconciliation, provisioning, identity administration, access management, federation, and Web services security. Effective August 2009 Page 11 of 17 Rev 1

12 What are the Functional Aspects of Directory Services? This functionality of identity management provides efficient storage, lookup, synchronization, and replication of identity management data between different directories. What are the Functional Aspects of Reconciliation? This functionality of identity management enables a company to transfer its user and organizational related data from multiple data directories into a single identity management repository. As a result, there is one centralized location through which this repository can learn about any activity occurring in the users and organizations recourse-related accounts. What are the Functional Aspects of Provisioning? This functionality of identity management helps to automate the creation, modification, and deletion of resource-related accounts for users and organizations. Provisioning products are often used to create and execute workflows that manage the life cycle of users and organizations. They can also be used to document processes and rights for audit, regulatory, and compliance purposes. What are the Functional Aspects of Identity Administration? This functionality of identity management enables the management of user and organizational identities and their associated attributes. What are the Functional Aspects of Access Management? This functionality of identity management facilitates the authentication of resource-related accounts for users and organizations, and authorizes the ability of these users and organizations to access their accounts. What are the Functional Aspects of Federation? This functionality of identity management extends identity management beyond a company s boundaries to permit authenticated access to resources by entities of independently managed external domains. What are the Functional Aspects of Web Services Security? This functionality of identity management controls access to and between Web services, based on an organization s security policies. Effective August 2009 Page 12 of 17 Rev 1

13 IdM Features and Benefits What are the Features and Benefits of Oracle Identity Manager? Features and benefits include identity and role administrator (user and group management, selfservice functionalities for users, and delegated administration), provisioning (approval and request management and configurable workflow models), policy-based entitlement, reconciliation, and attestation support (for audit, regulator and compliance purposes). Effective August 2009 Page 13 of 17 Rev 1

14 Oracle Enterprise Security and GRC Best Practices What are Authentication and IdM Best Practices? Define a consistent grade of identity assurance o Assurance and risk levels should correlate o Balance security, convenience, privacy and compliance Monitor transactions without impacting the application o Shorten deployment cycles o Allow for more agility and flexibility Adopt common access management infrastructure o Consistent enforcement of security policies o Leverage existing investment in authentication and SSO Leverage Identity Federation to establish trust o Reduce proliferation and exposure of credentials Strong Authentication and Identity Management: Hand-in-Glove Enterprise Security - Best Practices Recommendations Effective August 2009 Page 14 of 17 Rev 1

15 Mapping Requirements to Oracle Solutions What are the Authentication Requirements? Requirements Credential hardening Multi-factor authentication Graded authentication Anti-Phishing Applications Oracle Access Manage Oracle Identity Federation Oracle esso Suite What are the Authorization Requirements? Requirements Session Management In-session risk monitoring Role-based access control Applications Oracle Access Manage Effective August 2009 Page 15 of 17 Rev 1

16 What are the Auditing Requirements? Requirements Auditing and reporting Forensic analysis Attestation Applications Oracle Access Manage Oracle Identity Manager What are the Identity Administration Requirements? Requirements Registration Identity proofing Credential lifecycle management Applications Oracle Identity Manager Effective August 2009 Page 16 of 17 Rev 1

17 Integration Library Integration Library What is the Integration Library? The Integration Library is a container that holds the files used to integrate Oracle Role Manager and Oracle Identity Manager. What are the Features of the Integration Library? The Integration Library provides the following features: Creating Users This feature of the Integration Library enables the dynamic creation of a user account in Oracle Role Manager for every account in Oracle Identity Manager. Updating Users With this feature of the Integration Library, modification to user accounts in Oracle Identity Manager are reflected in Oracle Role Manager. Creating User Groups This feature of the Integration Library enables user groups to be created in Oracle Identity Manager for all Business and IT roles in Oracle Roles Manager. Updating User Groups With this feature of the Integration Library, status changes to roles in Oracle Role Manager that affect user groups in Oracle Identity Manager are reflected in Oracle Identity Manager. Querying for Approval Roles This feature of the Integration Library enables Oracle Identity Manager to query for Approver roles in Oracle Role Manager dynamically. By doing so, Oracle Identity Manager can find qualified approvers to use in approval processes. Effective August 2009 Page 17 of 17 Rev 1