Webinar: "Entitlements: Taking Control of the Big Data Gold Rush"
•Als PPTX, PDF herunterladen•
3 gefällt mir•954 views
Information is the new currency and as more “things” come online the volume of data will dramatically increase. Typically, this data is stored in multiple repositories and different personas have different levels of access. In this webinar, which was recorded on August 18th, 2015, you can learn how to answer key questions to today’s tough challenges: How do we keep sensitive data, secure it and make it accessible? How do we manage authorization policies related to this data? How do we manage entitlements for not only web apps, but also users, devices and things? ForgeRock’s Senior Software Developer, Andy Forrest, discussed the challenges and solutions surrounding Entitlements.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Ähnlich wie Webinar: "Entitlements: Taking Control of the Big Data Gold Rush"
Ähnlich wie Webinar: "Entitlements: Taking Control of the Big Data Gold Rush" (20)
Mehr von ForgeRock
Mehr von ForgeRock (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Webinar: "Entitlements: Taking Control of the Big Data Gold Rush"
- 1. Copyright © 2015 ForgeRock, all rights reserved. Entitlements: Taking Control of the Big Data Gold Rush Markus Weber Andy Forrest August 18th, 2015
- 2. Copyright © 2015 ForgeRock, all rights reserved. Achieving the Holy Grail of Identity Knowing Who's Who, What's What, and Who Gets Access to What Source: Scott McNealy, Identity Summit 2015
- 3. Copyright © 2015 ForgeRock, all rights reserved. ForgeRock Fastest-growing Open Source Identity Security Software company in the world ■ Founded 2010 with high double digit growth every year since inception ■ Over 200 full time employees ■ Over 400 customers ■ Active in over 30 countries ■ Locations: San Francisco, Vancouver (US), Bristol (UK), London (UK), Grenoble (FR), Oslo, Singapor, Düsseldorf Award winning platform driving innovation worldwide ■ Gold winner of the CEO World awards 2014 ■ Silver Winner in the 6th Annual Golden Bridge Award 2014 ■ Silver winner for the Fastest-Growing Company of the Year in Best in Biz Awards 2014 Investors: Our Origins:
- 4. Copyright © 2015 ForgeRock, all rights reserved. 275 survey respondents Research by
- 5. Copyright © 2015 ForgeRock, all rights reserved. Research by 71% using ForgeRock for THEIR customer identities (USA) 88% deploy in less than a year 65% deploy in less than 6 months 70% reach payback in less than 18 months 91% rate ForgeRock speed to deployment superior to competition 96% rate ForgeRock scalability superior to competition 92% rate ForgeRock reliability superior to competition 100% of government and financial services customers rate ForgeRock scalability superior to the competition
- 6. Copyright © 2015 ForgeRock, all rights reserved. The Platform
- 7. Copyright © 2015 ForgeRock, all rights reserved. The ForgeRock Identity Platform (Identity Management) (Access Management) (Directory Services) (Identity Gateway)
- 8. Copyright © 2015 ForgeRock, all rights reserved.Copyright © Identity Summit 2015, all rights reserved. IDENTITY MANAGEMENT Provisioning Self-Service Password Management Synchronization/Reconciliation Workflow Engine SaaS Connectors ACCESS MANAGEMENT Authentication Entitlements Management Federation Social Sign-On Adaptive Risk REST Security Token Service API & MOBILE GATEWAY API Security Mobile Security Legacy Application Security Web Services Security Password Capture and Replay DIRECTORY SERVICES Performance & Scalability High Availability Password Policy Active Directory Synchronization Identity Data Replication LDAPv3 and REST2LDAP COMMONSERVICES RESTAPI Standards UserInterface The ForgeRock Identity Platform
- 9. Copyright © 2015 ForgeRock, all rights reserved. customldapv3 User Data Stores Authentication Coarse Grained Authorization Policies SSO Session Management Federation Hub Adaptive Risk ForgeRock UI Framework Password management Audit Logging UI Layer Access Layer Business Logic Layer Services Layer Persistence layer SIEM | Reporting Tools (3rd party) Authentication Systems (out-of-the-box & 3rd party) Analytics tools (3rd party) Fine Grained Authorization Pluggable Common REST OpenID Connect OAuth2 SAMLv2 WS-* Protected Resource s Web Application Mobile Application Policy AgentFirewall Reverse Proxy REST Client Stateful StatelessSession Layer Load balancer Chip | Thing End-User UI JATO based Admin UI Policy Editor Monitoring
- 10. Copyright © 2015 ForgeRock, all rights reserved. The Near Future
- 11. Copyright © 2015 ForgeRock, all rights reserved. Return on Identity Platform Focus for Maximizing ROI API Economy IoT Scale IoT Ready Privacy & Consent Security Data Enrichment Run Anywhere
- 12. Copyright © 2015 ForgeRock, all rights reserved. Privacy & Consent User Managed Access (UMA) • Standards based privacy and consent • Giving people the right to control access to their data across providers • Interoperable OAuth2-based protocol • Shipping as an integrated feature of OpenAM and OpenIG
- 13. Copyright © 2015 ForgeRock, all rights reserved. Internet of Things Scale Stateless Sessions • Built on new stateless sessions • JWT-based sessions • Per-Realm configuration • Enables true elastic deployment • Massive horizontal scalability ClusterSize Demand Internet Elastic Load Balancer
- 14. Copyright © 2015 ForgeRock, all rights reserved. Security Continuous Authorization OpenAM Session Contextual Change System Detects New Location System detects change during session and requests 1x password • Context based authentication and authorization • Includes the device print and request context in the policy evaluation • Custom logic easily integrated into Policy decisions with JavaScript, Groovy, or Java • REST-calls to external Policy Information Points
- 15. Copyright © 2015 ForgeRock, all rights reserved. Entitlements Taking Control of the Big Data Gold Rush Andy Forrest (@apforrest) andrew.forrest@forgerock.com
- 16. Copyright © 2015 ForgeRock, all rights reserved. “Information is the new currency”
- 17. Copyright © 2015 ForgeRock, all rights reserved. Let’s rewind a little... Subject Resource Action Environment • Authentication • Authorization
- 18. Copyright © 2015 ForgeRock, all rights reserved. What has a policy looked like? Typically used to protect a web resource: “Can Bob who is part of the admin group see the admin web page?”
- 19. Copyright © 2015 ForgeRock, all rights reserved. Policy solutions • ACLs (access control lists) - focused on the subject • RBAC (role based access control) - focused on the subject and resource - role explosion
- 20. Copyright © 2015 ForgeRock, all rights reserved. Policy characteristics • Coarse grained • Allow / deny • Inflexible • Low volume • Minimal performance demand
- 21. Copyright © 2015 ForgeRock, all rights reserved. PEP Common policy architecture Protected resource Bob PDP PAP PIPs
- 22. Copyright © 2015 ForgeRock, all rights reserved. Common policy architecture Policy agent Protected resource Bob OpenAM
- 23. Copyright © 2015 ForgeRock, all rights reserved. What’s next for policy? “Authorization is the new cool kid”
- 24. Copyright © 2015 ForgeRock, all rights reserved. IoT (Internet of Things) • Not just web pages • Richer relationships • Descriptive demand
- 25. Copyright © 2015 ForgeRock, all rights reserved. UMA (User Managed Access) • In the hands of the consumer • High scale • Decoupled • Distributed
- 26. Copyright © 2015 ForgeRock, all rights reserved. Some of the buzz • ABAC (attribute based access control) • XACML (extensible access control markup language)
- 27. Copyright © 2015 ForgeRock, all rights reserved. Future policy characteristics • Attribute based • Fine grained • Entitlements • Unknown entities • High volume • Performance speed • Outward facing
- 28. Copyright © 2015 ForgeRock, all rights reserved. What about OpenAM? “We’re the real deal”
- 29. Copyright © 2015 ForgeRock, all rights reserved. OpenAM policy • Complete REST API • Intuitive UI • Organisational structure • Expressive rules • Contextual authz • Rich entitlement decisions • Selective evaluation • Scaling and replication • XACML export/import
- 30. Copyright © 2015 ForgeRock, all rights reserved. Demo
- 31. Copyright © 2015 ForgeRock, all rights reserved. Mobile Twitter Raspberry PI OpenAM Device 1 Radio Tx Radio Rx Device 3 Radio Rx Device 2 Radio Rx Web App Policy Demo topology
- 32. Copyright © 2015 ForgeRock, all rights reserved. Demo topology
- 33. Copyright © 2015 ForgeRock, all rights reserved. DJ 2 OpenAM 2 DJ 1 OpenAM 1 Replication Cross talk 8 x 3.3GHz, 64GB 8 x 3.3GHz, 64GB Performance topology
- 34. Copyright © 2015 ForgeRock, all rights reserved.
- 35. Copyright © 2015 ForgeRock, all rights reserved. How does OpenAM continue to lead? • Continually looking to push performance • More fine grained through ABAC - generic attribute model - application rules - nested applications • Simplified UIs
- 36. Copyright © 2015 ForgeRock, all rights reserved. “Information is the new currency”
- 37. Copyright © 2015 ForgeRock, all rights reserved. IDENTITY SUMMIT SERIES 2015: EUROPE 8 October London 5 November Amsterdam 10 November Düsseldorf Visit summits.forgerock.com
- 38. Copyright © 2015 ForgeRock, all rights reserved. Q & A
Hinweis der Redaktion
- Founded four years ago, by five guys who had an idea They were working for sun microsystems – very innovative. Built java & solaris etc They had a big software & hardware biz, and a huge IAM biz, globally successful Late 2000s, acquired by Oracle Oracle already had IAM. Proprietary fusion apps Sun had commercial open source, telco-scale IAM Lots of Sun IAM ppl left to found ForgeRock to continue the commercial open source portfolio under a diff name Now read slide We’ve got a lot of the SunIAM guys employed with ForgeRock now We’ve got some of the best investors in the world backing us now. Accel series A: Facebook Foundation Capital: Netflix Series A Sun Co-Founder Scott McNealy is our marquee advisor and he grew Sun into a multi-billion dollar company
- Introduce myself What is big data?
- 4 points buzz word revenue, business privacy, consumer protect Big data is essentially information, our data, collected, collated and utilised to bring value Big data is only relevant if it gives value Collect it all as you never know where the value may come Two sides, consumer and privacy, business and revenue Data is worth something to consumers and businesses and therefore needs protecting Avalanche of data
- authentication - proving who you say you are authorisation - verifying what you’re allowed to carry out in a given context policy?
- ACLs white lists / black lists all in / all out one dimension, the subject RBAC not who you are but you you’re apart of two dimensions, the subject/group, the resource employ door, door_close, door_open
- Elaborate each point
- P*P architecture Needs a few more labels How does it map to AM?
- Why? authentication has been the focus welcome everyone, trust no one
- IoT forces us to consider other types other than just web resources We need to be able to express richer rules to define the relationships between subjects and devices IoT devices are better described with attributes
- UMA puts policy in the hands of the consumer Now we’re talking about high scale policy management
- This needs a little more thought ABAC is a follow on from RBAC, the next evolution
- Elaborate each point
- Sun
- Elaborate each point 12/13 diff REST not only lightweight, simple and interoperable API but also eliminates the agent
- Demo time Main point is to demonstrate the engine via the UI
- 200 policies 200 sessions 10,000,000 users 20 milliseconds, 1% of two seconds maybe needs deployment diagram acceptable average web page load time
- Elaborate each point
- Tie back to presentation brief. Information is the new currency, information can take the form of big data and AM is ready to protect it.