BYOD ESSENTIALS FOR IT PROS SANDER BERKOUWER, DirTeam

Sander Berkouwer Microsoft MVP Directory Services Microsoft Virtual Technical Evangelist Blogger on DirTeam.com ServerCore.Net 4SysOps.com About

Introducing Bring Your Own (BYO) Challenges with Bring-Your-Own Solutions Web-ready authentication Rich authorization Straight-forward access Policy-based systems management Agenda

INTRODUCING BYO

51% of employees between years chooses to deliberately ignote corporate policies, applying to corporate use of privetly-owned devices, cloud storage and wearables Reality % 51% Source: Fortinet, October 22, 2013Fortinet

Bring Your Own Devices Apps InformationEmployees Devices Apps Employees Management| Access| Security Information

Bring Your Own facilitates access to organizational IT sources with devices owned by employees and other entities Bring Your Own

Bring Your Own and your existing infrastructure BYO Applications Data Corporate Non-corporate

WEB-READY AUTHENTICATION

Current protocols lack flexibility Kerberos tickets are encrypted, cannot be split Kerberos tickets only contain SIDs Active Directory trusts lack scalability After ~1200 trusts, authentication becomes terribly slow Multi-factor authentication Username, password combination is not good enough Challenges with authentication

Web-ready authentication Transport over SSL channel Optional encryption Open standards Flexible trusts Scalable loosely-coupled granular trust relationships Multi-factor authentication We need…

ACTIVE DIRECTORY FEDERATION SERVICES SOLUTION

Web-ready authentication SAML, Oauth2 are HTTPS-based and work with claims Device-agnostic authentication Relying Party trusts Fine-grained definitions, little information shared Multi-factor Authentication AD FS Authentication is extensible for 3rd parties Active Directory Federation Services

Authentication with AD FS On Premises Active Directory Domain Services Colleague Azure AD Integrated Application 7 2

Claims vs. Tokens EncryptionTransportContentsLimitsSecurity Claims in SAML Optional HTTP (TCP80) HTTPS (TCP443) Kerberos (TCP88) XML-based MaxTokenSize Ticket Lifetime, Mutual Auth, PAC Validation Claims in Kerberos Kerberos (TCP88) Authorization dataMaxTokenSize Ticket Lifetime, Mutual Auth, PAC Validation Tokens Signing, Replay Protection

AZURE ACTIVE DIRECTORY SOLUTION

Modern identity management Free REST-based web service for authentication Cloud identity management Identity and access for Azure, Office 365, etc. 100% interoperability Based on open standards, like SAML Full support for 3rd party identity providers Introducing Azure Active Directory

Authentication with Azure AD On Premises Active Directory Domain Services Colleague Directory Synchronization Tool Azure AD Integrated Application

DEMO CLAIMS AND CLAIMTYPES

AZURE MULTI-FACTOR AUTHENTICATION SOLUTION

Something someone can prove he/she knows Passwords Something someone can prove he/she is Biometric security like fingerprints, iris scans Something someone can prove he/she has Smart cards, phones Something someone does regularly Authentication factors

Smart card hardware Smart card readers never became a commodity Smart card require PKI Certificates are commonly experienced as very hard User friendliness Is a smart card actually convenient in BYOD scenarios? There are new alternatives to smart cards Challenges with auth factors

Extensible Authentication Model API in AD FS for 3rd party authentication extensions Default support for certificates on smart cards Azure Multi-Factor Authentication Recently acquired PhoneFactor technology Phone Call, Text message, App or OATH Multi-factor Auth with AD FS

DEMO CONFIGURING AZURE MFA WITH AD FS

Azure Multi-Factor Authentication On Premises Active Directory Domain Services

RICH AUTHORIZATION

Group memberships are too strict Based on a single attribute and uncontrollable fast Only AND rules allowed Token Bloat Cross-organizational access Organizations need Active Directory trust Trusts leak information both ways Challenges with authorization

Rich authorization Claims can be based on group membership, or on Any property of the user account Or occurrence of the user in the Global Addresslist (GAL) Or the location of the device used … or combinations of the above… … or external claims… Rich authorization scenarios

Claims in SAML, Oauth2 Active Directory Federation Services Available since Windows Server 2003 R2 Claims in Kerberos Dynamic Access Control Available since Windows Server 2012 * Claims in tokens and tickets

WORKPLACE JOIN SOLUTION

Single Sign-On on the intranet AD FS offers automatic Kerberos-to-claims transformation Identity 1.0 -> Identity 2.0 Single Sign-On the extranet Single Sign-On per browser session There is no Identity 1.0 on the extranet (we hope) Single Sign-On using WorkPlace Join Single Sign-on beyond the browser

Claims Employees verify devices for their account Certificates and cookies Certificate from MS-Organization-Access Cookies in the browser msDS-Devices in Active Directory Domain Services Automatically removed after 90 days of inactivity WorkPlace Join – Under the hood

DEMO WORKPLACE JOIN WITH MULTI-FACTOR AUTHENTICATION

STRAIGHT-FORWARD ACCESS

Server Message Block (SMB) Discloses Windows-based file servers Not optimized for the web Remote Procedure Call (RPC) Discloses remote Windows functionality Designed when there was no web… Challenges with accessing data

WORK FOLDERS SOLUTION

Work Folders positioning Personal data Individual business data Team and Project data Personal devices Storage back-end Onedrive SharePoint on-prem/online Onedrive for Business File Server Work Folders Public Cloud

HTTP-based file synchronization DNS Records (workfolders.domain.tld) for AutoDiscovery Windows Authentication or AD FS (OAuth2) Default device policies Password policy and device lock Customizable using Mobile Device Management (MDM) Encryption of data on device and remote functional wipe Work Folders internals

POLICY-BASED DEVICE MANAGEMENT

Systems management for multiple platforms Group Policies are Windows-only * Windows-based machines can be managed centrally Managing iPads, Android devices, Windows RT? Applications for multiple platforms Different platforms, different ecosystems, different apps Not all devices are connected to the network Challenges with systems management

INTUNE SOLUTION

Systems management with Intune On Premises Active Directory Domain Services

CONCLUDING

To facilitate access to organizational IT sources with devices owned by employees and other entities, you’ll need: Web-ready authentication Rich authorization Straight-forward access Policy-based systems management Concluding

Nagrađujemo vas sa 100 WinCoin bodova što ste posjetili predavanje. Osvojite dodatnih 100 WinCoin bodova ukoliko popunite službeni upitnik. HVALA!

MVA Successful proffessionals never stop learning. Microsoft Virtual Academy offers online Microsoft trainings led by experts to help proffessionals to upgrade their knowledge. Trainings are prepared by leading eyperts from different technology areas. After you take a training, you can test your knowledge. To better understand this session, I advise you to take following trainings: XXX1 XXX2 XXX3 Training name 1 link1 Training name 2 link1 Training name 3 link1