Unified Address Book Security Implications

Unified Address Book Overview –What are we talking about –What is the Risk –What are we doing to minimize the risk Details –How do the pieces connect –How are we securing the system Future

What are we talking about Creating and maintaining a unified address book Agency control of what information gets added to the unified address book Directions on how to point clients to the central address book

What are the Risks There will be an agent or lookup account needed on the source of addresses (Active Directory, eDirectory, etc.) with read access to the attributes needed. A path will have to be created between these sources and the central store in the GTA Datacenter through the firewalls and NATing schemes. On GroupWise and Notes mail systems, a driver needs to be loaded on the agency server.

What can we do to reduce the Risk Agent – The agents take up a small footprint and been installed in a large number of systems without problems Accounts – Grant the account the minimum rights needed to work. Path – Firewall rules and/or VPNs Audit – An audit package is planned in the future to enhance the base auditing features.

Security Aspects of the Core Servers will be hardened per Microsoft’s best practices for Server The core is protected by the normal firewalls, VLANs, and ACLs All traffic is planned to be encrypted via a minimum 128 bit SSL

Details

Novell’s Nsure Identity Manager 2 is the product that we are using. It has connectors to PeopleSoft, databases, systems, RACF, Network Operating Systems and others. It has add on Auditing capabilities and a more elaborate work flow engine

Development Environment

Processing Flow Publish and Subscribe picture

Future

Agency has complete control The account creation, change, and modification is all triggered through agency actions filtered by agency specified business rules. To do provisioning, we must gather userids and passwords

Password Security The passwords will be stored encrypted by triple DES in the directories Agents encrypt passwords before transmitting them to the centralized directory No administrator can see a password in clear text.

Provisioning Eventually PeopleSoft will be tied into the provisioning system Option 1 – Create a group to signify that a user has access to an application Option 2 – Extend the LAN schema to add an attribute that indicates that this user has access to the application. First phase is userid and password synchronization for authentication only

Provisioning c ont Second phase – new applications do direct lookups in the directory to check authentication. Third phase – authorization attributes are stored in the central directory and applications use it for authentication and authorization.

What about other agencies accessing my Application There is a simple work flow engine in the base product we purchased There is an add-on product we will use in the future that can the application owner for permission to add an account.

Possible Provisioning Targets Team Georgia Statewide Asset/Fleet Management PeopleSoft online access to info like check stubs Applications hosted for one or more agencies by GTA Applications hosted by an agency for internal use only

Future The infrastructure will allow automated account maintenance or provisioning. This option is at the agency’s discretion The infrastructure being setup can allow self service options like updating phone numbers on TeamGeorgia, and password reset. The information, changed by the self service application, can be optionally updated in agency directories.