Secure Connected Infrastructure Identity Management Allan Hvass Senior Consultant Microsoft Services

Identity Management Challenges Directories everywhere Too many passwords Passwords are weak Unmanageable security Allowing some outsiders access Reduce costs through directory integration Increase productivity with single sign-on Reduce risk through strong authentication Strengthen security with centralized management Extend the trust model

Secure Connected Infrastructure Secure Network Connectivity Secure Internet connectivity (MSA & ISA) Secure remote access (VPN, IAS) Secure wireless networks (PKI + 802.1x) Integrated Solution for Identity Management Directory Services (AD & MMS) Authentication (PKI, Kerberos, Passport) Authorization (ACLs, Roles, Federation) Policy based management (GP, and GPMC) Comprehensive Security Management & Operations Tools (MBSA, MSUS) Guidance (MOC, PAGs, Security Best Practices) Services (MSQS, PSS, & professional services)

Active Directory Common store for identity management Wireless LAN VPN Gateway Exchange SQL Server File Sharing LAN UNIX App Common store for identity management Application and NOS identities Repository for security principles Integrated policy-based management Scales to the Internet Web Services Active Directory Identity Repository

Flexible Authentication Mechanisms Authenticate Internet Smart Card X.509 / SSL Password Biometrics Active Directory Windows 2000 Server Applications Computers Devices Files People Credentials Many other authentication options than passwords

Authentication Services Wireless LAN VPN Gateway Exchange SQL Server File Sharing LAN UNIX App Integrated Security Services Kerberos Authentication & Authorization Integrated PKI for authentication and encryption Interoperable with UNIX via Kerberos & SFU Interoperable with mainframes via HIS Interoperable with Netware via SFN Web Services Active Directory

Options for Single Sign-on Single Sign-on Experience True SSO Single Identity Multiple Identities MMS can help keeping multiple directories synchronized, easing the authorization process Central Authentication Distributed Authentication Password Synchronization Client Managed Strategy Short Lived Long Lived Server Side Client Side Examples NTLM Kerberos Passport Certificates SfN SfU (pSync, NIS) HIS Credential Manager (XP) Extend to multiple directories with trusts

Directory Integration and Synchronization Wireless LAN VPN Gateway Exchange SQL Server File Sharing UNIX Application LAN Web Services Microsoft Metadirectory Server: Reduces the cost of managing ids Simplifies directory synchronization Automates user account provisioning Active Directory Non-AD Directory Active Directory

Windows 2000 Authorization Owners manage resources Access control lists (ACLs) Granular permissions & scope, Inheritance Admins manage users Groups Indirection & nesting simplify ACL management Privileges System-wide operational permissions System enforces access control Impersonation & delegation

Integrated Management Delegate Management Tasks to Office Admins Policy: Use Standard Security Template Company Users Machines Applications Marketing Extranet Devices Restrict Access to Color Printer Must Use Smart Card Integration with Active Directory provides a central consistent place to manage user and resource security

Active Directory Security Administration Forcing security settings to all users and systems with group policies Delegation of administration Grant permissions at organizational unit (OU) level Who creates OUs, users, groups, etc. Fine-grain access control Grant or deny permissions on per-property level, or a group of properties

.NET Server Improvements Directory Services Kerberos transitive trusts with constraining PKI cross-certification and qualified subordination Metadirectory Services optimized for multiple forests Authentication Passport authentication Smart Cards improvements Protocol transition Delegation improvements Authorization Authorization Manager (roles, tasks, rules, scope) Management Group Policy Management Console

Identity Management Challenges Directories everywhere Too many passwords Passwords are weak Unmanageable security Allowing some outsiders access Metadirectory Services, Authorization Manager AD (Kerberos, PKI), SfU, SfN, HIS, CredMan Smart Cards, Biometrics, AD policies Group Policies, AD delegation, GPMC Certificate or Passport based web client login

© 2001 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.