Identity & Access Management A Misnomer Informed, then decisive and protective Eric C Anderson, Sr. Cybersecurity Architect Health Care Service Corporation

Real Time Decisions Are you who you say you are? Do you belong here? Seventeen years ago, a technology executive published a book pushing the value of using a “digital nervous system” — real-time decisions, empowered by real time data. Today, we see the adoption of those principles. Data necessary for decisions is shared real-time, internally and externally, from any device, anywhere in the world. The result of this “Business at The Speed of Thought”, is the need to provide nearly instantaneous access management solutions to ensure that two questions are answered in the affirmative: Are you who you say you are? Do you belong here?

Identity Data Reference View Identity Lifecycle Management Enterprise Identity Lifecycle Mgmt Customer Identity Lifecycle Mgmt Identity Data Consumption The Identity Data space is defined by two distinct functions: Manipulation and management of identity data Provides capability to apply rules, governance, and analytics to access control Relationship between entitlement complexity and volume of identities may differentiate Enterprise ILM from Customer ILM. Data consumption service Allows for consumption of managed identity data to empower access control decisions

Identity Lifecycle Management What Is Identity Lifecycle Management? The process of actively managing an individual relationship as they move from persona to persona. Business Impact Commonalities Both Customer and Enterprise Identity Lifecycle empower the management of persona to persona within the enterprise Customer Customer identity tends to have more identities, simpler entitlements, and less control over device Enterprise Enterprise identity manages fewer identities, with much greater entitlement complexity

Identity Data Reference View Identity Lifecycle Management Enterprise ILM Customer ILM HR API/ WebService API/ WebService Enterprise ILM Customer ILM Identity Data Consumption Core Identity Repository Core Identity Repository Abstraction & Cache Consumption service Abstraction & Cache Consumption service

Access Control Business Impact What Is Access Control? The practice of ensuring that fulfilled access request must result in two questions, answered in the affirmative: “Are you who you say you are?”, “Do you belong here?” Business Impact Decision Service Externalization allows for the centralization of access control policy and decision authority Decouples access decisions from application code, providing improved agility Reduces prioritization conflicts around business features and security requirements Decision Enforcement Upon externalization and standardization of access control information, enforcement agents become fully commoditized Any process that can make a JSON/REST request can enforce the decision

Access Control Reference View Identity Data Identity Data Consumption Access Control Access Decision Access Enforcement The Access Control space is defined by two distinct functions: Access Decision Services access control request for defined resource by defined user Consumes Identity Data service to make access decision based upon centralized access control policies Access Enforcement Consumes and enforces simple allow/reject response

Access Control Reference View Identity Data Identity Data Consumption Core Identity Repository Core Identity Repository Abstraction & Cache Consumption service Abstraction & Cache Consumption service Access Control Access Decision ABAC/XACMLv3 Decision Service Application Layer Access Enforcement SM Policy Server Services Security Gateway API Gateway SM Agent Secured Proxy Services Secure Token Service JSON enabled enforcement points

Appendices

Use Case 1: Employee Onboarding Identity Data Identity Lifecycle Management Use Case 1 Internal Hiring Event Peoplesoft record created Request to Enterprise ILM ”Birthright entitlements” identified Explicit requests identified Approvals gained Governance records written Account provisioned to core identity service Abstraction layer picks up new body of entitlements to wrap around core object ILM (Enterprise) Enterprise ILM 1 B-Flex PeopleSoft HR API/ WebService 2 Identity Data Consumption Core Identity Repository 3 Abstraction & Cache Consumption service 4

Use Case 4: Prospect -> Member Conversion Identity Data Identity Lifecycle Management Use Case 4 Prospect -> Customer conversion Business Application identifies conversion Registration request submitted to Customer ILM API Customer ILM Converts identity from prospect to member Appropriate entitlements set Governance records written Record Created in Core Identity Repository Abstraction layer picks up the core identity update ILM (Customer) Customer ILM 2 API/ WebService Business Application 3 1 Core Identity Repository 4 Abstraction & Cache Consumption service 5

AC Use Case 1: Protected Application Identity Data AC Use Case 1 Protected Application User requests application Agent enforces Authentication Policy Server obtains Authentication Authenticates user Requests Coarse Authorization Identity Data Requested Coarse grained authorization decision made Application access granted Fine grained authorization requested Requests fine grained Authorization Identity data requested Fine grained authorization decision made Application Serves resource to browser Identity Data Consumption Core Identity Repository 3a Abstraction & Cache Consumption service 3c 4c Access Control Access Decision ABAC/XACMLv3 Decision Service 3b 4b Access Enforcement SM Policy Server SM Agent 3 2 Application Browser 4 1

AC Use Case 1: Protected Service Identity Data AC Use Case 2 Protected Service Application requests service Security GW enforces authentication Requests authentication from STS STS Obtains Authentication Issues Long term token shared with requestor Security Gateway services request Requests authorization decision based upon request Decision service requests relevant identity data Issues decision based upon identity data and centralized access control policy Issues short term token shared with requestor Decision enforced by Security Gateway Approved request submitted by proxy using short term token Data returned to requestor Identity Data Consumption Core Identity Repository 3a Abstraction & Cache Consumption service 3c 4c Access Control Access Decision ABAC/XACMLv3 Decision Service 3c 5a Access Enforcement Security GW Secure Token Service 6 2 4 7 3b Application 1