Alan Dekok, CTO Terena June 2 Why Identity Management is hard

2 Confidential - © Mancala Networks This is your network

3 Confidential - © Mancala Networks This is the network you want

4 Confidential - © Mancala Networks Why IDM is hard Secure systems require: Secure systems require: Knowledge Knowledge Inventory, monitoring, etc. Inventory, monitoring, etc. Requirements Requirements Network policies and procedures Network policies and procedures Enforcement Enforcement Firewalls, IDS, etc. Firewalls, IDS, etc. If any piece is missing, the system falls over If any piece is missing, the system falls over And so does your network And so does your network

5 Confidential - © Mancala Networks Vendors are warlords Knowledge? Knowledge? Locked up in proprietary systems Locked up in proprietary systems Requirements? Requirements? Need to be expressed in the vendors language Need to be expressed in the vendors language Enforcement? Enforcement? Go ask someone else. Go ask someone else. Your network is a battleground. And you are losing.

6 Confidential - © Mancala Networks Vendor Product Integration

7 Confidential - © Mancala Networks What makes IDM hard  Identity management is...  WHO is on your network  WHICH rules apply to them  WHAT they are doing  HOW to stop bad behavior In direct conflict with vendor goals.

8 Confidential - © Mancala Networks What you can do about it Own your network. Own your network. Know everything about the network. Know everything about the network. Set global network control Set global network control Enforce it across all sites and services. Enforce it across all sites and services. Demand this from the vendors.

9 Confidential - © Mancala Networks Better vendor integration

10 Confidential - © Mancala Networks Without IDM, what happens? No database of MAC / IP? No database of MAC / IP? No idea who is on your network No idea who is on your network No policy capability? No policy capability? No way of expressing what should happen. No way of expressing what should happen. No enforcement of policies? No enforcement of policies? No punishment for bad behavior No punishment for bad behavior Configuring all of this is expensive

11 Confidential - © Mancala Networks Similar to driving...  No car registration, anyone can drive!  Versus: licensed drivers and vehicles  No government control, drive anywhere!  Versus: Common policies and requirements  No enforcement, go steal a car!  Versus: Ubiquitous policing and enforcement

12 Confidential - © Mancala Networks How to get IDM  Demand access to data  Knowledge is power!  Demand inter-operability  Simpler, cheaper, better  Demand security!  Ignoring security is so 1990’s. It’s your network, not theirs.

13 Confidential - © Mancala Networks FreeRADIUS as an example  All data is stored in databases  Policy language to express any security system  Policy enforcement when user logs in  It has taken ~10 years to develop this system No equivalent for DNS or DHCP.

14 Confidential - © Mancala Networks IDM Examples Unknown person on the network? Unknown person on the network? Now: They can still do DHCP Now: They can still do DHCP Versus: Maybe kick them off of the network. Versus: Maybe kick them off of the network. Or inform the administrator. Or inform the administrator. User manually enters an IP address? User manually enters an IP address? Now: They can still access network resources Now: They can still access network resources Versus: Deny them access to network resources? Versus: Deny them access to network resources? Maybe kick them off of the network. Maybe kick them off of the network. Or inform the administrator. Or inform the administrator.

15 Confidential - © Mancala Networks Network evolution Open networks Open networks Anyone can get access Anyone can get access No policies or enforcement No policies or enforcement Hard shell networks Hard shell networks Login checking for access Login checking for access Minimal policies or enforcement Minimal policies or enforcement Defence in depth Defence in depth Continuous access checking Continuous access checking Detailed policies, extensive enforcement Detailed policies, extensive enforcement For every location, service, switch port,...

16 Confidential - © Mancala Networks Barriers to IDM

17 Confidential - © Mancala Networks Open Standards The network is built on open standards The network is built on open standards We need open data formats, too. We need open data formats, too. We need open policy languages We need open policy languages Perl or Python are a start Perl or Python are a start We need integrated systems We need integrated systems Real-time feeds between services Real-time feeds between services

18 Confidential - © Mancala Networks Demand freedom  All data is stored in databases  No restrictions on what you can do with it  Complex policies to build any security system  Integration of systems Network Management is Identity Management

19 Confidential - © Mancala Networks When everyone works together