Identity, Management & Federation  Can you ever trust someone you don't manage?  John Arnold Chief Security Architect, Capgemini  Geoff Sweeney CTO, Tier-3

© 2004 Capgemini - All rights reserved Xxx/yymmdd - Title of the presentation, Author / 2 Overview  Jericho Forum’s Trust Paper –What is trust –How can we manage trust in a de-perimeterised organisation?  Tier-3 Experience with monitoring outsourced back-office for a bank

Why should we care about Trust?  Modern IT security is largely about constraining behaviour against rules in a directory  Today, we are happy to maintain that directory manually  As organisations become more porous, so do their directories  Trust is a general framework for managing directories effectively

© 2004 Capgemini - All rights reserved Xxx/yymmdd - Title of the presentation, Author / 4 Why do I trust my employees  Employment is governed by a contract –Rules of behaviour laid out for both sides –System of rewards and penalties for desired and undesired behaviour  Employment is trusting and co-operative –Employee trusts employer to pay him in arrears –Employer trusts employee not to damage his interests –The legal system, and informal sanctions, punish non-co- operation

© 2004 Capgemini - All rights reserved Xxx/yymmdd - Title of the presentation, Author / 5 How do I trust non-employees?  I will trust people to perform a task if –They have the necessary resources and skills –They are well disposed towards me –I can hold them accountable  Any form of trust can be treated as a contract –The terms must be made clear –The performance of both sides must be monitored –An accountability mechanism is required to handle non- compliance

© 2004 Capgemini - All rights reserved Xxx/yymmdd - Title of the presentation, Author / 6 Generic Trust Model Contract Formation Contract Performance Contract Monitoring Service Catalogue ProvisioningUser Audit Shopping CartFulfilmentFraud Detection

© 2004 Capgemini - All rights reserved Xxx/yymmdd - Title of the presentation, Author / 7 Trust Continuum High TrustLow Trust Strict registration and reputation checking Basic registration Emphasis on accountability Emphasis on access control Long term relationshipShort term transaction

Background  International Bank  Off shoring opportunity based in India –Attractive cost proposal  Risk management concerns –IT Security major focus  Enforcement of contract terms –SLA monitoring –Regular reporting © 2004 Capgemini - All rights reserved Xxx/yymmdd - Title of the presentation, Author / 8

Key Challenges  No sure way to control outsourced environment  Detailed audit provisioning –Audit use of banking environment Network’s Operating environment Application layer –Control and monitoring of all connected devices  Real time response –Critical situation resolution © 2004 Capgemini - All rights reserved Xxx/yymmdd - Title of the presentation, Author / 9

Audit Analysis  Record all network activity –VPN handoff Real time connected asset view Anomalous communications Use of bank assets –Operating system layer Account logon/off File access –Applications layer Database access (query level) Mainframe use © 2004 Capgemini - All rights reserved Xxx/yymmdd - Title of the presentation, Author / 10

Ongoing Process  Compliance statement –Management reporting  Real time monitoring –Investigation and threat prioritisation  Regular reporting back to outsourcer –Anomalous and inappropriate activity SLA implications Commercial resolution © 2004 Capgemini - All rights reserved Xxx/yymmdd - Title of the presentation, Author / 11

Benefits  Monitoring makes up for difficulties with access control  Allows organisations to build up trust  Modern technology allows audit analysis to be performed in real time  Allows participants, and 3 rd parties, to gain confidence in each other  Makes new types of de-perimeterised business partnerships viable