INFORMATION SECURITY FOR ACCESS PROVISIONING: THE BOEING COMPANY T-BONE & TONIC: ALY BOGHANI JOAN OLIVER MIKE PATRICK AMOL POTDAR April 26, 2009

T-Bone & Tonic What is Access Provisioning? Provisioning To create and maintain a subject's digital identity, accounts, credentials, and entitlements in response to automated or interactive business processes. 11/13/ Identity A BEMSID (employee ID) and all related employee information Account A windows account for Jane Smith, Web Single Sign On (WSSO) Credentials Biometric identifier(s), Windows Password, Z-Token Entitlement Access to REDARS, A Boeing Badge, Access to newScale

T-Bone & Tonic Current Problem Boeing’s developed 40+ homegrown identity management and provisioning tools over the past 10 years The Problem  Provisioning processes are redundant, inefficient, costly, and frustrating  Data requirements and dependencies are unclear and confusing 11/13/2015 3

T-Bone & Tonic Current Problem The Risks  Users access to resources is difficult to manage  Unauthorized disclosure of information requiring enhanced controls  People leaking information requiring enhanced controls  Exploitation of people vulnerabilities resulting in information disclosure 11/13/2015 4

T-Bone & Tonic Current Problem The Result  Multiple compliance controls  Long cycle times  Processing errors due to human mistakes  Millions of dollars and hours lost in productivity for airline programs, finance, et al. 11/13/2015 5

T-Bone & Tonic End-User Perspective 11/13/ End Users Technologists End users focus on access to target systems like Windows, REDARS, etc. They don’t focus on what accounts they need to access Windows. Technologists focus the accounts and permissions end users need to access Windows, etc. Common Ground Is A With Access To The goal of provisioning is to help Sally obtain access to REDARS, etc. Using the Following Account(s) Using the Following Account(s) newScale

T-Bone & Tonic 11/13/ Enterprise Perspective

T-Bone & Tonic Solution: Enterprise Access Provisioning  Must incorporate the four cornerstones of information security:  Confidentiality, Authenticity, Integrity, Availability A successful provisioning solution ensures individuals get access to necessary resources easily and quickly while ensuring the proper security protocols are completed. 11/13/2015 8

T-Bone & Tonic Identity Management Systems - Concerns  A “metaverse” must exist that processes the rules and requests for password changes and synchronizations  The rules must be established by the business  There must be a directory of record that pushes identity changes to the other directories  Typically the HR system creates and deprovisions user accounts  Typically the Active Directory system pushes password changes to the other directories  A lot of custom scripting usually occurs to make the separate systems talk each other 11/13/2015 9