0. Case studies on Authentication, Authorization and Audit in SOA Environments Dr. Srini Kankanahalli

1. ClearAvenue, LLC
Headquartered in Columbia, Maryland
Focused on Systems Integration, Data Management, Information Security, Storage networking, Custom Software development
Premier IBM Business Partner
CMMi Maturity Level 3
clearAvenue, LLC is a 8(a) certified minority women owned Small Disadvantaged Business

2. Authentication, Authorization, and Audit– The Challenge
Identity and Access Management is a major challenge for all federal agencies
Multitude of Applications, Legacy as well as state-of the art Systems pose additional challenges
The complexity of Federal laws as well as federal contracting regulations further adds to the complexity
Comprehensive End-to-End Audits across multiple systems poses a significant challenge
Security is a major challenge for most organizations because of the threats. In federal agencies, it is even more complicated by the various federal mandates as well as complex federal contracts and contracting rules. Performing end-to-end audits, while a Certification and Accreditation mandate, poses significant challenges.

3. Layers of Security Perimeter Defense Control Layer Assurance Layer
Keep out unwanted with
Firewalls
Anti-Virus
Intrusion Detection, etc.
Perimeter Defense
Control Layer
Assurance Layer
Control Layer
Which users can come in?
What can users see and do?
Are user preferences supported?
Can user privacy be protected?
Security involves a multitude of technologies, products and processes. The notion of defense in depth is illustrated. Every layer has a different role and poses different challenges
Assurance Layer
Can I comply with regulations?
Can I deliver audit reports?
Am I at risk?
Can I respond to security events?

4. Services (Definitions) Supporting Middleware
SOA Security Encompass All Solution Layers 5 5 5 5
consumers
SCA
Portlet
WSRP
B2B
Other
SOA Security
Identity
Authentication
Authorization & Privacy
Auditing
Confidentiality, Integrity and Availability
Compliance
Administration and Policy Management
Service Consumer
Service Consumer 4 4 4 4
business processes
business processes
process choreography
process choreography 3 3 3 3
Services (Definitions)
services
atomic and composite
atomic and composite 2 2 2 2
Service
components
Service Provider
Service Provider 1 1 1 1
ISV
SAP
Packaged
Custom
Custom OO OO
While there is lot of talk around Service Oriented Architecture, implementing SOA poses multiple challenges. One of the major challenges is the propogation of identity across multiple services
Outlook
Packaged
Application
Custom
Custom
Application
Application
Application
Application
Application
Application
Application
Operational
systems
Custom Apps
Platform
Supporting Middleware
OS/390
Unix MQ
DB2

5. Identity Management– the basis of comprehensive security
Identity management is one of the main pillars of comprehensive security.

6. User Provisioning and De-provisioning
User Provisioning across multiple enterprise systems poses significant challenges
User De-provisioning is a greater challenge
Role-based access and Role Management adds to the complexity
Role Engineering encompasses very little “engineering” and lot of “Politics”

7. Implementing Role-based Access Control
Successfully implemented RBAC with role-based provisioning to legacy as well as state-of the art systems
A Role is a set of entitlements that has a “Business Context”
Roles are not “cast in stone,” but is derived through a “trial and error” process
Role Re-factoring has to be kept in mind during the design and implementation of any RBAC system

8. Role-based Access to Legacy and Modernized Systems

9. Legacy systems integration -- Seibel

10. Federated Identity Management-- Challenge
In many situations, one federal agency has to communicate and access data from another agency
This problem also may exist between multiple subdivisions of the same agency or organization
The solution involves building and propagating trust across boundaries using industry standards
Audits across agencies or subdivisions pose additional challenges

11. Organization B Organization A
SAML
Organization A
Federated Identity Management
Across Multiple Organizations

12. Federation Entities

13. SOA Federated Identity Management
SAML
TFIM
SAML
LDAP
Internet
Web Service
Websphere ND

14. Multi-Factor Authentication
There are multiple federal and commercial mandates for strong and Multi-factor authentication

15. Multi-factor based Certificate based Authentication architecture using IBM Tivoli Federated Identity manager

16. Conclusions
We have implemented complex security patterns in multiple federal agencies
Security is Multi-faceted and hence has to be carefully architected and implemented correctly
The availability of multiple point products adds to the integration complexity
Authentication, Authorization, Audit and Identity Management are all intertwined and has to be planned and implemented correctly to ensure that “Attack Surface” of an organization is minimized