1. Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. Andrew Stone Common Security Services

2. 2 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. Introduction Application Security Issues Common Security Services (CSS) Overview AAAA Services Leveraging Aspect Oriented Programming Benefits of CSS Questions Agenda

3. Introduction Andrew Stone, Sr. Manager 9 years of security experience Extensive custom design/build experience surrounding security solutions Patents pending on security technologies related to authorization 3 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture.

4. 4 Introduction Application Security Issues Common Security Services (CSS) Overview AAAA Services Leveraging Aspect Oriented Programming Benefits of CSS Questions Agenda

5. 5 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. Common Application Security Implementations Validate User Is User Authorized? Amount to Withdraw? Enough Funds? Errors? Withdraw Money Method Disburse funds Logging Authentication Authorization Business Logic Error Handling Code Tangling – Simultaneous presence of security elements intertwined with business logic.

6. 6 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. Deposit Funds Withdraw Funds View Funds Transfer Funds Open New Account Logging Authentication Authorization Sample Banking Application Code Scattering – Security is separated from business logic but code is duplicated within the application and is left to developer to leverage common security services. Common Application Security Implementations (cont’d)

7. Other Application Security Issues Upgrade Complexity – Since security is so woven into the application, it is difficult to implement newer technologies to meet new security requirements. Lower Code Reuse – Security is implemented specifically for each custom application and not reused throughout the enterprise. Disparate Administration – Administration of security policies is handled in each individual custom application. Difficult to Audit for Privileges – Code tangling and code scattering makes it difficult to tie granular privileges to individuals for reporting purposes. Protecting Data Access – Difficult to protect what users or services can access at the data layer level. 7 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture.

8. Modular and Reusable Security Services 8 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. Logging Authorization Deposit Funds Withdraw Funds View Funds Transfer Funds Open New Account Authentication Security components needs to be modular, reusable and encase the entire application in an object-oriented manner.

9. 9 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. Introduction Application Security Issues Common Security Services (CSS) Overview AAAA Services Leveraging Aspect Oriented Programming Benefits of CSS Questions Agenda

10. Common Security Services Overview 10 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. A Common Security Services (CSS) for custom applications establishes a flexible security model that is segregated from the business logic.

11. CSS Sequence Diagram 11 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. The diagram below explains how authentication, authorization and auditing is managed by a CSS infrastructure throughout the web, application and data layers.

12. Authentication and Authorization (AA) Framework 12 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. 4 components govern how requesters authenticate and obtain authorization to a protected resource.

13. Component Architecture of the AA Framework 13 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. The AA Framework revolves around an authorization engine in the PDP, caching capabilities and leveraging external data stores for deriving runtime decisions.

14. Implementation of AA Framework 14 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. The AA Framework can be implemented across a 3-tier architecture for users and application services.

15. 15 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. Introduction Application Security Issues Common Security Services (CSS) Overview AAAA Services Leveraging Aspect Oriented Programming Benefits of CSS Questions Agenda

16. CSS Functionalities 16 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. Functionalities provided by the various technical services in the Common Security Services model.

17. Authentication Services 17 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. CSS can abstract authentication providers and integrate with common providers like SiteMinder or LDAP Directory.

18. Authorization Services 18 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. CSS will leverage an entitlements server that holds the authorization engine to derive access decisions.

19. Administration Service 19 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. The administration service will provide workflow capabilities and manage the attributes, identities and roles required by the authorization engine in the entitlements server.

20. 20 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. Introduction Application Security Issues Common Security Services (CSS) Overview AAAA Services Leveraging Aspect Oriented Programming Benefits of CSS Questions Agenda

21. Leveraging AOP as a PEP 21 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. Aspect Oriented Programming (AOP) acts as a PEP by intercepting business logic that requires secure processing. The interception events can be executed before or after the execution of the business logic.

22. Aspect Oriented Programming 22 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. Compiler Aspect Compiler Weaver Rules Source Code Aspects Source Code with Aspects Binary Code

23. Benefits of AOP with Security Completely segregate business logic from security logic providing a level of abstraction Higher modularization of security components for portability and re-use Complements the implementation of a Common Security Services layer by “weaving” in security policies and decisions from an external source 23 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture.

24. 24 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. Introduction Application Security Issues Common Security Services (CSS) Overview AAAA Services Leveraging Aspect Oriented Programming Benefits of CSS Questions Agenda

25. Benefits of CSS Architecture Extensibility of security infrastructure to meet future requirements Centralized security administration Reduced development costs Portability and modularity of security components Consistency of security policies across all custom applications Ability to perform upgrades without affecting custom application functionalities Enhanced reporting and auditing capabilities 25 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture.

26. Questions? 26 Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture.