Hitachi ID Password Manager Deployment Best Practices

Total Page:16

File Type:pdf, Size:1020Kb

Hitachi ID Password Manager Deployment Best Practices Hitachi ID Password Manager Deployment Best Practices © 2020 Hitachi ID Systems, Inc. All rights reserved. Contents 1 Introduction 1 2 System objectives 3 3 Mission statement 4 4 Metrics 5 5 Stake-holders 6 6 Deployment and support team 8 7 Features and design 10 8 User access to the self-service UI 12 9 Formulating a uniform password policy 13 9.1 Strategy ............................................... 13 9.2 Suggested policy rules ....................................... 13 9.3 Where to enforce password policy ................................. 14 10 Equivalent credentials 15 11 Security questions 16 11.1 Security equivalence ........................................ 16 11.2 Memorable questions ........................................ 16 11.3 Other best practices ........................................ 16 11.4 Sample questions .......................................... 17 12 Augmenting security questions with a second factor 20 13 Infrastructure integrations 21 14 Hitachi ID Password Manager: technical architecture 23 14.1 Number and location of servers .................................. 23 14.2 Configuration of individual servers ................................. 23 14.3 Development, test and production environments ......................... 24 i Password Manager Deployment Best Practices 14.4 Proxy servers for hard-to-reach target systems ......................... 26 15 Hitachi ID Password Manager: server hardening 27 15.1 Overview ............................................... 27 15.2 Physical security .......................................... 28 15.3 Operating system access ...................................... 28 15.4 IIS configuration ........................................... 30 15.5 SQL Server configuration ...................................... 30 16 Hitachi ID Password Manager: BYOD access to on-premises credential management 31 17 Auto-discovery of user profiles and accounts 33 17.1 Selecting sources of profiles .................................... 33 17.2 Mapping login IDs to user profiles ................................. 33 18 User enrollment 35 19 Maximizing user adoption and ROI 38 19.1 Minimize password problems ................................... 38 19.2 User awareness ........................................... 38 19.3 Incentives for enrollment ...................................... 38 19.4 Automated reminders ........................................ 38 19.5 A call to IT support is not the right time to enroll ......................... 39 19.6 Charge-backs and manager feedback ............................... 39 19.7 Reduce SLA for help desk calls .................................. 39 19.8 Plan for user adoption ....................................... 39 20 Ongoing administration and support 40 20.1 Functional test ............................................ 40 20.1.1 Password changes .................................... 40 20.1.2 Enrollment ........................................ 40 20.1.3 Transparent password synchronization ........................ 40 20.1.4 Help desk logins ..................................... 40 20.1.5 Sending e-mails ..................................... 40 20.1.6 Creating call tracking system ticket ........................... 41 © 2020 Hitachi ID Systems, Inc. All rights reserved. Password Manager Deployment Best Practices 20.1.7 IVR (phone call) integration ............................... 41 20.1.8 Mobile access ...................................... 41 20.1.9 Off-site, Windows login screen access ......................... 41 20.1.10 Filesystem unlock .................................... 41 20.2 Changes to target system configuration .............................. 41 20.3 Monitor service health ....................................... 41 20.4 Monitor utilization .......................................... 42 21 Summary 43 © 2020 Hitachi ID Systems, Inc. All rights reserved. Password Manager Deployment Best Practices 1 Introduction The remainder of this document is organized as follows: • System objectives – what credential management systems are designed to do. • Mission statement – how organizations should structure their internal communication about priorities and objectives. • Metrics – how to measure the impact on the system. • Stake-holders – who to involve in design, implementation and ongoing support. • Deployment and support team – who the core individuals are that must build out and support the system and what their initial and long term commitment will be. • Features and design – what processes the system should automate. • User access to the self-service UI – how to ensure that users can resolve login problems wherever they may be, at any time and on any device in any state. • Formulating a uniform password policy – how to develop a set of password rules that work for every system and every user community. • Equivalent credentials – caution about weak links in security and how to avoid them. • Security questions – design considerations for enrolling security questions and using them to au- thenticate users who forgot their password. • Augmenting security questions with a second factor – how to improve security by front-ending security questions with a stronger, one-time-password credential. • Infrastructure integrations – what systems the credential management automation should integrate with. • Hitachi ID Password Manager: technical architecture – the runtime platform and network architec- ture on which Password Manager is deployed. • Password Manager: server hardening – how to lock down OS, DB and web servers to protect the system. • Password Manager: BYOD access to on-premises credential management – how to enable users to access self-service from their phones or tablets, which are typically not attached to the corporate network. • Auto-discovery of user profiles and accounts – how to minimize care and feeding of the system using auto-discovery. • User enrollment – inviting users to answer security questions; install smart phone apps; etc. • Maximizing user adoption and ROI – strategies to get users to enroll and to use the system to resolve login problems. © 2020 Hitachi ID Systems, Inc. All rights reserved. 1 Password Manager Deployment Best Practices • Ongoing administration and support – what can be expected in terms of long term care and feeding of the system. © 2020 Hitachi ID Systems, Inc. All rights reserved. 2 Hitachi ID Password Manager Deployment Best Practices 2 System objectives A credential management system should deliver three benefits: • Improved user service: Fewer credentials for users to remember and manage and simpler, quicker and more convenient resolution for login problems. • Lower IT support cost: Fewer help desk calls related to login problems such as forgotten passwords, intruder lockouts or tokens left at home. • Stronger security: Stronger and more consistent enforcement of policies around password composition, change fre- quency and reuse, as well as more reliable processes to authenticate users who experience a login problem, before assisting them. © 2020 Hitachi ID Systems, Inc. All rights reserved. 3 Hitachi ID Password Manager Deployment Best Practices 3 Mission statement A mission statement documented before the system is deployed is helpful for getting all stake-holders to cooperate. One way to formulate this mission statement is to capture the state of affairs before the system is deployed and the desired end state. Following is an example: Credential management system objectives Before After User service / SLA Users manage 8 different passwords, on With password synchronization, users will only have to manage 2 average. passwords. Only some passwords expire and they Users will be prompted to change all passwords at the same time. do so at different times Different systems enforce different A uniform password policy will supersede multiple, inconsistent password policy rules. rules. Users sometimes forget their pre-boot Enable self-service filesystem unlock via smart phone app. password. Users sometimes forget their OS login Enable self-service password reset from the PC login screen, with password, in some cases while off-site. VPN+WiFi integration to support users working outside the office. IT support cost 30% of total help desk call volume is due Password synchronization and self-service problem resolution to login problems. will reduce this call volume by at least 80%. 5% of total call volume is due to OTP Offer self-service PIN reset and emergency passcodes via token problems. smart-phone app. Help desk calls to resolve login problems Consolidate caller authentication, technician login, problem take 10 minutes to resolve, on average. resolution and ticket generation behind a single UI, to reduce call duration to 2 minutes. Security / authentication Users have too many passwords and Synchronization will eliminate the main user motivation for writing write them down. down passwords. Different systems and applications Implement a uniform policy with a superset of password enforce different password policies. composition, reuse and change frequency rules. Users calling the help desk are not Move most incidents to self-service and apply uniform reliably identified. authentication processes in both self-service and assisted-service contexts. Not all systems log password changes. Will record who changed passwords, on a central credential management system. Too many IT support staff have logins Support staff will reset passwords through an assisted-service with elevated rights, required to reset portal, eliminating the need for such
Recommended publications
  • Comparative Analysis and Framework Evaluating Web Single Sign-On Systems
    Comparative Analysis and Framework Evaluating Web Single Sign-On Systems FURKAN ALACA, School of Computing, Queen’s University, [email protected] PAUL C. VAN OORSCHOT, School of Computer Science, Carleton University, [email protected] We perform a comprehensive analysis and comparison of 14 web single sign-on (SSO) systems proposed and/or deployed over the last decade, including federated identity and credential/password management schemes. We identify common design properties and use them to develop a taxonomy for SSO schemes, highlighting the associated trade-offs in benefits (positive attributes) offered. We develop a framework to evaluate the schemes, in which weidentify14 security, usability, deployability, and privacy benefits. We also discuss how differences in priorities between users, service providers (SPs), and identity providers (IdPs) impact the design and deployment of SSO schemes. 1 INTRODUCTION Password-based authentication has numerous documented drawbacks. Despite the many password alternatives, no scheme has thus far offered improved security without trading off deployability or usability [8]. Single Sign-On (SSO) systems have the potential to strengthen web authentication while largely retaining the benefits of conventional password-based authentication. We analyze in depth the state-of-the art ofwebSSO through the lens of usability, deployability, security, and privacy, to construct a taxonomy and evaluation framework based on different SSO architecture design properties and their associated benefits and drawbacks. SSO is an umbrella term for schemes that allow users to rely on a single master credential to access a multitude of online accounts. We categorize SSO schemes across two broad categories: federated identity systems (FIS) and credential managers (CM).
    [Show full text]
  • A Decentralized Framework for Verifiable Credentials on the Web by Kayode Yadilichi Ezike S.B
    SolidVC - A Decentralized Framework for Verifiable Credentials on the Web by Kayode Yadilichi Ezike S.B. EECS | Massachusetts Institute of Technology | 2017 Submitted to the Department of Electrical Engineering and Computer Science in Partial Fulfillment of the Requirements for the Degree of Master of Engineering in Electrical Engineering and Computer Science at the MASSACHUSETTS INSTITUTE OF TECHNOLOGY February 2019 ○c Massachusetts Institute of Technology 2019. All rights reserved. Author................................................................ Department of Electrical Engineering and Computer Science February 20, 2019 Certified by. Lalana Kagal Principal Research Scientist Thesis Supervisor Accepted by . Katrina LaCurts Chair, Master of Engineering Thesis Committee 2 SolidVC - A Decentralized Framework for Verifiable Credentials on the Web by Kayode Yadilichi Ezike Submitted to the Department of Electrical Engineering and Computer Science on February 20, 2019, in Partial Fulfillment of the Requirements for the Degree of Master of Engineering in Electrical Engineering and Computer Science Abstract Credentials are an integral part of our lives, as they express our capabilities and enable access to restricted services and benefits. In the early 2010s, the Verifiable Claims Working Group of the World Wide Web Consortium (W3C) proposed a specifica- tion for what is now the Verifiable Credentials Data Model. This living specification, which is still in development, outlines a cogent framework for the issuance, storage, presentation, and verification of credentials on the Web. Many of the leading Verifi- able Credentials projects leverage Distributed Ledger Technology (DLT), potentially compromising Web interoperability and sometimes exposing otherwise personal data. SolidVC is a decentralized Verifiable Credentials platform built with the open pro- tocols of the Web.
    [Show full text]
  • Indeni Insight
    Indeni 6 User Guide Part 1: Understanding the Basics 1.1 Requirements 1.2 Installation 1.3 Indeni Insight Part 2: Getting Started 2.1 Creating Users on Vendor Devices 2.2 Device Communication Part 3: Navigating the User Interface 3.1 Summary Tab 3.2 Current Tab 3.3 Archived Tab 3.4 Rules Tab Part 4: Analysis and Reporting 4.1 Custom Reports Part 5: Device Management 5.1 Credential Sets 5.2 Adding Devices 5.3 Device Backup Part 6: Settings 6.1: Centralized Authentication 6.2: Role Based Access Control 6.3: Configuring a Proxy Server to access Indeni Insight 6.4: SNMP Integration Part 7: Security Open Source Credits 2 | Page Part 1: Understanding the Basics This Introductory Guide is geared towards technical users with a strong working knowledge of networking and network security administration. Users should have the ability to set up network devices on their own, and also be familiar with how to use the various Command Line Interfaces (CLI). The guide is designed to take you from start to finish, in an order that will help you succeed. If you are a first time Indeni user, you will want to go through each step of the guide, and at the end, you should be able to add devices with a good understanding of how to use the system successfully. We highly encourage interested users, students, and IT professionals testing new technologies to download and use Indeni for free! If you do not have networking devices to test with, but are interested in trying out our system, you can use other tools such as GNS3, since Indeni works with both physical and virtual devices.
    [Show full text]
  • Move Beyond Passwords Index
    Move Beyond Passwords Index The quest to move beyond passwords 4 Evaluation of current authentication method 6 Getting started with passwordless authentication 8 Early results to going passwordless 9 Common approaches to going passwordless 11 Email magic links 11 Factor sequencing 12 Webauthn 14 Planning for a passwordless future 16 Move Beyond Passwords 2 Introduction Traditional authentication using a username and password has been the foundation of digital identity and security for over 50 years. But with the ever-growing number of user accounts, there are a number of new issues: the burden on end users to remember multiple passwords, support costs, and most importantly, the security risks posed by compromised credentials. These new challenges are now outweighing the usefulness of passwords. The case for eliminating passwords from the authentication experience is getting more compelling every day. Emerging passwordless security standards, elevated consumer and consumer-like experience expectations, and ballooning costs have moved eliminating passwords from a theoretical concept to a real possibility. In this whitepaper, we will explore the case for going passwordless for both customer and employee authentication, and map out steps that organizations can take on their journey to true passwordless authentication. Move Beyond Passwords 3 The quest to move beyond passwords Understanding the need for passwordless authentication starts with understanding the challenges presented by passwords. The core challenges with passwords can be broken down into the following areas: Poor Account Security Passwords have spawned a whole category of security/identity-driven attacks — compromised passwords due to credential breaches, phishing, password spraying attacks, or poor password hygiene can result in account takeover attacks (ATO).
    [Show full text]
  • Netiq Securelogin Installation Guide
    SecureLogin 8.7 Installation Guide February, 2019 Legal Notice For information about NetIQ legal notices, disclaimers, warranties, export and other use restrictions, U.S. Government restricted rights, patent policy, and FIPS compliance, see https://www.netiq.com/company/legal/. © 2018 NetIQ Corporation. All Rights Reserved. For information about NetIQ trademarks, see https://www.netiq.com/company/legal/. All third-party trademarks are the property of their respective owners. 2 Contents About This Guide 7 1 Getting Started 9 Prerequisites . 9 Setting Up a Passphrase . 9 2 Introduction 11 Features of SecureLogin Installer. .11 Installation Overview . .11 Logging Event Messages. .13 Disabling Logging to Windows Event Log By Using Installation Wizard . .13 Disabling Logging to Windows Event Log After the Installation. .14 Logging of Syslog Audit Messages . .14 Installing and Configuring Syslog Auditing . .14 Enabling Logging to Syslog . .16 Managing Log Settings for SecureLogin Components . .17 Understanding the NSLLogManager Functionality . .17 Using NSLLogManager. .17 Installing SecureLogin with Advanced Authentication. .17 Installing SecureLogin Browser Extensions . .18 Installing Single Sign-on Assistant in Google Chrome. .18 Installing Single Sign-on Assistant in Microsoft Edge (Chromium-based) . .19 Installing Single Sign-on Assistant in Microsoft Edge (HTML-based). .19 Installing Single Sign-on Assistant in Mozilla Firefox. .20 Installing NetIQ SecureLogin Extension in Google Chrome . .20 Installing NetIQ SecureLogin Extension in Mozilla Firefox . .20 3 Installing and Configuring in Active Directory Environment 23 Before You Begin . .23 Prerequisites . .23 Requirements for Microsoft Windows Server . .24 Installation Overview. .25 Microsoft Active Directory . .25 Configuring . .26 Extending the Active Directory Schema and Assigning Rights . .26 Configuring a User’s Environment .
    [Show full text]
  • Derived Personal Identity Verification (PIV) Credentials
    NIST SPECIAL PUBLICATION 1800-12 Derived Personal Identity Verification (PIV) Credentials Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C) William Newhouse Michael Bartock Jeffrey Cichonski Hildegard Ferraiolo Murugiah Souppaya Christopher Brown Spike E. Dog Susan Prince Julian Sexton This publication is available free of charge from https://doi.org/10.6028/NIST.SP.1800-12 Previous drafts of this publication are available free of charge from https://www.nccoe.nist.gov/library/derived-piv-credentials-nist-sp-1800-12-practice-guide NIST SPECIAL PUBLICATION 1800-12 Derived Personal Identity Verification (PIV) Credentials Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C) William Newhouse National Cybersecurity Center of Excellence Information Technology Laboratory Michael Bartock Jeffrey Cichonski Hildegard Ferraiolo Murugiah Souppaya National Institute of Standards and Technology Information Technology Laboratory Christopher Brown Spike E. Dog Susan Prince Julian Sexton The MITRE Corporation McLean, Virginia August 2019 U.S. Department of Commerce Wilbur Ross, Secretary National Institute of Standards and Technology Walter Copan, NIST Director and Undersecretary of Commerce for Standards and Technology NIST SPECIAL PUBLICATION 1800-12A Derived Personal Identity Verification (PIV) Credentials Volume A: Executive Summary William Newhouse National Cybersecurity Center of Excellence Information Technology Laboratory Michael
    [Show full text]
  • Foglight Administration and Configuration Guide Updated - November 2018 Software Version - 5.9.X Contents
    Foglight® 5.9.x Administration and Configuration Guide © 2018 Quest Software Inc. ALL RIGHTS RESERVED. This guide contains proprietary information protected by copyright. The software described in this guide is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser’s personal use without the written permission of Quest Software Inc. The information in this document is provided in connection with Quest Software products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Quest Software products. EXCEPT AS SET FORTH IN THE TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, QUEST SOFTWARE ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL QUEST SOFTWARE BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF QUEST SOFTWARE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Quest Software makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice.
    [Show full text]
  • Background on Identity Federation Technologies for the Public Safety Community
    1 Draft NISTIR 8336 2 Background on Identity Federation 3 Technologies for the Public Safety 4 Community 5 6 William Fisher 7 Mark Russell* 8 Sudhi Umarji 9 Karen Scarfone 10 11 * Former employee; all work for this 12 publication was done while at employer. 13 14 15 16 This publication is available free of charge from: 17 https://doi.org/10.6028/NIST.IR.8336-draft 18 19 20 21 Draft NISTIR 8336 22 Background on Identity Federation 23 Technologies for the Public Safety 24 Community 25 William Fisher 26 Applied Cybersecurity Division 27 Information Technology Laboratory 28 29 Mark Russell* 30 Sudhi Umarji 31 The MITRE Corporation 32 McLean, VA 33 34 Karen Scarfone 35 Scarfone Cybersecurity 36 Clifton, VA 37 38 * Former employee; all work for this 39 publication was done while at employer. 40 41 This publication is available free of charge from: 42 https://doi.org/10.6028/NIST.IR.8336-draft 43 44 June 2021 45 46 47 48 U.S. Department of Commerce 49 Gina Raimondo, Secretary 50 51 National Institute of Standards and Technology 52 James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce 53 for Standards and Technology & Director, National Institute of Standards and Technology 54 National Institute of Standards and Technology Interagency or Internal Report 8336 55 80 pages (June 2021) 56 This publication is available free of charge from: 57 https://doi.org/10.6028/NIST.IR.8336-draft 58 Certain commercial entities, equipment, or materials may be identified in this document in order to describe an 59 experimental procedure or concept adequately.
    [Show full text]
  • Complete and Scalable Access Management
    Oracle Access Management Complete, Integrated, Scalable Access Management Solution ORACLE WHITE PAPER | M A Y 2 0 1 5 Disclaimer The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle. ORACLE ACCESS MANAGEMENT Table of Contents Executive Summary 2 Introduction 3 Typical Use-Case Scenarios 5 Oracle Access Management Overview 6 Oracle Access Management Core Services 7 Intelligent Access Management 8 Adaptive Access and Fraud Prevention 12 Identity Federation 13 Mobile Security 16 API and Web Services Security 20 Cloud Security 22 Enterprise Single Sign-On 24 Scalability and High Availability 25 Conclusion 26 1 | ORACLE ACCESS MANAGEMENT Executive Summary In the recent past, Access Management was mainly focused on web authentication, single sign-on, and access to intranet applications. However, the enterprise access management landscape has been evolving at a fast pace over the last few years to meet the requirements of new computing paradigms and technologies transforming the way organizations access and expose business-critical services and data. In today’s enterprise environment, organizations increasingly depend on the cloud for delivery of applications in addition to existing on-premise deployments, and more and more users leverage multiple types of devices to access those applications. In order to increase traffic to their corporate portals, enterprises often leverage less-secure social network identities.
    [Show full text]
  • Authentication and Authorization for the Front-End Web Developer
    Authentication and Authorization for the front-end web developer Biraj Paul School of Science Thesis submitted for examination for the degree of Master of Science in Technology. Espoo 22.6.2020 Supervisor Prof. Tuomas Aura Advisor Niall O’Donoghue, M.Sc., Gofore Copyright © 2020 Biraj Paul Aalto University, P.O. BOX 11000, 00076 AALTO www.aalto.fi Abstract of the master’s thesis Author Biraj Paul Title Authentication and Authorization for the front-end web developer Degree programme CCIS Major Secure Systems Code of major SCI3042 Supervisor Prof. Tuomas Aura Advisor Niall O’Donoghue, M.Sc., Gofore Date 22.6.2020 Number of pages 61 Language English Abstract Traditional web pages are hosted and served through a web server that are executed in a web browser in the user’s devices. Advancement in technologies used to create web pages has led to a paradigm shift in web development, leading to concepts such as front-end and back-end. Browser-based technologies, particularly JavaScript, has seen enormous advancements in functionalities and capabilities. This led to a possibility of creating standalone web applications capable of running in the browser and relying on the back-end server only for data. This is corroborated by the rise and popularity of various JavaScript frameworks that are used by default when creating web applications in modern times. As code running on a web browser can be inspected by anyone, this led to a challenge in incorporating authentication and authorization. Particularly because storing user credentials and secrets on the web browser code is not secure in any way.
    [Show full text]
  • Webauthn Is Coming to Town! [email protected]
    WebAuthn is coming to town! [email protected] With courtesy of reused talks by @herrjemand, @equalsJeffH, @Oskar456 and others from FIDO Alliance ;) A non-formal prequel ... A non-formal prequel ... ● Do you think that NIST recommendation should be enough for everybody ??? ● If password expiration make users to use weak passwords, so the zero password policy requirements would result in usage of strong passwords ? ○ I don’t think so From a field experience ... 1. Online bruteforce (1st party - login procedure not rate-limited or guarded) 2. Offline bruteforce (1st party - DB leaks) 3. Password reuse (3rd party - DB leaks) 4. Insecure delegation (2nd party - NTLM Wdigest, MSV/Cached Logons, ...) 5. Insecure storage (self - sticky notes, keepass triggers) 6. Phishing (self) DCE should be guarded as whole and in depth ● On the contrary to the many other experts ... ● … I do think that password policy 10 + 3 + 2 is a good idea for a common distributed computing environment ○ … not best idea nor the only one. ○ 10 characters … average length of a czech word is 5, so it encourages users to use at least two words ○ 3 character classes ... to harden the bruteforce ○ 2 years expiration … nothing lasts forever Is there a way out of this ? Black Hat 2019: Every Security Team is a Software Team Now Current (web) authentication recap ● Username / password ○ + works for everyone (users, developers, business) ○ - password policy ○ - sometimes enhanced by 2FA/MFA ■ - user experience (drivers, special device, recovery, …) ■ - no real standardization (beyond basic auth and few others …) ● PKI based x509 authentication ○ - application support ○ - user experience (nor users, nor developers understands the technology well enough) ○ - key/cert provisioning vs multiple devices ● SSOs / Federations ○ User-centric (mojeid, facebook, …) / Organization-centric (eduid, …) ○ Works, but creates a single point of failure And here comes a new kid to the block ..
    [Show full text]
  • BIG-IP Access Policy Management Operations Guide
    BIG-IP Access Policy Management Operations Guide Comprehensive Global Access Anytime, Anywhere With BIG-IP Access Policy Manager (APM), your network, cloud, and applications are secure. BIG-IP APM provides valuable insight into who is on your network or cloud, which applications they’re accessing, with which devices, from where, and when. A message from Julian Eames, Executive Vice President, F5 Business Operations Welcome to the F5 Operations Guide series. Our series of operations guides address real-world scenarios and challenges. The content was written by the engineers who design, build, and support our products, as well as other F5 professionals—some former customers worked in the field and have firsthand experience. While no document can anticipate every question or situation, F5 endeavors to provide a better understanding of your BIG-IP system and offer tools needed to address common issues and conditions. In this guide you’ll find recommendations, practices, and troubleshooting tips to keep your F5 products running at peak efficiency and elements that may be incorporated into your own run books. F5 is pleased to offer industry-leading products and services, including world-class support and welcome your suggestions and feedback. Let us know how we can better serve you. —Julian Eames i Contents Acknowledgments 1 About this guide 2 Before using this guide 2 Limits of this guide 2 Glossary 3 Customization 3 Issue escalation 3 Feedback and notifications 4 Document conventions 4 Change list 6 Introduction 7 BIG-IP APM features 7 Client
    [Show full text]