IT Security Policy Management Usage Patterns Using IBM Tivoli Security Policy Manager
Total Page:16
File Type:pdf, Size:1020Kb
Front cover IBM® Tivoli® IT Security Policy Management Usage Patterns Using IBM Tivoli Security Policy Manager End-to-end security policy management for IT infrastructures IBM Tivoli Security Policy Manager architecture overview Solution patterns and deployment considerations Axel Buecker Scott Andrews Craig Forster Nicholas Harlow Ming Lu Sridhar Muppidi Trevor Norvill Philip Nye Günter Waller Eric T. White ibm.com/redbooks International Technical Support Organization IT Security Policy Management Usage Patterns Using IBM Tivoli Security Policy Manager October 2011 SG24-7880-00 Note: Before using this information and the product it supports, read the information in “Notices” on page ix. First Edition (October 2011) This edition applies to Version 7.1 of IBM Tivoli Security Policy Manager. © Copyright International Business Machines Corporation 2011. All rights reserved. Note to U.S. Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents Notices . ix Trademarks . x Preface . xi The team who wrote this book . xii Now you can become a published author, too! . xv Comments welcome. xv Stay connected to IBM Redbooks . xvi Part 1. Business context . 1 Chapter 1. Business drivers and foundation for IT security policy management . 3 1.1 Drivers that influence security . 4 1.1.1 Business drivers that influence security . 5 1.1.2 IT drivers that influence security . 7 1.2 IBM Security Framework . 10 1.2.1 Security Governance, Risk Management, and Compliance model. 12 1.2.2 People and Identity domain. 13 1.3 IBM Security Blueprint. 14 1.4 SOA governance . 17 1.4.1 SOA adoption: Impact on business and security . 18 1.4.2 Relating SOA governance to other business drivers . 18 1.5 Identity and access management governance . 20 1.5.1 Critical data: Ensuring authorized access only when needed. 20 1.5.2 Driving operational efficiency through automation . 21 1.5.3 Enforcing consistent policy enforcement across the IT environment 21 1.6 Compliance management . 22 1.6.1 Regulation and privacy concerns . 22 1.6.2 Assessing compliance: The audit trail. 23 1.6.3 Relating compliance management and governance . 24 1.7 Data and information security . 25 1.7.1 Risk of unauthorized access and data loss. 25 1.7.2 Context-based information access . 26 1.7.3 Data security in cloud and SOA environments . 27 1.8 IT security policy management: A unifying solution . 28 1.8.1 Addressing governance . 29 1.8.2 Compliance and data security. 30 1.8.3 Risk management and the cost containment . 31 © Copyright IBM Corp. 2011. All rights reserved. iii 1.9 Introduction to IT security policy life cycle management . 32 1.9.1 Policy authoring. 34 1.9.2 Transform . 38 1.9.3 Enforcement . 39 1.9.4 Monitor . 39 1.10 Conclusion. 40 Chapter 2. Architecture patterns for externalizing security from applications and services . 41 2.1 Intermediary approach . 43 2.1.1 Customer example . 44 2.1.2 Integrating policy at the intermediary level . 44 2.2 Container level approach . 47 2.2.1 Customer example . 48 2.2.2 Integrating policy at the container level. 49 2.3 Database level approach. 51 2.3.1 Customer example . 52 2.3.2 Integrating policy at the database level. 54 2.4 Application level approach . 56 2.4.1 Customer example . 56 2.4.2 Integrating policy at the application level . 57 2.5 Conclusion. 59 Part 2. Implementing a policy life cycle management solution . 61 Chapter 3. Tivoli Security Policy Manager overview and architecture. 63 3.1 Tivoli Security Policy Manager overview . 64 3.1.1 Tivoli Security Policy Manager components . 64 3.2 Tivoli Security Policy Manager architecture . 69 3.2.1 Logical component architecture . 72 3.2.2 Policy server architecture . 75 3.2.3 Tivoli runtime security service architecture . 78 3.2.4 Policy data model, repository, and exchange . 83 3.2.5 Policy administration and classification. 84 3.2.6 Delegated administrative security . 85 3.2.7 Auditing and reporting . 87 3.3 Example deployment physical architecture . 88 3.4 Conclusion. 91 Chapter 4. Integration with external systems. 93 4.1 Identity management. 94 4.1.1 Integration with identity management . 95 4.1.2 Integration with Tivoli Identity Manager. 96 4.1.3 Integration with other identity management systems . 98 iv IT Security Policy Management Usage Patterns Using IBM Tivoli Security Policy Manager 4.2 Access management. 98 4.2.1 Integration with Tivoli Access Manager for e-business . 100 4.2.2 Integration with other access management systems . 103 4.3 Role management . 103 4.4 User repositories . 104 4.4.1 Integration with Tivoli Directory Server . 104 4.4.2 Integration with Tivoli Directory Integrator. 105 4.4.3 Integration with other user repositories . 109 4.5 Trust services . 110 4.5.1 Integration with Tivoli Federated Identity Manager . 110 4.6 Application repositories . 111 4.6.1 Databases . 111 4.6.2 User registries . 112 4.6.3 Proprietary repositories . 112 4.6.4 Java. 112 4.7 Classification management tools. 113 4.8 Compliance management . 114 4.9 Rules engines . 115 4.10 Conclusion. 116 Part 3. Usage patterns for IT security policy management. 119 Chapter 5. Intermediary level integration . 121 5.1 Concepts and benefits. ..