Security for multichannel.

Over the years lot of keywords have evolved in the security space. One such word that intrigues everyone is multi channel security. What is multichannel security? Well, every vendor has its own take on multi channel security ( mostly skewed to fit the offerings these vendors provide)

I thought it's high time to speak of multichannel security.

Channels

Let's look at channels

1. Web

2. Mobile

Accepted by most...

There is more though.

3. ATMs (in case of banks)

4. Kiosks (in case of governments mostly)

5. Voice (in case of helplines for services like telecom)

.

.

.

Wait... There's more...

What about personal interactions and paper forms???

What about social media which can be from both web and mobile (kaching app in Facebook by commbank)???

What about the good old letters you (still) receive for credit line and mortgages( the ones that still work according to law of the land)???

It's endless...

So basically multichannel is too large a word to use...

Hmm now there is some concern about security...

People who solve the issue on multichannel are predominantly the ones solving the the first 2.

Why???

And why not the other channels???

Simple... They don't figure in the key initiatives in the 21st century. That's play of words.. Or craftsmanship. But the problem is real...

Multi channel is a truth of this century and there is innovation and solutions all over the place to solve this one-word issue. But it is just too large a problem to solve just by point products.

The answer lies in the way technology evolves and consolidates.

It evolves in all directions... And consolidates in one direction...

It evolves in all directions driven by innovation and consolidates in one direction driven by effectiveness...

What is the only commonality from which we can at least guess the effectiveness while we speak? By the way there is only one thing in common to all the channels. That one is the actual person who is interacting.

So how to solve this puzzle?

Identity context or identity in relation to the context of usage.

E.g. Banker selling shares for his

Private client. Identity context could be consent from client and also the bankers qualifications and limits to do so in his bank.

If you are not able to enforce this, this may be a compliance liability or defacement for you.

Customer care extracting credit card details and then planning his vacation. You could limit the visibility of your customer care based on roles. Pure law abiding challenges...

How are you equipped to do this. 

Maybe...

By starting to use a source which can hold this in the first place rather that just depending upon profile (identity 1.0)...

And then...

Secondly by finding a solution that can flag off this problem for you.

This has to gel well with your apps and dev-ops strategy.

No need to worry too much anyways...

Take a deep breath and understand the risk you carry because you lack information in each channel of interaction and then prioritize on capturing and enforcing them.

Products can solve the rest of the jigsaw puzzle. Trust me. This is equivalent to reaching Mars with men...

Capture what is required.

What is required is based on what business you do.

It could be the ones you want to avoid  while doing business, like storing unnecessary information. 

Or, it could be those you could make use of, like providing ease of use for customers, monetizing on what you have (telcos are on a spree these days)

But don't be limited by the ways you can collect it. You could collect it from social media through social login or big data and many more ways. 

You have to see whether you have a platform that can provide you 2 thinks 

1. Decision point

This may well be a central policy repository you can refer to. Just thoughts...

2. Enforcement point

Where this is enforced so that you are not dependent on your yearly report to find you have done according to the policy decision point. You have all the vendors lined up for this...

Pick a solution that works for these 2 scenarios and you are safe for another 5 years 😊

Do comment if you object or want to add on...

Scan IPs, VIPs and Datasources in Weblogic

Recently I was visiting a customer in Korea and there was this interesting topic on when to use Multidatasources in WebLogic and why not use a single Datasource with SCAN IP for the Oracle RAC Cluster behind.

Well there are 2 ways to look at it.

Do you need GRID capabilities of horizontal scaling up and down???  You better go for a single Datasource with SCANIP instead of VIPs

Is your environment sized and future proof in terms of volume(well almost…) and you don’t have more to spend on Databases??? You have the Multidatasource

Off course you need to also see the best practices on the application you are running on WebLogic if they are COTS.

Still there are some advantages:

Weblogic drivers for RAC enabled XA connectivity to Oracle DB is superb and by far the best driver to use.

Weblogic takes care of connection handling and liaising with multiple pools of connections and it is a MAA architecture model

It can do Load Balancing for you!!!

Comments, if you have any…

ObSSOCookie

One of my collegues asked this question that is cookies really secure even if people call it secure cookie??

That gave me some time to think and research... Thought sharing this will help someone...
==============================================================

I am assuming you are asking for 10g since you have asked for obSSOCookie. 11g uses OAMAuthnCookie in the following format: OAMAuthnCookie__

Secure Cookie is what we use…

Normally for a secure cookie to be hacked, you need to have IP Spoofing at a system level and then cookie replay attack. MD5 sum will go for a toss if anyone tampers on the way. It can be even update of timezone in your machine. But remember cookie itself is a compromise between security and convenience. The solution for this to change the cookie everytime. 11g Cookie uses this technique and is issued per webgate and it rotates the entire cookie contents on every request. Cookie itself changes

Excerpts from doc:

http://docs.oracle.com/cd/E12530_01/oam.1014/b32420/v2sso.htm#BJFDEIDF

7.3 Single Sign-On Cookies

The Access System implements single-domain and multi-domain single sign-on through an encrypted cookie called the ObSSOCookie. The WebGate sends the ObSSOCookie to the user's browser upon successful authentication. This cookie can then act as an authentication mechanism for other protected resources that require the same or a lower level of authentication.

When the user requests access to a browser or another resource, the request flows to the Access Server. The user is logged in, and the ObSSOCookie is set. The Access Server generates a session token with a URL that contains the ObSSOCookie. Single sign-on works when the cookie is used for subsequent authorizations in lieu of prompting the user to supply authorization credentials.

When the cookie is generated, part of the cookie is used as an encrypted session token. The encrypted session token contains the following information:

·         The distinguished name (DN) of the authenticated user.

·         The level of the authentication scheme that authenticated the user.

See "About Authentication and Authentication Schemes" for details.

·         The IP address of the client to which the cookie was issued.

·         The time the cookie was originally issued.

·         The time the cookie was last updated.

If the user has not been idle, the cookie is updated at a fixed interval to prevent the session from timing out. The update interval is one-fourth of the length of the idle session timeout parameter. See "Viewing AccessGates" for details.

Unencrypted ObSSOCookie data includes:

·         Cookie expiry time.

·         The domain in which the cookie is valid.

·         An optional flag that determines if the cookie can only be sent using SSL.

7.3.1 Security of the ObSSOCookie

The ObSSOCookie is a secure mechanism for user authentication. When the Access System generates the cookie, an MD-5 hash is taken of the session token. When the ObSSOCookie is used to authenticate a user, the MD-5 hash is compared with the original cookie contents to be sure no one has tampered with the cookie. MD-5 is a one-way hash, so it cannot be unencrypted. The Access Server does the comparison by hashing the session token again and comparing the output with the hash of the token already present in the cookie. If the two hashes do not match, the cookie is corrupt. The system relies on the fact that if someone tampers with the session token, the hashes will not match.

The single sign-on cookie does not contain user credentials such as user name and password.

What are the main causes for IDM project failures???

10 years in Identity Management and SSO, so I thought I should voice my perspective from my experience:

• When the group owning and sponsoring IDM does not have a say on policies and infrastructure. This happens more in group of companies where parent organization does not have visibility to infra of group's subsidiary companies. In some cases, a team which is responsible for finance IT will try to implement IDM for the entire group. In such a case, the Finance IT may not have policy authoring relations with CISO or IT security team There is every chance that it will be a failure.
• When you run IDM program as part of a divisional/operational applications deployment program. Running too many programs in one shot as an organization can lead to a lot of chaos. IDM will definitely fail if we try to include it in an implementation which is not focusing on security but on some business automation. The timelines and  project plan often overlooks the complexity IDM brings to the organization and last minute patch ups lead to a lot of overrun and finally the organization does not eliminate the actual pain points addressed by IDM.
• When you don't want to change the KPIs of existing application groups and  IT teams. IDM brings in a sea change in organizations SLA and KPIs. It needs managements agreement on changing people and processes. (like change in job roles of current application administrators, change in SLAs for access requests as now more business users will participate etc....)
• When the management is not sure of IDM implementations depth. You may have a good technical team to create a sophisticated IDM architecture, but Business barely knows about the depth, they just think this is for the admins and not for day to day...
• When IDM like a project of limited time frame. IDM programs are long journeys that organizations have to embark. Organizations need to have patience when it comes to ROI and they should think of limiting the initial scope to achievable micro ROIs or stepping stones for a long implementation which may span 2 to 3 years.
• Participation of applications teams and functional owners not scoped. This could lead to heavy delays and that can lead to an ineffective implementation. A system integrator or consultant can only implement the technical solution. Functional solution normally lies within the organization.

The list does not end here. But I think I covered the most common ones.

Identity NXT...

I am always confused by the term identity as a service. So I thought I will open up a discussion on what it could mean or what it can bring as a change to the current identity ecosystems. Well, look at the current ecosystems...
They are either

Closed - corporate users, partners or customers
Or Open - web 2.0 based week credential sharing for collaboration/blogging community
Or federal - government related (mostly non-web still...)

So Identity can be shared across these ecosystems if we have Identity as a service???

But when I search in the internet for identity as a service, people talk about it with respect to the applications that consume these identities... so, all it might need is a way to interact with the systems in these different types of ecosystems. That is nothing new... it's just about interoperability and common framework. This will eventually lead to more and more specifications. Why are all the leaders in Provisioning and web access management using these words then??? Because they address the larger portion of closed ecosystem... they are happy with doing identity services for the corporates... extending maximum to partners... or to some vendor...

Now what I expected when I began my search for identity as a service was that identity would be a service for organizations, communities like blogs and federal to share identity for the benifit and ease of use for the end user. Like Kim Cameron's famous laws of identity.
It should be acquired by having proper validations... so that the issuer knows that the person applying for it actually exists... (unlike the popular mail providers like google and yahoo, where the person at the other end is not even a person, but a machine :) )

Hmm… I am thinking more in the lines of digital identities again which will lead to another username password in some directory or database… let me stop here…

we can look at actual identities… People acquire it one time and use it till expiry. passports... ration cards... PAN Cards... The beauty of real world identity is that you choose which identity to use... You may want passport to be your age proof, but would want to show address proof from only your driver's license ...

How do we mimic this in the e-world? Where do we start identity creation? If you see off late people are resorting to aspects like national skills registry for validation of your work experience... (Strictly India)... I think registries like that is where the core is when it comes to practicality....

Or let us look at one more aspect... this is very much in lines with Mr. Nilekani's UID thoughts, look at the subscriber base for mobile phones... can't they be tapped as a user base for mobile is becoming essence of your existence in the world these days... What do we need in this case? There are PINs available for mobile SIM Cards... is there a way to tap into this as a credential? A framework through which you can ask a user to use his mobile number and PIN to authenticate.

Ofcourse, this will be a simple authentication, first factor may be...

Club it with your banking credentials as a second factor. Internet banking gateways maybe exposing some methods in future to just do authentication using web services??? You are covering some good number of the worldwide netizens in this case too... and since bank will always try to have the safest way of transacting, it is surely a very strong Second level authentication...

Now for the usage of the acquired identity...

User should be able to use the identity according to his own choices... like not showing passport to get a satellite tv connection... you flash your driver's license then... so maybe a user should be given a choice on what credential he would need to use...

Same factors that I discussed above... telecom PINs for a week authentication... banking for a stronger credential... it could be you’re verified by visa... hmm... too much of pondering...

How IDAM can help group companies

Group companies environment
These are organizations which work in a structure where there is a central corporate parent company and lot of subsudiaries running as individual companies. While a lot of infrastructure is shared between these entities, a lot of people and ragulations related disconnected can be observed in such places. I have been involved in a lot of infrastructure companies offlate. Some of my thoughts around it as as follows:

Typical challenges in a group-of-companies environment
The organizations which work in a group companies face the following typical identity related challenges. I am trying to list down some of the challenges it has seen in different customers which follow similar governance model.
•Lack of centralized risk framework: The risk framework is evolved as per individual needs of the companies contributing to the group.
•Disparate technology environment: The technology and products chosen by different groups are controlled by businesses rather than the corporate structure. This is more of a requirement than a challenge as the companies need independence in software and infrastructure selection due to the technology dependence on the businesses they carry out.
•Different regulatory adherences for different groups due to law of the land: When ISO 20007 is a requirement for some of the operations, some may mandate SOX compliance and some other business may need to adhere to other regional regulatory or compliance norms depending on the region of operation or line of business like JSOX for Japan or HIPAA for medical business.
•Need to quickly respond to identity related needs: The identity needs may vary from new organization creation and designation of a new company and bulk transfer of employees from one unit to another due to reorganizations.

An Identity Services Approach
Based on the above mentioned challenges and the trends of identity management products, Let us try to look at an approach in which the IDAM solution can be showcased as a service for all group companies. I am trying to explain the approach in 3 different angles, which are:
•Governance approach
•Operational approach
•Technology approach

IDAM Governance Approach - A framework structure to follow
The IDAM Governance approach calls for mandatory participation from Business level Auditors/Owners, Centralized IT Security / risk management team and corporate applications like HRMS applications. This aids the risk and governance structure by providing the right controls to the overall governance structure. It aids the Business owners and auditors to get better visibility to their environment by providing reports and attestation/certification of access levels on a scheduled basis. The IDAM system also provides corporate applications like HRMS with a single point of integration to accesses. The following governance structure relates to the above mentioned points.


IDAM Operational approach - A plan to capture your CAPEX and OPEX flow on IDAM
The IDAM Operational approach defines the different operational priorities that should be followed during implementation. The implementation should be service centric and IDAM should be first implemented for corporate and one business unit after which the base framework will be ready for showcasing the benefits of IDAM processes and policies. It also gives the comfort for new business to embark into integration with the corporate IDAM model. The centralized infrastructure can be reused for all the businesses or group companies with integration spanning from physical security to application privileges. Additionally IDAM aids in rolling out new and centralized initiatives like DRM, DLP and privileged user management or data centre security aspects like server access control and database security.

IDAM Technology approach – Basic Identity Framework
Ideally, from a technology perspective, IDAM as a deployment should have the following:
• Self Service for users like password resets, access requests etc
• Management capabilities to administrators
• Approval and workflow based user access provisioning for better ownership
• Reports and audit procedures for better visibility and control
• Access Management controls for web applications and non-web applications
The below diagram explains the different interfacing capabilities that should be present in a typical IDAM Technology stack.

A basic IDAM system should have authentication for all applications for control. It should have self service interfaces and SSO for user experience. It should have delegated administration for manageability and audit / attestation facilities for gaining visibility. The IDAM System should allow workflows and identity synchronization extensively. It should interface with different applications and should have a secure identity store and an accessible audit store.

Oracle IDM Versus Sun IDM

As we all would have already read in the newspapers, Oracle is taking over Sun and the fate of technology offerings from both sides in different areas of direct competition needs to be seen in the days to come. I am, being in the Identity Management industry, particularly curious of the way forward on the offerings that Oracle and Sun have in the IDAM Space.

I am just opening a frank discussion on what will look good if they were to go with only one offering in IDAM space.
Let us look at Oracle. Oracle IDAM is in the leaders quadrant and has been termed the market’s most comprehensive stack. The products are:
• Directory Server - Oracle Internet Directory. Probable not the best in class
• Identity Virtualization - Oracle Virtual Directory. Strong and time tested product right from the times of OctetString.
• Web Access Management - Oracle Access Manager – Strong track record again. Focus on interoperability and scalability.
• Identity Lifecycle Management – Oracle Identity Manager. Once Thor’s best in breed product Xellerate. Supports a host of connectors. Time to Production is still a little high.
• Role and Entitlement Management – Oracle Role Manager and Oracle Entitlement Manager. One from BridgeStream and one from BEA. BEA Entitlement server is a very unique offering in J2EE and SOA Entitlements. BridgeStream is also a market leader, but a tough-to-deploy product.
• Enterprise Single Sign-on – Oracle ESSO – OEM with Passlogix. You know there are only a few. Everywhere you see, it is either actividentity, passlogix or CA.
• Other offerings: Fraud Management – Oracle Adaptive Access Manager, Federation - Oracle Identity Federation, WS-* - Oracle Web Service Manager.

Now let us look at Sun’s IDAM Offerings. They are also the Market leaders according to Gartner…
• Directory Server - SunOne Directory. Best in Breed Directory Server. Heavily deployed and highly scalable.
• Identity Virtualization – Directory proxy and Directory synchronization. Well… not very impressive.
• Web Access Management - Sun OpenSSO (which is a licensed version) and it’s open source version, OpenSSO – Not a very strong product. But emphasis on Open source and features like federation/WS-* capabilities built on to access management itself can be of great advantage.
• Identity Lifecycle Management – Sun Identity Manager. Once Waveset. Largely deployed around the world. This is by far the best IDM product that has cruised on earth.
• Role and Entitlement Management – Vaayu RBACx and Sun Identity Compliance Manager. Strong Market presence for role engineering and management through Vaayu.
• Enterprise Single Sign-on – Partnership with ActivIdentity and Passlogix.
• Other offerings: SoD - Sun Identity Compliance Manager, Open source - initiatives like OpenSSO and OpenPTK.

From what we have seen above, some possible directions that Oracle may pursue could be:
Elimination of OID from Directory Space.
Sun Identity Manager being the roadmap for all OIM deployments.
Key web access management tool to be Oracle Access Manager and extended support for federation and WS-* through Sun OpenSSO
OviD will be the Virtual Directory solution of future from the new Oracle.

What needs to be seen are the developments on areas like Role Management, SoD and SOA/WS/integration layer security.
Let us hope that Oracle can pursue all the Open source initiatives that Sun has been spearheading.

Now if we were to form a consolidated suite of IDAM products, my ideal list would be:

• Directory Server - SunOne Directory. Best in class.
• Identity Virtualization – Oracle Virtual Directory. The impressive OctetString.
• Web Access Management - Oracle Access Manager and Oracle Identity Federation/OpenSSO for options like federation. And OpenSSO in the open source space again.
• Identity Lifecycle Management – Sun Identity Manager. True winner!!!
• Entitlement Management – Vaayu RBACx, Really Really strong.
• Role Management – Vaayu RBACx. Again...
• Enterprise Single Sign-on – Passlogix OEM.
• Other offerings: Oracle products.
• Open Source toolkits – OpenSSO and OpenPTK


Note: These are just my views and you are always welcome to comment!!!

ILM "2" Overview

ILM "2" Overview: "ILM '2' builds on the metadirectory, certificate and smart card management and user provisioning available in ILM 2007, and adds a rich management environment including integrated user management, self-service for comprehensive credential management, group management, policy management, and expanded extensibility and connectivity. ILM “2” feature investments is categorized into four areas:
•Policy Management: ILM “2” delivers a framework for identity management automation and integration so all enterprise systems run using the same set of enterprise policies
•Credential Management. With ILM '2' organizations can manage multiple credentials in an integrated manner, using self-service tools that are available through the Windows logon environment for ease of discoverability and use.
•User Management. One of the most important things Microsoft is delivering from a business standpoint is automated, codeless, user provisioning. ILM '2' delivers tools for integrated user management and self-service across enterprise applications without the costly coding of business rules or recoding of the target systems.
•Group Management. ILM ”2” provides powerful capabilities out of the box that help increase the productivity of end users, frees up IT from repetitive tasks and provide better security and compliance outcomes."

Risk Based Authentication

Risk Based Authentication??? What!!!
The concept of risk-based authentication is becoming the key word in identity management nowadays.Especially when you talk about big budget implementations of Customer facing Banking Solutions dealing with online business-to-consumer transactions.
What is Risk-Based Authentication?
Risk-based authentication (RBA) involves two key ideas: device profiling and behavioral analytics. It is about the automatic profiling of information associated with the way you normally login to an online application, such as your IP address, your computer’s operating system, browser version, your usual times of login, time zone etc. RBA works by referring to your stored profile each time you log in and, if there are variances, a risk level will be registered and you will be required to answer a security challenge question that only you know the answer to.

OK, How can it help you get better security to your application?
Risk-based authentication detects any abnormal login activity, such as a change in IP address or change in browser version. Abnormal login activity prompts you to answer a personal security question that only you know the answer to. RBA provides an additional layer of security to validate the identity of users trying to login to the application.

Let's take a case and see how this works. Let's assume that a bank is using RBA. It gathers a basic profile of the computer the customer typically uses to do online banking, learning things like the machine's MAC address and settings over the number of accesses you have made on it's website. The bank also tracks and begins to understand a your normal pattern of behavior, such as when he might typically log on or the types of transactions you usually conduct. Should you deviate from normal behavior -- perhaps by logging on from a different machine in a different country or attempting to transfer an unusually large sum of money -- the session would get a higher risk score, which could trigger the need for an additional form of authentication. This might mean that you have to answer a challenge-response question or that the bank will want to authenticate the user by phone.

In short, it is simply sequential, or matrix-based, authentication. But risk-based authentication can face a lot of user level dislike over things, such as the fact that spouses often access shared accounts on different computers and travelers occasionally log on from unexpected locations. Anyway, there is a long way to go for RBA... Just like my blogf in here... :) sorry for no posts till now...

Welcome to my Identity Management Blog

Hi All,

I welcome you to my Blog for Identity Management. Through this I wish to communicate to you about my ideas about Identity Management.