Presentatie van Maurice Luizink van Oracle over Oracle's Identity Management oplossingen tijdens het AMIS Simplified Security seminar op 18 juni 2015.

1. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle Security Inside Out
Iden?ty & Access Management Overview
Maurice Luizink (maurice.luizink@oracle.com)
Principal Solu?on Architect IDM
1

3. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Safe Harbor Statement
The following is intended to outline our general product direc?on. It is intended for
informa?on purposes only, and may not be incorporated into any contract. It is not a
commitment to deliver any material, code, or func?onality, and should not be relied upon
in making purchasing decisions. The development, release, and ?ming of any features or
func?onality described for Oracle’s products remains at the sole discre?on of Oracle.
3

4. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle Market Trends

5. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Accelerated Pace of Change
Rapidly Evolving Opportuni7es in Business and Society
80% OF USER
ACCESS
WILL BE MOBILE
BY 2020
44% OF
ORGANIZATIONS
PLAN TO SOCIAL
ENABLE
APPLICATIONS
CLOUD
COMPUTING
WILL BECOME
THE BULK OF
NEW IT SPEND
BY 2016
THERE WILL BE
26 BILLION
CONNECTED
DEVICES
BY 2020

6. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Accelerated Applica?on Prolifera?on
Unique Iden7ty Requirements for Each Pla?orm
Mobile
Apps
Cloud
Apps
Enterprise
Apps

7. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Challenges of the New Digital Economy
• More applica?ons to onboard and
manage
• Outdated Request & Fulfillment
processes
• Limited visibility across Enterprise,
Mobile & Cloud applica?ons
• Manual access cer?fica?on processes
• Delays revoking unauthorized access
Enabling Users and Maintaining Access Controls – Iden7ty Governance

8. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Requirements for the New Digital Economy
• Business Friendly Access Request &
Approval Interfaces
• Scalable & Flexible Access
Cer?fica?on
• Automated Provisioning & Closed
Loop Remedia?on
• Management of standard and
privileged user accounts
• Common Connector Framework
Unified Iden7ty Governance

9. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle IAM por]olio

10. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | 10
Mobile
Security
Iden7ty
Governance
Directory
Services
Access
Management
Encryp7on
& Redac7on
Privileged
User Control
Key
Management
Ac7vity
Monitoring
Configura7on
Management
Database
Firewall
SECURING ACCESS TO APPS & DATA
IDENTITY MANAGEMENT DATABASE SECURITY

11. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Mobile Security
– Mobile Applica?on Management
– Mobile Device Management
– Mobile Access Management
– API Security
– Mobile Authen?cator
Iden7ty Governance
– Access Request
– Access Governance
– Automated Provisioning
– Privileged Account Management
Access Management
– Authen?ca?on
– Authoriza?on
– Audit
– Federa?on
Directory Services
– Enterprise Directory
– Cloud/Mobile App Directory
– Virtual Directory
Oracle Iden?ty Management

12. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle Iden?ty Management 11gR2 PS3 – Highlights
• Mobile Security
– Supports corporate-owned devices using Mobile Device Management (MDM)
– Integrates with exis?ng Iden?ty Management solu?ons for simplified opera?ons
and ?ghter security
• Iden7ty Governance
– Converged role management, SoD, and closed-loop remedia?on
– Windows session recording for privileged accounts
– Simplified and intelligent self-service and access request
• Other Key Improvements
– Con?nued suite simplifica?on via automated patching and upgrades
– Mobile Authen?cator enhanced to allow PIN-less 2-factor authen?ca?on
– Convergence of virtualiza?on into Oracle Unified Directory (OUD)

13. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle Mobile Security
Secure Corp Data. Op7mize User Experience
13
• Mobile App Management
• Strong authen?ca?on
• Security for na?ve apps
• Integrated authen?ca?on
and access
• BYOD with corporate
policies

14. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle’s Mobile Security Strategy
Comprehensive Enterprise Mobility Management
14
• Secure Container
• Application Management
• Device Management
• Content Management
• Web and Native App SSO
• Enterprise App Store
• Productivity Apps
• Unified Self-Service Console
Secure Device & Data Simplify User Experience Restore Control
• Governance & Compliance
• Strong Authentication
• API Security
• Unified Delegated Admin
Console

15. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Unified Mobile Security
Features
Manage corporate data, not
devices
MDM is not a pre-requisite
for BYOD
Secure Communica7on
Channel obviates VPN
Re-use & extend corporate
Iden7ty, user, roles, policies
ISV friendly, no recoding and
redeployment of apps
Higher security, no cached
creden7als
15

16. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle Mobile Security Suite
Secure Corp Data. Op7mize User Experience
16
• Mobile Iden?ty
• App Isola?on
• App Management
• Secure Access
• MDM
• Containerized apps

17. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle Mobile Security Suite 11gR2 PS3 – New Features
• Mobile Device Management
• Integrated Administra?on & Self-Service with OAM & OIM
• Risk Based Step-up authen?ca?on
• Support for Android 5 incl. secure storage using NDK API
• Support for kiosk mode
• Support for addi?onal LDAP directories

18. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle Secure Mobility
Secure BOTH consumer and containerized apps
Corporate DMZ Corporate Network
HTTP/REST/SOAP/OAUTH
SOAP/REST and Legacy
Web Services
Oracle Mobile
Access Server
Oracle API
Gateway
Corporate
Resources
Oracle IDM Stack
Oracle Mobile
Security
Manager
Oracle
Identity
Governance
Oracle Access
Management
Unified
Registry

19. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
API Management and Security
• Extend Access
Management to REST APIs
• Context aware
• Authen?ca?on
• Authoriza?on
• Fraud detec?on
• Security tokens
• Data redac?on
• Audit
19
Secure mobile access to corporate informa7on
Transforma7on
API Control &
Governance
API Management
& Monitoring
Threat
Protec7on
Secure
REST API’s
OAUTH 2.0
Client & Server
Client
Thro[ling
Native JSON & XML
Processing
< XML >
{“JSON”}
API Key
Management
OracleAccessManagement

20. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | 20
Fine grained authoriza7on for Mobile Apps
Exposing Secure APIs
/customer/get
/customer/update
/customer/delete
Customer Service REST API
Request
“User”: Bob Doe
“Org”: Acme Corp
“Grade” : Marketing Manager
“Customer”:
“ID”: 12345

21. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
/customer/get
/customer/update
/customer/delete
Customer Service REST API
Request
21
Fine grained authoriza7on for Mobile Apps
Exposing Secure APIs
API Gateway
En7tlements Server
PEP
PDP
isAuthorized(user = Bob Doe,
userOrg = Acme Corp
userRole = Marketing Manager
resource = Customer Service
action = /customer/get
customerID = 12345)

22. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
/customer/get
/customer/update
/customer/delete
Customer Service REST API
Request
22
Fine grained authoriza7on for Mobile Apps
Exposing Secure APIs
API Gateway
En7tlements Server
PEP
PDP
isAuthorized(user = Bob Doe,
userOrg = Acme Corp
userRole = Marketing Manager
resource = Customer Service
action = /customer/get
customerID = 99999)

23. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Fine grained authoriza7on for Mobile Apps
Exposing Secure APIs
/customer/get
/customer/update
/customer/delete
Customer Service REST API
Response
“Customer”:
“ID”: 99999
“Name”: Sally Smith
“Phone”: 01323 232125
“NI”: AB 12 34 56 B
“CreditCard”: 1122 3344 5566
“Purchase History”: …

24. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Fine grained authoriza7on for Mobile Apps
Exposing Secure APIs
/customer/get
/customer/update
/customer/delete
Customer Service REST API
Response
API Gateway
En7tlements Server
PEP
PDP
isAuthorized(user = Bob Doe,
userOrg = Acme Corp
userRole = Marketing Manager
resource = Customer Service
action = /customer/get
customerID = 99999)
“Customer”:
“ID”: 99999
“Name”: Sally Smith
“Phone”: 01323 232125
“NI”: @^*%&@$#%!
“CreditCard”: **** **** 5566
“Purchase History”: …

25. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle Iden?ty Governance
Unified Approach to Complete Iden7ty Governance
• Iden?ty Administra?on
• Access Provisioning
• Role Life Cycle Management
• Access Request Management
• Access Cer?fica?on
• Iden?ty Audit / SoD
• Audit and Repor?ng
• Connector Framework
• Privileged Account Management
25

26. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle Iden?ty Governance
Transla7ng business Needs to Repeatable Processes
Business-Friendly
Request Catalog
Streamlined Business
Process for Approvals
Intelligent and Flexible
Cer7fica7on
Scalable and Rapid
Fulfillment
Modular and Pluggable
Architecture
Privileged Access and Audit
26

27. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Key focus areas for PS3
Simplified Iden7ty Governance
27
• Clean UI with a Cloud look and feel, with
faster performance
• End-users get easy access to business
func?ons without requiring
customiza?on
• Collabora?ve cer?fica?on process
• Intelligent Access Catalog

28. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle Iden?ty Governance 11gR2 PS3 – New Features
• Business Friendly Interfaces & Intelligent Catalog
• Comprehensive Role Management & Con?nuous Compliance
• SOD Detec?on & Closed Loop Remedia?on
• Iden?ty Services for Mobile & Extranet (REST API - SCIM 2.0)
• Enhanced Privileged Access
• Enhanced Audi?ng (synchronous)
• Temporal grants for new and exis?ng access

29. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Iden?ty Administra?on
• Self Service
– Self Registra?on, Self profile management
– Self Password management – Reset/Forgot Password, Challenge Ques?ons
• User Management
– User Life Cycle Mgt, Delegated Administra?on, Proxy User
– Configurable policies for UserName and Password genera?on
• Password Policy
– Global
– Organiza?on Scoped
• Support for REST, SPML and Remote APIs
• Orchestra?on engine for extensibility – Plug-in and Event Handlers
Oracle Solu7on

30. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Access Provisioning
• Provisioning framework and data model for modeling target applica?ons
• Role Based Access Controls
• Iden?ty Connectors
• Reconcilia?on
• Disconnected Applica?on Framework
Oracle Solu7on

31. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Access Provisioning
• Common Connectors for all
Governance needs
• Supports mul?ple target versions
and mul?ple instances of a target
simultaneously
• Flexible deployment op?ons –
local and remote deployment
• Extensible – Administrators can
extend the capabili?es without coding
• Connector for Web Services
Identity
Connector
Framework
Access
Request
Access
Certification
Privileged
Access
Identity
Connectors
Cloud Applications
Enterprise Applications
Directories
Databases
Custom Applications
and Mainframes
P
R
O
V
I
S
I
O
N
I
N
G
E
N
G
I
N
E
SOD
Evaluation
Iden7ty Connectors

32. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
• Control and provide informa?on for
ac?vi?es, such as:
• Crea7on of roles.
• Modifica7on of role a[ributes.
• Modifica7on of role members.
• Dele7on of roles.
• Business users can request crea?on of
new roles and changes to exis?ng ones
• Role requests can leverage the same
request and approval framework
available for Access Requests and
Cer?fica?on
• Role owners can see comprehensive
audi?ng and prior versions
Role Life Cycle Management
Oracle Solu7on

33. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
• Comprehensive role analy?cs allows
business users to see the impact of new
roles and changes to exis?ng ones
• Role owners can reduce role explosion by
review the effec?veness of the roles and
consolidate new roles with exis?ng ones
• Business users can create roles using
“model users”
Comprehensive management func7onality
Role Life Cycle Management

34. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Access Request Management
• Access Catalog provides ability to browse
and search
• Smart search forms allow users to
navigate the Catalog in a guided manner
• Catalog search results indicate relevance
• Access Catalog can recommend access
based on pre-defined and user-defined
criteria
• Support for Start/End Dates for Access
Grants
• Preventa?ve SoD Analysis
Intelligent Access Catalog

35. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Access Request Management
• Administrators can define custom
security roles to control who can do
what at an aoribute level
• Users can be assigned security roles
via rules reducing administra?on
burden
• User ac?ons and the context that they
used to perform the ac?on are
audited
• SOA based approval workflow
Simplified yet granular security

36. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
• Configurable risk defini7on and periodic risk aggrega7on
• Four Types of Iden?ty Cer?fica?on (User, Role, App Instance, En?tlement).
• Schedule, monitor, delegate and audit cer7fica7ons
• Online and offline user cer?fica?on
• Mul7 Phased Review
• Closed-loop remedia7on
• Generate user/applica?on cer?fica?ons
• Generate cer?fica?on reports
Oracle Solu7on
Access Cer?fica?on
Access Certification
JDOE Accounts Payable
JDOE Accounts Receivable

37. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
• SOD Rule and Policy Defini?on
• Define rules across users, applica?ons, roles and
en?tlements
• Detec?ve SOD Analysis
• Detec?ve Policy Enforcement – Closed Loop
Remedia?on
• Access History to audit all viola?ons and
decisions
• Review High Risk policy viola?ons in
Cer?fica?ons
• Preventa?ve SOD Analysis
• Enforce SOD policies during access requests
• Review policy viola?ons during approvals and
launch excep?on workflows
Oracle Solu7on
Iden?ty Audit / Segrega?on of Du?es

38. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle
Identity
Manager
Database
Metadata
Audit/Compliance
BI Publisher
Reads Oracle Identity Manager
database to provide
Identity Management reports
Conducts Identity Management while
saves/audits information
– Embedded BIP, No separate BIP infrastructure required
– New Lightweight Audit Engine
– Supports new entities and processes
Audit and Repor7ng
Iden?ty Audit / Segrega?on of Du?es

39. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
• Ac?onable dashboards for risk
analysis and compliance
• 80+ OOTB reports providing a 360
deg.
view of users’ access
• Flexible deployment op?ons,
including
ability to schedule report runs
• Publicly available schema
Reports and Dashboards
Iden?ty Audit / Segrega?on of Du?es

40. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle Privileged Account Management
40
Control access to high privileged accounts
• Managed targets
• Unix/Linux
• Windows Local Account
• HyperVisor and Network Devices
• SAP
• Scripted Connector (SSH) to speed
up integra?on with network devices
• Session Management
control policies
• Windows (DVR-like) session
recording

41. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle Access Management
Unified Approach to Complete Authen7ca7on, Authoriza7on and Audit
• Web Access Management
• Federated & Social SSO
• Mobile Access Management
• Cloud Access Management
• Authoriza?on Management
• Fraud Preven?on
• Strong Authen?ca?on
41

42. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Unified Access Management
Key Solu7on Requirements
Seamless Mul7-Channel
Access
Access Any Applica7on,
From Any Device, Any Where
Scalable for today’s
Internet Needs
Standards Based Modular
Architecture
Integrated Risk, Fraud
& Strong Authen7ca7on
Increase Agility with
External Security Policies
42

43. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle Access Manager
43
Simplified Converged Complete Access Solu7on
• Single pla]orm to secure on-
premise, Cloud, and mobile access
• Support seamless mul?-channel
access with modern user experience
• Fully Converged Federa?on Solu?on
• Intelligent Context Aware
Authen?ca?on
– Na?ve OTP Via: SMS, Email, Mobile
– Step Up Based on post auth Rule or auth
level
• Seamlessly integrate with Oracle and
third-party enterprise applica?ons

44. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle Access Manager
Cloud Access Portal
• Deliver User Single Sign-on To Cloud
Apps From Launchpad Portal
• Provide Seamless Access From Smart
Phone, Tablet and PC
• Support For Federated and
Unfederated Apps
• Switly Remove Unauthorized Access
44

45. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle Access Manager
• Push no?fica?on and one-buoon
verifica?on
• Support for mul?ple account registra?on
• Custom Branding (modify the app name,
font, icons, etc)
• Integrated into Access Management
• Client app downloaded from corporate
app store
Oracle Mobile Authen7cator

46. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle Access Manager
Integrated Support for OAuth
46
• Enable User To Authorize 3rd Party
Apps to Access and Leverage User Data
• Avoid storing iden?ty data in
unnecessary loca?ons
• Provide Support for both server and
client, 2 and 3 legged, profile services
• Connect support with enterprise
iden?ty management systems

47. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Oracle Directory Services
Scalable, Secure and Performant
• Iden?ty Repository
• Naming Services
• Host Access Control
• Virtual Directory
47

48. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Unified Directory Services
Oracle Differen7ators
Published performance
benchmarks
Op7mized for Cloud
and Mobile
Integrated virtualiza7on
Support for an7quated
Iden7ty stores
Iden7ty Isola7on from
transac7onal data
Internet Scale for billion
Iden77es
48

49. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
OUD
Virtualiza7on Storage Synchroniza7on
Cloud Apps
Databases
Enterprise Apps Servers
Mobile Apps
HR DB DSEE
Ac7ve
Directory
OUD – The All in One Directory
49
• Storage,
virtualiza?on and
Sync
• High performance
• Extreme scalability
• REST support

50. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Licensing Iden?ty & Access Management Solu?ons
• Models
– Employee and Non-Employee
– CPU and NUP
• Iden?ty & Access Management Licensing Guide
– hop://docs.oracle.com/cd/E55108_01/doc.1213/e56762/toc.htm
• Products and Suites
– API Gateway
– En?tlements Server Security Module
– Iden?ty Manager Connectors
50

51. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Licensing Iden?ty & Access Management Solu?ons
• Suites
– Iden?ty & Access Management Suite Plus
• Iden?ty Manager, Access Manager, Iden?ty Federa?on, and Directory Services Suite Plus
– Iden?ty Governance Suite
• Iden?ty Manager, Privileged Account Management, Iden?ty Analy?cs, and various Connectors
– Access Management Suite Plus
• Access Manager, Adap?ve Access Manager, En?tlements Server, Iden?ty Federa?on
– Directory Services Suite Plus
• Internet Directory, Unified Directory, Virtual Directory
51

52. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Licensing Iden?ty & Access Management Solu?ons
• Suites
– Mobile Security Suite
– Enterprise Single Sign On Suite Plus
– Enterprise Iden?ty Services Suite
• Directory Services Suite Plus, Iden?ty Governance Suite, Access Management Suite, and Mobile
Security Suite
52

53. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Join the Community
Twioer
twioer.com/OracleIDM
Facebook
facebook.com/OracleIDM
Oracle Blogs
Blogs.oracle.com/OracleIDM
Oracle IdM Website
oracle.com/Iden?ty

54. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
Ques?ons
54

55. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | 55