SlideShare a Scribd company logo

Enterprise Security Architecture: From access to audit

•
•
Bob Rhubart
Bob Rhubart

Paul Andres' presentation from OTN Architect Day in Pasadena, July 9, 2009. Find an OTN Architect Day event near you: http://www.oracle.com/technology/architect/archday.html Interact with Architect Day presenters and participants on Oracle Mix: https://mix.oracle.com/groups/15511

1 of 35
Downloaded 615 times
Enterprise Security Architecture: From access to audit
<Insert Picture Here> Enterprise Security Architecture: From access to audit Paul Andres Director, Enterprise Architecture
Why Security?
Changing Business Climate Challenges Our Customers Face… "In a time of accelerating turbulence, the valuation of a company will be strongly affected by how it executes change."
Today’s IT Challenges More Compliant Business • Increasing regulatory demands • Increasing privacy concerns • Business viability concerns More Agile Business More Secured Business • More accessibility for employees, • Organized crime customers and partners • Identity theft • Higher level of B2B integrations • Intellectual property theft • Faster reaction to changing requirements • Constant global threats
Today’s “New Normal” Users, Systems, Globalization and Compliance Forced Complexity Service Level Compliance & IT Records Anti-Money Anti- Compliance Ethics Programs Governance Retention Laundering Financial Supply Chain Audit Legal Data Privacy Reporting Traceability Management Discovery Compliance Users Finance Suppliers R&D Mfg Sales HR Legal Customers Systems Enterprise Data Database Mainframes Mobile Devices Apps Applications Warehouse Server Globalization EU Patriot Mandates SOX JSOX Directives FDA Basel II HIPAA GLBA Act SB1386 PCI…
The Business Platform The Right Information to the Right People in the Right Format at the Right Time! Unified User Actionable Experience Analytics End-to-End Industry Processes HCM CRM Finance 3rd Party Custom Oracle Applications Non-Oracle Oracle Platform Agile Process Pervasive Business Content Existing Orchestration Intelligence Management Tools & Comprehensive Consistent + Centralized Infrastructure Security Scalable Data Development
Oracle is ‘Information Driven’ • Manage It… • Use It… • Share It… • Protect It…
Security for Apps, Middleware, Data and Infrastructure Comprehensive ‘Defense in Depth’ Approach Applications Automated Controls Automated Controls Monitoring and Configuration Monitoring and Configuration Enterprise Visibility Enterprise Visibility Access to Business Services Access to Business Services Fusion Lower Cost of User Lifecycle Lower Cost of User Lifecycle Middleware Data Protection and Privacy Data Protection and Privacy Database and Infrastructure Unbreakable Linux Unbreakable Linux Copyright © 2008, Oracle and/or its affiliates. All rights reserved. 9
Industry Frameworks
Oracle Enterprise Architecture Framework Methodology Business Architecture Governance Motivation Function Organization Drivers Models Products Mission Finance Reference Goals Strategy Services Roles Architectures Objectives Processes People EA Governance Strategy Applications Architecture Performance Principles Reference Architectures Functional Services Products Standards Risk Strategy General General General Components Security Policy Principles Industry Industry Industry Cost Integrity Business Continuity Capabilities Information Architecture Compliance Reference Architectures Entities Structures Portfolio Requirements Strategy Management Standards Models Design Principles Components Development Structures Data Quality Standards Test SLA’s Production Reference Technology Architecture Architectures Platform Services Products General Services Strategy SOA/ EDA Infrastructure Components Principles Cost Standards Data Management Development Security Management Version 2 (Draft)
Enterprise Architecture Security Model Assess Business Objectives Vulnerability Penetration Testing Assessment Quantitative & Define Risks & Qualitative Risk Risk Analysis Threats Assessment Protection Data Functionality Requirements Classification Evaluation Security System Policy & Legal Liabilities Awareness Reliability Procedures Cost Effective Safeguards Counter Measures Solutions Data Integrity Confidentiality Security Assurance Security Domains Access Control Systems Security Management & Methodology Security Architecture & Operations Security Practices Models Laws, Investigations, & App and Systems Business Continuity & Ethics Development Security Disaster Recovery Telecommunications & Network Security Cryptography Physical Security * CISSP, Shone Harris
TOGAF to Oracle Security Mapping GRC, Security Policy Data Protection & Privacy Access Security Control Management
TOGAF 9
TOGAF 9
TOGAF 9 Capability Framework
Burton Group Security Framework
Oracle Security Solutions
Enterprise Security Reference Architecture
Oracle Security Components Applications E-Business Suite, PeopleSoft, Siebel, Hyperion, JDE SAP, Custom, Legacy Access Identity Web Service Enterprise Manager Identity Manager Federation Manager and Access Identity Manager Management Directory Services Database Vault Audit Vault Data Advanced Label Security Security Security Option Information Rights Management
Oracle’s “Top to Bottom” GRC Strategy Analytics Define Your Policy…Connect to IT Controls…Analyze Your Results! • Real-time Leveraged Output and visibility Compliance Visibility • Pre-Made reports and dashboards Analyze Policy and Controls Map Risks-Policy-Controls Track Policy • By Standard Test & Gather Evidence GRC Manager • By Cycle • By Application Track Issues + Remediate • By Process Connect Policies to Controls • Embedded and Controls Set Control Rules Embedded Identity Access Enterprise- Low-Level Detail App Controls Management Management Wide Controls Configuration Database Information • Oracle and Handle Exceptions Management Controls Rights Mgmt Non-Oracle
Orace Identity Management Components Oracle Role Manager Oracle Identity Manager Enterprise Applications Basic Authentication / Course-Grained Authorization / Audit / User Administration Business Custom Helpdesk Email Portals Apps Apps Employees Customers Suppliers Oracle Access Manager - Identity Oracle Internet (Meta) Directory Oracle Virtual Directory Data and User Stores Directories Databases Operating Systems Oracle Identity Manager Oracle Role Manager
A Typical Environment… Data Tier Presentation Tier Logic (Business) Tier
Identity and Access Challenges Problems • No Ability to Establish User Roles • Manual User Administration (Int + Ext) • No knowledge of “Who has access to what?” • Multiple Sign-Ons + Forgotten Passwords Problems • No Self Service or Password Management • Unstructured Content is not controlled • Access to sensitive DB data is not controlled • Difficult to Manage Environment
Solution: Centralize and Simplify Access SSO En ab led Ap pli cat ion s
Solution: Simplify Access to Multiple Datastores…
Solution: Simplify Employee to Business Partner Login SSO +F ed e rat i on -En ab l ed Ap p s
FMW Security as a Service Oracle 3rd Party Custom Legacy Applications Fusion ISF Aware Developed Applications Applications ISF Aware Business Functions & Middleware Applications Authentication User Authorization Business Business Business Management Federation Functions Functions Functions Legacy Integration Interface Connectors, Agents Oracle IAM Suite with Identity Services Framework Service Interfaces WS-*, SPML, SAML, XACML, CARML Identity Services Authentication Provisioning Identity Provider Audit Authorization Administration Role Provider Federation & Trust Enterprise Identity Management Infrastructure Policy & Orchestration Virtualization & User Store
Fusion Security Architecture OAM Enterprise Authentication Identity Store Federation Services (OIF) (LDAP) Single Sign-On Sign- Identity Provisioning & Authentication Reconciliation Fusion Applications OC4J FIDM Identity Provisioning Identity Administration ADF ATG Account Provisioning JAAS+ Security Account Administration Extensible Security (XS) Enterprise Role Mgmt Account + Role Operational Interaction RDBMS Provisioning & using JDBC Reconciliation LUS (Extensible Security) FIDM Operational Store
Policy-Driven Security & Identity Management Policy-Driven Security & Identity Management portal .NET logic CICS wrap Customers WSM PEP WSM PEP WSM PEP J2EE logic Legacy WSM PEP Trading B2Bi logic Partners TIBX logic App logic WSM PEP WSM PEP CRM WSM PEP B2B Exchanges FRONT OFFICE INTEGRATION SERVICES BACK OFFICE Oracle WSM Oracle Oracle WSM Policy Identity Monitor Manager Services Architects Security Operations
Expose, Secure and Manage Web Services… Auditor Security IT Admin Partner Portal Portals Outsourced Provider AD / Exchange IIS/ASP Apps | Peoplesoft Virtual Access Manager HR Mainframe Web SSO & (RACF /ACF2/TS Directory Environment) Web IdMgt Packaged Applications using Sun or Apache ` Business Users Unix Linux Customers Partners , Vendors Employees Apps w / Portals Web Service Web using Services Web Services Manager
Oracle Database Security Components Enterprise Applications Business Custom Helpdesk Email Portals Apps Apps Database Operational Data DBA / DBA Manager Protect Data Vault Protect Data from in Motion with View and Alteration Select SALARY X Network from users; as well as Insider Encryption using Alter system. X Threat using Alter table.. Advanced Security 5 Database Vault Consolidate Audit Option * Example roles and privs Data & Show Reports Operational using Audit Vault Alter table …. DBA Select SALARY from USERS; Protect User and Sensitive Data LNAME SSN SALARY at Rest by Encrypting Database KING 123-45-6789 $125,000 Columns using SCOTT 987-65-4321 $229,500 Securely Backup Data To Advanced Security Option SMITH 345-67-8912 $ 53,700 Tape with Secure Backup LNAME CREDIT_CARD EXP_DATE KING 1234-5678-9123 04-2010 SCOTT 2345-6789-4321 09-2012 SMITH 9876-5432-1987 01-2011
Securing Database Operational Data DBA / DBA Manager Separation of Vault Duties with the Database… Database Vault Protects Against Select SSN from cust; X Alter system.. X Insider Threats Alter table …. * Example roles and privs Operational Alter table …. DBA KING 18031 KING, 18031, $1,800 5 0 SCOTT 14220 Select ssn from cust; SMITH 17170 ִ Protect Data at Rest Protect Data in Motion Transparently Encrypt with Network Encryption Database Columns with Advance Security Option Advance Security Option Encrypt Backup of KING, 18031, $1,800 Database and Flat Files 5 0 KING 18031 SCOTT 14220 to Tape with SMITH 17170 ִ Consolidate & Report on Audit Data Manage Database IT Admin with Audit Vault Identities / Roles with IT Security Audit Data DBA Manager Warehouse
Other Supporting Slides
Oracle Enterprise Security Identity And Access Management Governance Risk User Management Directory Management Compliance Access Management Platform Security Identity Audit Policy & Process Application Security Management Enterprise Control Data Security Compliance Multi-level Access Control Encryption Analysis & Information Rights DBA Security Monitoring & Alert Reporting Operating System Security Audit Automation Authentication Service User Management

More Related Content

Enterprise Security Architecture: From access to audit

  • 2. <Insert Picture Here> Enterprise Security Architecture: From access to audit Paul Andres Director, Enterprise Architecture
  • 4. Changing Business Climate Challenges Our Customers Face… "In a time of accelerating turbulence, the valuation of a company will be strongly affected by how it executes change."
  • 5. Today’s IT Challenges More Compliant Business • Increasing regulatory demands • Increasing privacy concerns • Business viability concerns More Agile Business More Secured Business • More accessibility for employees, • Organized crime customers and partners • Identity theft • Higher level of B2B integrations • Intellectual property theft • Faster reaction to changing requirements • Constant global threats
  • 6. Today’s “New Normal” Users, Systems, Globalization and Compliance Forced Complexity Service Level Compliance & IT Records Anti-Money Anti- Compliance Ethics Programs Governance Retention Laundering Financial Supply Chain Audit Legal Data Privacy Reporting Traceability Management Discovery Compliance Users Finance Suppliers R&D Mfg Sales HR Legal Customers Systems Enterprise Data Database Mainframes Mobile Devices Apps Applications Warehouse Server Globalization EU Patriot Mandates SOX JSOX Directives FDA Basel II HIPAA GLBA Act SB1386 PCI…
  • 7. The Business Platform The Right Information to the Right People in the Right Format at the Right Time! Unified User Actionable Experience Analytics End-to-End Industry Processes HCM CRM Finance 3rd Party Custom Oracle Applications Non-Oracle Oracle Platform Agile Process Pervasive Business Content Existing Orchestration Intelligence Management Tools & Comprehensive Consistent + Centralized Infrastructure Security Scalable Data Development
  • 8. Oracle is ‘Information Driven’ • Manage It… • Use It… • Share It… • Protect It…
  • 9. Security for Apps, Middleware, Data and Infrastructure Comprehensive ‘Defense in Depth’ Approach Applications Automated Controls Automated Controls Monitoring and Configuration Monitoring and Configuration Enterprise Visibility Enterprise Visibility Access to Business Services Access to Business Services Fusion Lower Cost of User Lifecycle Lower Cost of User Lifecycle Middleware Data Protection and Privacy Data Protection and Privacy Database and Infrastructure Unbreakable Linux Unbreakable Linux Copyright © 2008, Oracle and/or its affiliates. All rights reserved. 9
  • 11. Oracle Enterprise Architecture Framework Methodology Business Architecture Governance Motivation Function Organization Drivers Models Products Mission Finance Reference Goals Strategy Services Roles Architectures Objectives Processes People EA Governance Strategy Applications Architecture Performance Principles Reference Architectures Functional Services Products Standards Risk Strategy General General General Components Security Policy Principles Industry Industry Industry Cost Integrity Business Continuity Capabilities Information Architecture Compliance Reference Architectures Entities Structures Portfolio Requirements Strategy Management Standards Models Design Principles Components Development Structures Data Quality Standards Test SLA’s Production Reference Technology Architecture Architectures Platform Services Products General Services Strategy SOA/ EDA Infrastructure Components Principles Cost Standards Data Management Development Security Management Version 2 (Draft)
  • 12. Enterprise Architecture Security Model Assess Business Objectives Vulnerability Penetration Testing Assessment Quantitative & Define Risks & Qualitative Risk Risk Analysis Threats Assessment Protection Data Functionality Requirements Classification Evaluation Security System Policy & Legal Liabilities Awareness Reliability Procedures Cost Effective Safeguards Counter Measures Solutions Data Integrity Confidentiality Security Assurance Security Domains Access Control Systems Security Management & Methodology Security Architecture & Operations Security Practices Models Laws, Investigations, & App and Systems Business Continuity & Ethics Development Security Disaster Recovery Telecommunications & Network Security Cryptography Physical Security * CISSP, Shone Harris
  • 13. TOGAF to Oracle Security Mapping GRC, Security Policy Data Protection & Privacy Access Security Control Management
  • 16. TOGAF 9 Capability Framework
  • 20. Oracle Security Components Applications E-Business Suite, PeopleSoft, Siebel, Hyperion, JDE SAP, Custom, Legacy Access Identity Web Service Enterprise Manager Identity Manager Federation Manager and Access Identity Manager Management Directory Services Database Vault Audit Vault Data Advanced Label Security Security Security Option Information Rights Management
  • 21. Oracle’s “Top to Bottom” GRC Strategy Analytics Define Your Policy…Connect to IT Controls…Analyze Your Results! • Real-time Leveraged Output and visibility Compliance Visibility • Pre-Made reports and dashboards Analyze Policy and Controls Map Risks-Policy-Controls Track Policy • By Standard Test & Gather Evidence GRC Manager • By Cycle • By Application Track Issues + Remediate • By Process Connect Policies to Controls • Embedded and Controls Set Control Rules Embedded Identity Access Enterprise- Low-Level Detail App Controls Management Management Wide Controls Configuration Database Information • Oracle and Handle Exceptions Management Controls Rights Mgmt Non-Oracle
  • 22. Orace Identity Management Components Oracle Role Manager Oracle Identity Manager Enterprise Applications Basic Authentication / Course-Grained Authorization / Audit / User Administration Business Custom Helpdesk Email Portals Apps Apps Employees Customers Suppliers Oracle Access Manager - Identity Oracle Internet (Meta) Directory Oracle Virtual Directory Data and User Stores Directories Databases Operating Systems Oracle Identity Manager Oracle Role Manager
  • 23. A Typical Environment… Data Tier Presentation Tier Logic (Business) Tier
  • 24. Identity and Access Challenges Problems • No Ability to Establish User Roles • Manual User Administration (Int + Ext) • No knowledge of “Who has access to what?” • Multiple Sign-Ons + Forgotten Passwords Problems • No Self Service or Password Management • Unstructured Content is not controlled • Access to sensitive DB data is not controlled • Difficult to Manage Environment
  • 25. Solution: Centralize and Simplify Access SSO En ab led Ap pli cat ion s
  • 26. Solution: Simplify Access to Multiple Datastores…
  • 27. Solution: Simplify Employee to Business Partner Login SSO +F ed e rat i on -En ab l ed Ap p s
  • 28. FMW Security as a Service Oracle 3rd Party Custom Legacy Applications Fusion ISF Aware Developed Applications Applications ISF Aware Business Functions & Middleware Applications Authentication User Authorization Business Business Business Management Federation Functions Functions Functions Legacy Integration Interface Connectors, Agents Oracle IAM Suite with Identity Services Framework Service Interfaces WS-*, SPML, SAML, XACML, CARML Identity Services Authentication Provisioning Identity Provider Audit Authorization Administration Role Provider Federation & Trust Enterprise Identity Management Infrastructure Policy & Orchestration Virtualization & User Store
  • 29. Fusion Security Architecture OAM Enterprise Authentication Identity Store Federation Services (OIF) (LDAP) Single Sign-On Sign- Identity Provisioning & Authentication Reconciliation Fusion Applications OC4J FIDM Identity Provisioning Identity Administration ADF ATG Account Provisioning JAAS+ Security Account Administration Extensible Security (XS) Enterprise Role Mgmt Account + Role Operational Interaction RDBMS Provisioning & using JDBC Reconciliation LUS (Extensible Security) FIDM Operational Store
  • 30. Policy-Driven Security & Identity Management Policy-Driven Security & Identity Management portal .NET logic CICS wrap Customers WSM PEP WSM PEP WSM PEP J2EE logic Legacy WSM PEP Trading B2Bi logic Partners TIBX logic App logic WSM PEP WSM PEP CRM WSM PEP B2B Exchanges FRONT OFFICE INTEGRATION SERVICES BACK OFFICE Oracle WSM Oracle Oracle WSM Policy Identity Monitor Manager Services Architects Security Operations
  • 31. Expose, Secure and Manage Web Services… Auditor Security IT Admin Partner Portal Portals Outsourced Provider AD / Exchange IIS/ASP Apps | Peoplesoft Virtual Access Manager HR Mainframe Web SSO & (RACF /ACF2/TS Directory Environment) Web IdMgt Packaged Applications using Sun or Apache ` Business Users Unix Linux Customers Partners , Vendors Employees Apps w / Portals Web Service Web using Services Web Services Manager
  • 32. Oracle Database Security Components Enterprise Applications Business Custom Helpdesk Email Portals Apps Apps Database Operational Data DBA / DBA Manager Protect Data Vault Protect Data from in Motion with View and Alteration Select SALARY X Network from users; as well as Insider Encryption using Alter system. X Threat using Alter table.. Advanced Security 5 Database Vault Consolidate Audit Option * Example roles and privs Data & Show Reports Operational using Audit Vault Alter table …. DBA Select SALARY from USERS; Protect User and Sensitive Data LNAME SSN SALARY at Rest by Encrypting Database KING 123-45-6789 $125,000 Columns using SCOTT 987-65-4321 $229,500 Securely Backup Data To Advanced Security Option SMITH 345-67-8912 $ 53,700 Tape with Secure Backup LNAME CREDIT_CARD EXP_DATE KING 1234-5678-9123 04-2010 SCOTT 2345-6789-4321 09-2012 SMITH 9876-5432-1987 01-2011
  • 33. Securing Database Operational Data DBA / DBA Manager Separation of Vault Duties with the Database… Database Vault Protects Against Select SSN from cust; X Alter system.. X Insider Threats Alter table …. * Example roles and privs Operational Alter table …. DBA KING 18031 KING, 18031, $1,800 5 0 SCOTT 14220 Select ssn from cust; SMITH 17170 ִ Protect Data at Rest Protect Data in Motion Transparently Encrypt with Network Encryption Database Columns with Advance Security Option Advance Security Option Encrypt Backup of KING, 18031, $1,800 Database and Flat Files 5 0 KING 18031 SCOTT 14220 to Tape with SMITH 17170 ִ Consolidate & Report on Audit Data Manage Database IT Admin with Audit Vault Identities / Roles with IT Security Audit Data DBA Manager Warehouse
  • 35. Oracle Enterprise Security Identity And Access Management Governance Risk User Management Directory Management Compliance Access Management Platform Security Identity Audit Policy & Process Application Security Management Enterprise Control Data Security Compliance Multi-level Access Control Encryption Analysis & Information Rights DBA Security Monitoring & Alert Reporting Operating System Security Audit Automation Authentication Service User Management