Welcome!

SOA & WOA Authors: Jason Bloomberg, Carmen Gonzalez, Lori MacVittie, Trevor Parsons, Keith Cawley

Related Topics: Cloud Expo, SOA & WOA, Open Source, Security, Big Data Journal, SDN Journal

Cloud Expo: Article

Consolidating the Variables: Augment Existing Identity Management Systems

Using cloud security to expand on-premise investments

The modern enterprise is a fluid entity. As an IT construct it expands and contracts (sometimes simultaneously), and many of the moving parts (like users and applications) are themselves evolving and changing. This creates unique challenges in operational efficiencies, core competency support, compliance observance and risk management.  The central theme to all these challenges is establishing and maintaining control of applications which serve as gateways to all the valuable data (personal, trade secrets and other IP) on which an enterprise exists. Many companies have turned to an identity management solution which administrate and validate the digital identities of authorized users.

This is not a new concept, nor is it a foreign practice to many established enterprises. Identity management combined with controlled and channeled access is a recognized best practice and regulatory compliance necessity. Many companies have invested in some sort of authoritative identity repository and management system.  The rising issue is that in order to keep up with the quickly changing landscape of SaaS, cloud and web –based apps, that investment becomes costlier and the ability to agilely address identity validation and authentication becomes less responsive.

Unless you leverage the cloud to augment existing systems.

Let’s assume an enterprise has made a serious investment in a solution like IBM Tivoli or Oracle Identity Manager.  Both products have significant clout and enterprise functionality. It handles the identity creation, rules management, administration and provisioning for many of the legacy and on-premise products and internal systems. It's no secret that these enterprise monoliths are expensive to purchase, deploy and continuously maintain. So, when examining the scope of applications available to users, several are left unsecured because of the cost and resource drain to incorporate them into IDM fold.  Layered on this is the need to authenticate and authorize users outside of an enterprise’s direct control. This includes 3rd party suppliers, vendors and even customers; all who need access to slivers of data contained in specific applications.

The costs to expand the on-premise authentication scope are broader and deeper than simply adding the subscription price of a SaaS solution. There is the licensing of the adapter (or connector) to allow the data of the SaaS to securely flow between the application and the IDM solution via Active Directory (or other repository source). There is support and maintenance (usually 20% of the purchase price paid annually). There are the professional services to install and configure the connectors. There is the cost of development, time-to-market gaps, and the added burden of doing this multiple times for each SaaS and web-based application.

Yet, by deploying a complimentary IDaaS (identity-as-a-service) strategy, all of the above costs, services and deployment difficulties are considerably reduced or eliminated, while still promoting the necessary security gravitas to assert control, streamline workflow and optimize IT resources. As part of the IDaaS arsenal, most of the popular federated connectors are already available out of the box. IDaaS managed from the cloud also extends its scope to those Non-SAML based application (web-based) through an identity gateway. So, no development costs, no additional licenses, and professional services shrink to a minimum. By creating this umbrella over your virtual footprint, the ability to automatically provision and deprovision user accounts extends to these new applications as seamlessly as if they were parked on-premise. Additionally, creating a parallel-yet-integrated identity manager allows for seamless integration with single sign on. This unique cloud-controlled advantage enforces corporate access policy decisions across the enterprise and puts IT back in control of the IT landscape. It eliminates the potential for Shadow IT applications, BYOD abuse and enables better productivity.

The notion is not to reinvent the wheel, but to expand the metaphor, change out the tires for all-terrain use.  If an organization has spent millions to create a viable identity management system, it is unlikely they will abandon the project to put the entire administration and management in the cloud. However, it is prudent to create a cost-effective, enterprise grade equivalent to integrate new applications, multiple data stores and “outside,” users accounts into a secure and controlled environment. In short, it consolidates the variables into a manageable, automated and centralized strategy without incurring additional resources and runaway costs.

Some call this a hybrid strategy. Regardless of the label, a strategy that extends your capability to authenticate, attest and authorize user names, passwords and permissions beyond your firewall will only strengthen you defense against breach, unwanted usage and data leakage from insider threats. In that it can be done with minimal disturbance and without deep pocket spending makes this all the more attractive and practical.

The automations inherent in IDaaS also facilitates stronger compliance…especially when it comes to monitoring the SaaS and web applications. Instead of an infrequent review of logs real time reports can be instantaneously generated to see exactly who accessed what application. But the cornerstone of compliance is to monitor if any changes were made, especially to access protocols (passwords, user names etc…). IDaaS can note in real time when any attribute changes, who made the change and who approved the change. This is a standard compliance audit requirement.

The proliferation of SaaS and web-based applications has changed the security quotient. Leaving these applications partially secured still leaves them partially unsecured. IDaaS allow you to close those vulnerability gaps. Despite best efforts, network perimeters have all but disappeared. All too often, because of multiple data stores and the virtual left hand does not know what the right is doing.

As noted earlier, your IT environment continues to expand and contract. Just consider the lifecycle of the different users that need to access different applications. New hires, promotions, demotions, firings, new partners, new customers, latent customers-- each instance requires some modification to their identity rights.  Does Chuck, who used to be in your accounting department still have his active user credentials? Has Rachel who hasn’t ordered from your site in 3 years had her account retired? How easy would it be for Chuck, Rachel or some nefarious account takeover hacker using their stolen credentials to create significant havoc on your network? It’s a significant task and greater responsibility to find each data store they have been given access and deprovision, However,  IDaaS can turn off or modify any user account instantly-both in the cloud and through on-premise systems through its connection to Active Directory (or LDAP, AS/400, MySQL, Solaris, RedHat, etc…).

Now multiply the above scenario by 500 or 5000 users a day for a modest enterprise when creating users, resetting passwords and permission sets and you begin to recognize the significant advantages and efficiencies a centralized and augmented with the cloud identity rights management and access control system provide. And the larger the organization, the more complex these data islands are to resolve.

Stronger forms of authentication and authorization need to be deployed in response to the growing threats.  Using an IDaaS and SSO combination from the cloud is a proactive step towards consolidating all the variables and cost-effectively strengthening your identity defenses.

Kevin Nikkhoo
www.cloudaccess.com

More Stories By Kevin Nikkhoo

With more than 32 years of experience in information technology, and an extensive and successful entrepreneurial background, Kevin Nikkhoo is the CEO of the dynamic security-as-a-service startup Cloud Access. CloudAccess is at the forefront of the latest evolution of IT asset protection--the cloud.

Kevin holds a Bachelor of Science in Computer Engineering from McGill University, Master of Computer Engineering at California State University, Los Angeles, and an MBA from the University of Southern California with emphasis in entrepreneurial studies.

@ThingsExpo Stories
All major researchers estimate there will be tens of billions devices – computers, smartphones, tablets, and sensors – connected to the Internet by 2020. This number will continue to grow at a rapid pace for the next several decades. With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo in Silicon Valley. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be!
Noted IoT expert and researcher Joseph di Paolantonio (pictured below) has joined the @ThingsExpo faculty. Joseph, who describes himself as an “Independent Thinker” from DataArchon, will speak on the topic of “Smart Grids & Managing Big Utilities.” Over his career, Joseph di Paolantonio has worked in the energy, renewables, aerospace, telecommunications, and information technology industries. His expertise is in data analysis, system engineering, Bayesian statistics, data warehouses, business intelligence, data mining, predictive methods, and very large databases (VLDB). Prior to DataArchon, he served as a VP and Principal Analyst with Constellation Group. He is a member of the Boulder (Colo.) Brain Trust, an organization with a mission “to benefit the Business Intelligence and data management industry by providing pro bono exchange of information between vendors and independent analysts on new trends and technologies and to provide vendors with constructive feedback on their of...
Software AG helps organizations transform into Digital Enterprises, so they can differentiate from competitors and better engage customers, partners and employees. Using the Software AG Suite, companies can close the gap between business and IT to create digital systems of differentiation that drive front-line agility. We offer four on-ramps to the Digital Enterprise: alignment through collaborative process analysis; transformation through portfolio management; agility through process automation and integration; and visibility through intelligent business operations and big data.
There will be 50 billion Internet connected devices by 2020. Today, every manufacturer has a propriety protocol and an app. How do we securely integrate these "things" into our lives and businesses in a way that we can easily control and manage? Even better, how do we integrate these "things" so that they control and manage each other so our lives become more convenient or our businesses become more profitable and/or safe? We have heard that the best interface is no interface. In his session at Internet of @ThingsExpo, Chris Matthieu, Co-Founder & CTO at Octoblu, Inc., will discuss how these devices generate enough data to learn our behaviors and simplify/improve our lives. What if we could connect everything to everything? I'm not only talking about connecting things to things but also systems, cloud services, and people. Add in a little machine learning and artificial intelligence and now we have something interesting...
Last week, while in San Francisco, I used the Uber app and service four times. All four experiences were great, although one of the drivers stopped for 30 seconds and then left as I was walking up to the car. He must have realized I was a blogger. None the less, the next car was just a minute away and I suffered no pain. In this article, my colleague, Ved Sen, Global Head, Advisory Services Social, Mobile and Sensors at Cognizant shares his experiences and insights.
We are reaching the end of the beginning with WebRTC and real systems using this technology have begun to appear. One challenge that faces every WebRTC deployment (in some form or another) is identity management. For example, if you have an existing service – possibly built on a variety of different PaaS/SaaS offerings – and you want to add real-time communications you are faced with a challenge relating to user management, authentication, authorization, and validation. Service providers will want to use their existing identities, but these will have credentials already that are (hopefully) irreversibly encoded. In his session at Internet of @ThingsExpo, Peter Dunkley, Technical Director at Acision, will look at how this identity problem can be solved and discuss ways to use existing web identities for real-time communication.
Can call centers hang up the phones for good? Intuitive Solutions did. WebRTC enabled this contact center provider to eliminate antiquated telephony and desktop phone infrastructure with a pure web-based solution, allowing them to expand beyond brick-and-mortar confines to a home-based agent model. It also ensured scalability and better service for customers, including MUY! Companies, one of the country's largest franchise restaurant companies with 232 Pizza Hut locations. This is one example of WebRTC adoption today, but the potential is limitless when powered by IoT. Attendees will learn real-world benefits of WebRTC and explore future possibilities, as WebRTC and IoT intersect to improve customer service.
From telemedicine to smart cars, digital homes and industrial monitoring, the explosive growth of IoT has created exciting new business opportunities for real time calls and messaging. In his session at Internet of @ThingsExpo, Ivelin Ivanov, CEO and Co-Founder of Telestax, will share some of the new revenue sources that IoT created for Restcomm – the open source telephony platform from Telestax. Ivelin Ivanov is a technology entrepreneur who founded Mobicents, an Open Source VoIP Platform, to help create, deploy, and manage applications integrating voice, video and data. He is the co-founder of TeleStax, an Open Source Cloud Communications company that helps the shift from legacy IN/SS7 telco networks to IP-based cloud comms. An early investor in multiple start-ups, he still finds time to code for his companies and contribute to open source projects.
The Internet of Things (IoT) promises to create new business models as significant as those that were inspired by the Internet and the smartphone 20 and 10 years ago. What business, social and practical implications will this phenomenon bring? That's the subject of "Monetizing the Internet of Things: Perspectives from the Front Lines," an e-book released today and available free of charge from Aria Systems, the leading innovator in recurring revenue management.
The Internet of Things will put IT to its ultimate test by creating infinite new opportunities to digitize products and services, generate and analyze new data to improve customer satisfaction, and discover new ways to gain a competitive advantage across nearly every industry. In order to help corporate business units to capitalize on the rapidly evolving IoT opportunities, IT must stand up to a new set of challenges.
There’s Big Data, then there’s really Big Data from the Internet of Things. IoT is evolving to include many data possibilities like new types of event, log and network data. The volumes are enormous, generating tens of billions of logs per day, which raise data challenges. Early IoT deployments are relying heavily on both the cloud and managed service providers to navigate these challenges. In her session at 6th Big Data Expo®, Hannah Smalltree, Director at Treasure Data, to discuss how IoT, Big Data and deployments are processing massive data volumes from wearables, utilities and other machines.
P2P RTC will impact the landscape of communications, shifting from traditional telephony style communications models to OTT (Over-The-Top) cloud assisted & PaaS (Platform as a Service) communication services. The P2P shift will impact many areas of our lives, from mobile communication, human interactive web services, RTC and telephony infrastructure, user federation, security and privacy implications, business costs, and scalability. In his session at Internet of @ThingsExpo, Erik Lagerway, Co-founder of Hookflash, will walk through the shifting landscape of traditional telephone and voice services to the modern P2P RTC era of OTT cloud assisted services.
While great strides have been made relative to the video aspects of remote collaboration, audio technology has basically stagnated. Typically all audio is mixed to a single monaural stream and emanates from a single point, such as a speakerphone or a speaker associated with a video monitor. This leads to confusion and lack of understanding among participants especially regarding who is actually speaking. Spatial teleconferencing introduces the concept of acoustic spatial separation between conference participants in three dimensional space. This has been shown to significantly improve comprehension and conference efficiency.
The Internet of Things is tied together with a thin strand that is known as time. Coincidentally, at the core of nearly all data analytics is a timestamp. When working with time series data there are a few core principles that everyone should consider, especially across datasets where time is the common boundary. In his session at Internet of @ThingsExpo, Jim Scott, Director of Enterprise Strategy & Architecture at MapR Technologies, will discuss single-value, geo-spatial, and log time series data. By focusing on enterprise applications and the data center, he will use OpenTSDB as an example to explain some of these concepts including when to use different storage models.
SYS-CON Events announced today that Gridstore™, the leader in software-defined storage (SDS) purpose-built for Windows Servers and Hyper-V, will exhibit at SYS-CON's 15th International Cloud Expo®, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Gridstore™ is the leader in software-defined storage purpose built for virtualization that is designed to accelerate applications in virtualized environments. Using its patented Server-Side Virtual Controller™ Technology (SVCT) to eliminate the I/O blender effect and accelerate applications Gridstore delivers vmOptimized™ Storage that self-optimizes to each application or VM across both virtual and physical environments. Leveraging a grid architecture, Gridstore delivers the first end-to-end storage QoS to ensure the most important App or VM performance is never compromised. The storage grid, that uses Gridstore’s performance optimized nodes or capacity optimized nodes, starts with as few a...
The Transparent Cloud-computing Consortium (abbreviation: T-Cloud Consortium) will conduct research activities into changes in the computing model as a result of collaboration between "device" and "cloud" and the creation of new value and markets through organic data processing High speed and high quality networks, and dramatic improvements in computer processing capabilities, have greatly changed the nature of applications and made the storing and processing of data on the network commonplace. These technological reforms have not only changed computers and smartphones, but are also changing the data processing model for all information devices. In particular, in the area known as M2M (Machine-To-Machine), there are great expectations that information with a new type of value can be produced using a variety of devices and sensors saving/sharing data via the network and through large-scale cloud-type data processing. This consortium believes that attaching a huge number of devic...
Innodisk is a service-driven provider of industrial embedded flash and DRAM storage products and technologies, with a focus on the enterprise, industrial, aerospace, and defense industries. Innodisk is dedicated to serving their customers and business partners. Quality is vitally important when it comes to industrial embedded flash and DRAM storage products. That’s why Innodisk manufactures all of their products in their own purpose-built memory production facility. In fact, they designed and built their production center to maximize manufacturing efficiency and guarantee the highest quality of our products.
All major researchers estimate there will be tens of billions devices - computers, smartphones, tablets, and sensors - connected to the Internet by 2020. This number will continue to grow at a rapid pace for the next several decades. Over the summer Gartner released its much anticipated annual Hype Cycle report and the big news is that Internet of Things has now replaced Big Data as the most hyped technology. Indeed, we're hearing more and more about this fascinating new technological paradigm. Every other IT news item seems to be about IoT and its implications on the future of digital business.
Can call centers hang up the phones for good? Intuitive Solutions did. WebRTC enabled this contact center provider to eliminate antiquated telephony and desktop phone infrastructure with a pure web-based solution, allowing them to expand beyond brick-and-mortar confines to a home-based agent model. Download Slide Deck: ▸ Here
BSQUARE is a global leader of embedded software solutions. We enable smart connected systems at the device level and beyond that millions use every day and provide actionable data solutions for the growing Internet of Things (IoT) market. We empower our world-class customers with our products, services and solutions to achieve innovation and success. For more information, visit www.bsquare.com.