Upload
forgerock
View
711
Download
0
Embed Size (px)
Citation preview
© 2016 ForgeRock. All rights reserved.
Digital Trust How Identity Tackles the Privacy, Security, and IoT Challenge
Eve Maler, VP Innovation & Emerging Technology
Jessica Morrison, Product Marketing Director
1
© 2016 ForgeRock. All rights reserved.
2010 Founded
10 Offices worldwide with headquarters in San Francisco
350+ Employees
450+ Customers
30+ Countries
$52M Funding to date (thru Series C) by Accel Partners, Foundation Capital and Meritech Capital Partners
ForgeRock The leading, next-generation, identity security software platform.
© 2016 ForgeRock. All rights reserved.
$25 Billion Est. Size of Consumer IoT Market in 2019
20% Of Annual Security Budgets Will Be Spent on IoT Security in 2020
5.5 Million New Things Will Be Connected Every Day in 2016
$11.1 Trillion Est. Total Economic Impact of the IoT
20.8 Billion Connected Devices by 2020
$2.5 Billion Est. Retailer Spend on the IoT by 2020
Gartner Research, McKinsey Global Institute Juniper Research, CCS Insight
Global IoT Trends
© 2016 ForgeRock. All rights reserved.
Major Trends We Are Seeing in Identity…
Privacy and
Consent
Contextual Identity
IoT Ready
Open Source
Scalable Unified
Platform
Single Customer
View
© 2016 ForgeRock. All rights reserved.
From IAM to Identity Relationship Management…
Digital business requires an identity-centric approach
Identity Access Management Identity Relationship ManagementCustomers (millions)
On-premises
People
Applications and data
PCs
Endpoints
Workforce (thousands)
Partners and Suppliers
Customers (millions)
On-premises Public Cloud
Private Cloud
People
Things (Tens of millions)
Applications and data
PCs Phones Tablets Smart
Watches Endpoints
Source: Forrester Research
© 2016 ForgeRock. All rights reserved.
ForgeRock Identity Platform• Simple • Scalable • Modular • Common services architecture • Community participation
© 2016 ForgeRock. All rights reserved.
USER-MANAGED ACCESS (UMA)A new standard for sharing
Regard for one's wishes and preferences
The true ability to say no and change one's mind
The ability to share just the right
amount
The right moment to make the decision to share
Context Control
Respect Choice
© 2016 ForgeRock. All rights reserved. 8 flickr.com/photos/vincrosbie/16301598031/ CC BY-ND 2.0
flickr.com/photos/vincrosbie/16301598031/ CC BY-‐ND 2.0
© 2016 ForgeRock. All rights reserved.
What Happens When Businesses Can’t Form Trusted Digital Relationships With Consumers?
• Revenue loss • Brand damage • Loss of trust
• Missing out on opportunities
• Compliance costs and penalties?
flickr.com/photos/delmo-baggins/3143080675 CC BY-ND 2.0
Source: Accenture, 2016 Technology Vision report
© 2016 ForgeRock. All rights reserved.
Why Enable Personal Data Sharing?Let’s Use Health Relationship Trust as an Example
© 2016 ForgeRock. All rights reserved.
data qualityand accuracy
improvedclinical data
better care
© 2016 ForgeRock. All rights reserved.
Why Ensure Personal Control of Sharing?
© 2016 ForgeRock. All rights reserved.
How Dire is the Consent Technology Situation?
9 percent [of companies] believe current methods (i.e., check boxes, cookie acknowledgment) used to ensure data privacy and consent will be able to adapt to the needs of the emerging digital economy.
– ForgeRock global survey conducted by TechValidate, 16 Mar 2016
© 2016 ForgeRock. All rights reserved.
A Consumer Scenario
Alice wants to allow her accountant to import her tax data directly from her employer’s site into the tax return app he uses, with the ability to revoke that consent.
• ProacMve sharing (“pushing” her consent to him) without giving away her password
• Could grant “read” but not “print” permissions
• She can decide to grant “print” later • She can revoke his access • She can Mme-‐out his access
© 2016 ForgeRock. All rights reserved.
authorizaMon server
resource owner
requesMng party
client
manage
control
protect
delegate revoke
authorize
manage access
negotiate
deny
An Enterprise Scenario
IT manages hundreds of API-‐fronted apps in the enterprise (and some outside). Alice is an employee who needs to delegate constrained access to app features/funcMons to fellow employees and partners within the ecosystem, giving IT – and herself – centralized visibility into the access granted.
resource server
© 2016 ForgeRock. All rights reserved.
A Deep Dive on a Consumer Health IoT Scenario
© 2016 ForgeRock. All rights reserved.
OAuth does “RESTful WS-Security,” capturing user consent for app access and respecting its withdrawal
RS resource
server
AS authorization
server
C client
Both servers are run by the same organization; RO goes to AS in each ecosystem to revoke its token
Standard OAuth endpoints that manage access token issuance
API endpoints that deliver the data or other “value-add”
App gets the consent based on the API “scopes” (permissions) it requested; is uniquely identified vs. the user
RO resource
owner
Authorizes (consents) at run time after authenticating
© 2016 ForgeRock. All rights reserved.
OpenID Connect Turns Single Sign-On Into an OAuth-Protected Identity API
SAML 2, OpenID 2 OAuth 2 OpenID Connect
Initiating user’s login session
Collecting user consent
High-security identity tokens
Distributed/aggregated claims
Dynamic introduction (OpenID only)
Session management
No sessions
Collecting user consent
No identity tokens per se
No claims per se
Dynamic introduction (new)
No sessions
X
X
X X
X
X
X Initiating user’s login session
Collecting user consent
High-security identity tokens
Distributed/aggregated claims
Dynamic introduction
Session management (draft)
© 2016 ForgeRock. All rights reserved.
UMA adds party-to-party, asynchronous, scope-grained delegation and control to OAuth
Loosely coupled to enable centralized authorization and a central sharing management hub
Enables party-to-party sharing – without credential sharing – driven by “scope-grained” policy rather than run-time opt-in consent
Tested for suitability through trust elevation, e.g. step-up authn or “claims-based access control” (optionally using OIDC), captured in a specially powerful access token borne by the client
Subsidiary access tokens protect UMA’s standardized endpoints and represent each party’s authorization (consent) to engage with the central server
© 2016 ForgeRock. All rights reserved.
The CMO and the CPO Can and Must Meet in the Middle
“Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. … In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller…”
We value personal data as an asset Our customers’ wishes have value Our customers have their own reasons to share, not share, and mash up data, which we can address as value-add
Risk management perspective Business perspective
© 2016 ForgeRock. All rights reserved.
ForgeRock Identity Platform
UMA Provider Mobile App Synchronization Auditing
LDAPv3 REST/JSON
Replication Access Control
Schema Management
Caching
Auditing
Monitoring
Groups
Password Policy
Active Directory Pass-thru
Reporting
Authentication Authorization Provisioning User Self-Service Authentication OIDC / OAuth2
Federation / SSO User Self-Service Workflow Engine Reconciliation Password Replay SAML2
Adaptive Risk Stateless/Stateful Registration Aggregated User View
Message Transformation
API Security Scripting
Built from Open Source Projects:
UMA Protector
Access Management Identity Management Identity Gateway
Directory Services
Com
mon
RES
T AP
I
Com
mon
Use
r Int
erfa
ce
Com
mon
Aud
it/Lo
ggin
g
Com
mon
Scr
iptin
g
© 2016 ForgeRock. All rights reserved.
Thank You