Driving Digital Transformation with Identity-centric Security

© 2015 CA. All rights reserved.

Driving Digital Transformation with Identity-centric Security

Santiago CavannaSecurity Solution Account DirectorArgentina, Chile, Bolivia, Uruguay y Paraguay.

Twitter https://twitter.com/scavannaOffice: +54-11-43-17-15-95 | Mobile: +54-911-41-65-15-47 | [email protected]

2 © 2015 CA. ALL RIGHTS RESERVED.

Traditional Approach to Security


From sneaker company to data enabled athletic brand.

From book seller to insight driven delivery service, cloud servicer and entertainment hub.

Today, Every Company is a Software Company. Are You?

From UK Grocer to global consumer retailer leveraging data and technology that reframes the shopper experience.

In 2015, CEOs must focus on leading their organizations to think like and become more like “tech” companies, because within a few years, digital business capabilities will dominate every industry. Urgent action is needed because first-mover advantage is common in digital business, and fast followers must be very fast.


Digital transformation is underwayHalf of enterprises today say the application economy is significantly disrupting their industry—while 44% say it is doing the same to their own organization.1

-- CA Technologies with Vanson Bourne

Sources: 1. CA Vanson Bourne Study2. eMarketer study3. McKinsey Global Institute, Disruptive Technologies, advances that will transform life, business and the global economy, May 20134. GMSA Intelligence, From Concept to Delivery, the M2M Market Today, Feb. 17, 2014

1.75Bsmartphone users in 2014 1

25Business apps per device2

50BConnected devices (IoT) by 2020 3

>$100Bin cloud spending this year 4


Digital transformation drives the need for increased Security

1All data on this slide from CA Application Economy Market Study commissioned by CA, conducted by Vanson Bourne, 2014

2. The 2014 Cost of Cyber Crime Study Reveals Increased Risks, Oct, 2014

3. http://breachlevelindex.com/pdf/Breach-Level-Index-Annual-Report-2014.pdf

Security concerns - the top obstacle in app economy#1

$12.7MAverage cost to the

company for a breach

Overall IT spend devoted to Security

over next 3 years

>25%2

78%Increase in # of breached

records from 2013 to 20143

16,856Number of attacks the average company had

in 2013

http://breachlevelindex.com/pdf/Breach-Level-Index-Annual-Report-2014.pdf


Future security approach must go beyond the perimeterBusinesses are more open than ever – and subject to attacks

Employees

Connected Devices

On Premise Apps

Cloud Services

Threats/Attacks on Identity

CustomersCitizens

Partners

http://www.terinea.co.uk/blogs/terineatechtips/wp-content/uploads/2007/07/image45.png



Business drivers & challengesPerimeter security cannot meet current needs

Employees

Connected Devices

On Premise Apps

Cloud Services

Threats/Attacks on Identity

Protect Corporate Information•Account Takeover•Careless/Malicious admins

CustomersCitizens

Partners Engage Customers & Partners•Bring Your Own Identity•Control partner access

Rapidly Adopt Cloud ApplicationsExposed credentials via insecure appsOrphaned user accounts

Simple AccessToo many passwordsDifficult to use multi-factor




Digital Transformation requires Identity-Centric Security

On Premise Apps

Cloud Services

Connected Devices

CustomersCitizens

Partners

Employees




Now customer experience is paramount

1All data on this slide from CA Application Economy Market Study commissioned by CA, conducted by Vanson Bourne, 20142. Cisco

Security priority for business is improving the user mobileexperience

#2

Connected devices by 2020

50B2

Business apps on each device (average)

25

4. eMarketeer

Companies have increased customer base due to

security initiatives

87%Leaders saw revenue increase for security-

enabled services

47%


Security spend must do more than just SecureSell the business on business value

ENABLE THE BUSINESS

Cloud Services

On Premise Apps

Engage with your customers faster & better

Make your employees more productive

CustomersCitizens

Employees / Partners

Connected Apps / Devices

PROTECT THE BUSINESS

Strongly validate each user’s identity

Govern & control user access

Protect privileged identities




What you need to be thinking about

ENABLE THE BUSINESS

ENGAGE YOUR CUSTOMERS FASTER AND BETTER

Improve customer adoption/experience/ loyalty

Gain insight into your customer base

ENABLE YOUR EMPLOYEES TO BE MORE PRODUCTIVE

Enable simple, secure access to on-premise & cloud apps

Provide each user has the “right access”, always


You need to engage your customers faster and better

REQUIREMENTS

THIS IS JOHN. HE IS YOUR CUSTOMER.

JOHN WANTS:

TO EASILY AND SECURELY CONNECT TO

YOUR APPS AND SERVICES

A PERSONALIZEDEXPERIENCE

THE LATEST SERVICES

ALL WITHOUT THINKING ABOUT

SECURITY

Multi-device Support & Social Login

Customer Insight

Partner Federation

Seamless SSO & Authentication


How to engage your customers faster and better

Desktop/Laptop

Mobile

CUSTOMERS

Partner Apps

CONNECTING

Social MediaIdentity

Via Partners

Directly

Cloud Services

On Premise Apps

Federation

Single Sign-on

Strong & Risk-based Authentication

Using Multiple

Platforms

Customer Insight

Where John is

Where he lives

Where he was born

Who his friends are

What his interests are

• Device• Geolocation• TOD• User history• Etc…





Desktop/Laptop

Mobile

CUSTOMERS CONNECTING


Via Partners

Directly


Using Multiple

Platforms

CAPABILITIES User behavior profiling Transparent risk scoring & analysis Device fingerprinting

BUSINESS VALUE Improve user experience Reduce risk of fraudulent access Manage authentication strategy

according to business needs

Cloud Services

On Premise Apps

Partner Apps

Federation

Single Sign-on





Desktop/Laptop

Mobile



Via Partners

Directly


Using Multiple

Platforms

CAPABILITIES• Session assurance• Seamless federation• Centralized policy enforcement

BUSINESS VALUE• Prevent session theft• Improved user experience• Simplified security management

Cloud Services

On Premise Apps

Partner Apps

Federation

Single Sign-on




How to engage your customers faster and betterSaaS deployment

Desktop/Laptop

Mobile



Via Partners

Directly


Using Multiple

Platforms

CAPABILITIES• Standards based federation• Strong & risk-based

authentication

BUSINESS VALUE• Quick time to value• Seamless interaction with on-premise IAM• Leverage partner expertise for managed

services

Managed Service Option

Cloud Services

On Premise Apps

Partner Apps

Federation

Single Sign-on




Engaging customers: real world success

Desktop/Laptop

Mobile



Using Multiple

Platforms

Cloud Services

On Premise Apps

Single Sign-on

One of CA SSO customers is supporting over 80 million users

The Canada Revenue Agency uses CA SSO to provide secure access for over 70,000 users across

the agency, and to support over 200,000 user authentications per day.

CA SSO is handling 1.5 BILLION transactions per month at a major European Telecom

“CA Advanced Authentication integrates well with our CA SSO environment and has helped us to

provide secure access to our external business partners.” - Global 500 Pharmaceuticals Company

“Setting up federated identities was very simple using CA SSO WAM. We now have a flexible and

scalable model that we will eventually be able to extend to thousands of suppliers and other

partners.” – VP, IT Security, Top 10 Global Telecom




You need to make your employees more productive

REQUIREMENTS

THIS IS SARA. SHE IS YOUR EMPLOYEE.

SARA WANTS:

TO GET HER ACCOUNTS SET

UP QUICKLYTO MANAGE HER

OWN PROFILE INFO LOG IN ONCE EASILY GET ACCESS TO NEW SERVICES

Automated on/off-boarding

Self-serviceSeamless SSO & Authentication

Automated access requests


How to make your employees more productive

Business Managers

Auditors

IT Manager

EmployeesPartners

IDENTITIES ACCESS

Federation

Mobile

Web

API

Onboarding

Self-service

Certify access

Ongoing refinement

Analytics & privilege cleanup

Single Sign-on

Identity Mgt&

Governance

Cloud Services

On Premise Apps

CAPABILITIES Role mining & analytics Automated access certifications Business-oriented unified interface Deployment tools

BUSINESS VALUE Improved efficiency & productivity Reduced risk of over-privileged users Improved ease of use Much faster time-to-value

Stron

g & R

isk-based

A

uth

enticatio

n





Business Managers

Auditors

IT Manager

EmployeesPartners

IDENTITIES ACCESS

Federation

Mobile

Web

API

Onboarding

Self-service

Certify access

Ongoing refinement


Single Sign-on

Identity Mgt&

Governance

Cloud Services

On Premise Apps

CAPABILITIES Variety of strong credentials User behavior profiling Unbreachable passwords

BUSINESS VALUE Improve User Experience Reduce risk of fraudulent access Protect employees from account takeover

and social engineering

Stron

g & R

isk-based

A

uth

enticatio

n




Stron

g & R

isk-based

A

uth

enticatio

n


Business Managers

Auditors

IT Manager

EmployeesPartners

IDENTITIES ACCESS

Federation

Mobile

Web

API

Onboarding

Self-service

Certify access

Ongoing refinement


Single Sign-on

Identity Mgt&

Governance

Cloud Services

On Premise Apps

CAPABILITIES Seamless federation Session assurance Centralized policy enforcement

BUSINESS VALUE Prevent session theft Improved user experience Simplified security management




Stron

g & R

isk-based

A

uth

enticatio

n

How to make your employees more productiveSaaS deployment

Business Managers

Auditors

IT Manager

EmployeesPartners

IDENTITIES ACCESS

Federation

Mobile

Web

API

Single Sign-on

Identity Mgt&

Governance

Cloud Services

On Premise Apps

CAPABILITIES• Self service user management• Simple access request & approval process• Hybrid provisioning and de-provisioning• Standards-based federation• Strong & risk-based authentication

BUSINESS VALUE• Quick time to value• Seamless interaction with on-premise IAM• Leverage partner expertise for managed

services

Managed Service Option




Streamlining identity managementCase study: A large, multi-national media/broadcasting company

CONTRACTORS

150K+ Users

Challenges:

Fragmented entitlements

lack of visibility of access orphan accounts overlapping access

Manual entitlement reviews

No standardized role definitionsPARTNERS

EMPLOYEES

800+ Apps15K+ Unix servers

31K+ Windows servers55K+ Devices



CA Identity Suite

CONTRACTORS

PARTNERS

EMPLOYEES

Consistent role definitions Remediated orphan accounts/incorrect access Seamless access to apps and assets Shopping cart experience for access requests

RESULTS:

Reduced onboarding SLAs (5 day to minutes!) Vast improvement in ease of administration “Day 1 Productivity” Reduced time for certification campaigns (50 campaigns went

from 12 weeks to 3)

BENEFITS ACHIEVED:

IdentityPortal

IdentityManagement

IdentityGovernance

Roles



CONTRACTORS

PARTNERS

EMPLOYEES

Consistent role definitions Remediated orphan accounts/incorrect access Seamless access to apps and assets Shopping cart experience for access requests

RESULTS:

Reduced onboarding SLAs (5 day to minutes!) Vast improvement in ease of administration “Day 1 Productivity” Reduced time for certification campaigns (50 campaigns went

from 12 weeks to 3)

BENEFITS ACHIEVED:

IdentityPortal

IdentityManagement

IdentityGovernance

Roles–Chief Infrastructure and Information Security Officer

“We have been able to help simplify identity management processes and make engagement easy for our business leaders without compromising our security and compliance needs.”


What you need to be thinking about

PROTECT THE BUSINESS

COMBAT INTERNAL THREATS & EXTERNAL ATTACKS

Strongly validate each user’s identity

Govern & control user access

Protect privileged identities


Your organization can’t afford a large-scale cyber-attack

http://www.businessinsider.com/cyber-attack-utilities-katrina-2013-5http://bit.ly/1FqtGrGhttp://arstechnica.com/security/2014/10/report-cybercrime-costs-us-12-7m-a-year/http://www.zdnet.com/article/average-company-now-compromised-every-four-days-with-no-end-to-the-cybercrime-wave-in-sight/http://www.cnbc.com/id/102234825#http://www.reuters.com/article/2014/06/09/us-cybersecurity-mcafee-csis-idUSKBN0EK0SV20140609

http://www.businessinsider.com/cyber-attack-utilities-katrina-2013-5

http://arstechnica.com/security/2014/10/report-cybercrime-costs-us-12-7m-a-year/

http://arstechnica.com/security/2014/10/report-cybercrime-costs-us-12-7m-a-year/

http://www.zdnet.com/article/average-company-now-compromised-every-four-days-with-no-end-to-the-cybercrime-wave-in-sight/

http://www.cnbc.com/id/102234825

http://www.reuters.com/article/2014/06/09/us-cybersecurity-mcafee-csis-idUSKBN0EK0SV20140609


You need to combat internal threats & external attacks

REQUIREMENTS

THIS IS TOM. HE IS THE CISO. TOM WANTS:

TO PROTECT CORPORATE &

CUSTOMER INFO

TO DETECT & PREVENT ATTACKS

TO PREVENT PRIVILEGE

ESCALATION

TO VALIDATE USER IDENTITIES

Fine-grained controls for Admin

Shared Account Management

Privileged access governance

Risk-aware authentication


Protect the Business – Common threats

AdministratorsEmployees

Privileged Identity

INSIDERS

Common Attack Points

Social engineering

Fake Web sites

Stolen Admin credentials

API attacks

Session hijacking

Common Weaknesses

Weak authentication, no risk analysis

No privileged user governance

Lack of fine-grained Admin controls

Weak API controls

Shared Admin passwords

CUSTOMERS

EXTERNAL THREATS

Systems

Data

Mobile / API / Web


How to combat internal threats & external attacks

Privileged Identity

Mgt

INSIDERS

Stron

g & R

isk-base

d

Au

then

tication

SSO w/ Session

Assurance

API Security


CUSTOMERS

EXTERNAL THREATS

Systems

Data

Mobile / API / Web



Privileged Identity

Mgt

CUSTOMERS

EXTERNAL THREATS

INSIDERS

SSO w/ Session

Assurance

CAPABILITIES Variety of strong credentials User behavior profiling Transparent risk scoring & analysis Unbreachable passwords

BUSINESS VALUE Improve User Experience Reduce risk of fraudulent access Apply business policies to

authentication strategy

Stron

g & R

isk-based

Au

then

tication

Systems

Data

Mobile / API / Web

API Security





Privileged Identity Mgt

CUSTOMERS

EXTERNAL THREATS

INSIDERS

SSO w/ Session

Assurance

Stron

g & R

isk-base

d

Au

then

tication

CAPABILITIES Fine-grained Admin control Share account password mgt Session recording

BUSINESS VALUE Reduced risk of successful attack Protect critical systems & data Increased accountability

Systems

Data

Mobile / API / Web

API Security


Mobile / API / Web



Privileged Identity

Mgt

CUSTOMERS

EXTERNAL THREATS

INSIDERS

Web, API Security

SSO w/ Session

Assurance

Stron

g & R

isk-base

d

Au

then

tication

Systems

Data

CAPABILITIES Security policy for Web, mobile, API Session assurance

BUSINESS VALUE Prevent session stealing Improved user experience Simplified security management


API Security



Privileged Identity

Mgt

CUSTOMERS

EXTERNAL THREATS

INSIDERS

Web, API Security

SSO w/ Session

Assurance

Stron

g & R

isk-base

d

Au

then

tication

Systems

Data

Mobile / API / Web

CAPABILITIES• Enforce authentication & authorization via APIs

based on user, app, and/or device• Protect exposed APIs from external threats (SQL

injections, x-site scripting, etc)• Enterprise-grade SSO for the user and device

BUSINESS VALUE• Apply appropriate risk-based controls based

on context• Protect sensitive assets from compromise


Protecting the business from a breachCase study: A major hotel chain

Customers in Loyalty Program

Customer Data

Access earned points for awards, discounts Stron

g & R

isk-base

d

Au

then

tication

Attempted theft of loyalty points

CAPABILITIES• Strong, flexible authentication methods• Simple user experience• User behavior profiling (geolocation,

device, time, etc)• Unbreachable passwords

Loyalty programs make me more

likely to continue doing business

83%

I will modify the brands I buy to

maximize benefits

64%


An “Agile” Digital Platform for the Internet of ThingsAPIs provide connectivity to data stored in internet devices

CAPABILITIES Control access to APIs Threat protection Developer portal

BUSINESS VALUE Secure partner ecosystems Faster development

APIsApplications

API Security

Internet DevicesConsumer Industrial


CA Identity & Access ManagementComprehensive & Proven Solution

CA SECURE CLOUD

Mobile Security

AUTHENTICATION

Strong, multi-factor credentials Risk analysis and scoring Behavioral profiling

IDENTITIES

Provisioning & access governance Self-service Password management

ACCESS

Single-Sign-On Web access management Web services security, federation

PRIVILEGED IDENTITIES

Fine-grained access controls Shared account password management Command filtering

CA SECURE CLOUD

Directory Services

IDENTITY as a SERVICE Identity management Authentication SSO

API SECURITY

API gateway, mobile access gateway Developer portal


CA Identity & Access ManagementComprehensive & Proven Solution

CA SECURE CLOUD

Mobile Security

AUTHENTICATION

Strong, multi-factor credentials Risk analysis and scoring Behavioral profiling

IDENTITIES

Provisioning & access governance Self-service Password management

ACCESS

Single-Sign-On Web access management Web services security, federation

PRIVILEGED IDENTITIES

Fine-grained access controls Shared account password mgt Hypervisor hardening

CA SECURE CLOUD

API SECURITY

API gateway, mobile access gateway Developer portal

Directory Services

IDENTITY as a SERVICE Identity management Authentication SSO

CA Identity Suite

CA Advanced Authentication

CA Single Sign-On

CA Privileged Access Manager

CA Secure Cloud CA API (Mobile) Gateways, CA API Portal

CA Mobile Application Mgt CA Directory


Why CA Identity & Access Management?

LEADERSHIPBest of breed capabilities across a comprehensive, integrated suite of solutions – from mobile to mainframe

DIFFERENTIATIONCA IAM provides unique capabilities to engage with customers across multi-channels; secure APIs; protect against breaches, including session assurance and unbreachable passwords; and scale to consumer-level environments

End-to-end security: from device to datacenter

INNOVATIONInnovation initiatives in areas such as virtual appliances, behavorial analytics, identity custody, IDaaS, secure payments, and mobile SSO.

PROVENSuccessfully deployed in some of the largest and most complex IT environments today. Large customer base across all major verticals.

We know how to make our customers successful.


SCALE TO CONSUMER-LEVEL ENVIRONMENTS

DELIVER MULTI-CHANNEL ACCESS ACROSS APPLICATIONS(WEB, MOBILE, APIS) PROVIDE END-TO-END SECURITY

Why CA? – Unique Capabilities

…in a modular, integrated and highly scalable solution

API

Web Apps

Mobile AppsCustomersEmployeesDevelopers

User Transmission Backend

Customers Employees

Partners

Apps(on-prem, Saas)

Servers


Why CA? – How we do it

Both CA SSO and CA Identity Manager have been validated (external firm) to support over 100M users.

CA SSO is handling 1.5 BILLION transactions per month at a major European Telecom

A F500 Services company secures over 1 million authentications a day with CA Advanced Authentication

>30 customers are supporting over 10M users with CA SSO

…in a modular, integrated and highly scalable solution

Only vendor providing secure SSO across Web, mobile, and APIs

- With patent-pending session assurance protection

Only vendor that uses dynamic behavioral modeling to confirm the identity of the user.

- Others are rule-based and static, need vendor to update policy

Only suite vendor protecting customer data by controlling privileged user access with deep, fine-grained controls

- others have limited, shallow controls

Only vendor providing developer SDK for mobile app SSO across native, hybrid, & Web apps

Only API & suite vendor with end to end security -- client auth. through API transmission to backend Web services

- others only secure at API or authentication

Secure SSO solution for mobile apps

- others offer flawed browser redirect

SCALE TO CONSUMER-LEVEL ENVIRONMENTS

DELIVER MULTI-CHANNEL ACCESS ACROSS APPLICATIONS(WEB, MOBILE, APIS) PROVIDE END-TO-END SECURITY


OUR AUTHENTICATION SOLUTION IS

BEING USED TO SUPPORT OVER 165MCARDHOLDERS

ENABLED MAJOR RETAILER TO PROCESS 240M TRANSACTIONS ON BLACK FRIDAY

15 OF THE TOP 16 GLOBAL BANKS

CA Identity and Access Management – by the numbers

LARGE, DIVERSE CUSTOMER BASE

8 OF THE TOP 10 US MANUFACTURING COMPANIES

21 OF THE TOP 25 FORTUNE 500 COMPANIES

PROVEN SCALABILITY

30 CUSTOMERS ARE USING CA SSO TO SUPPORT WEBSITES WITH OVER 10M USERS

PROVIDING VALUE TO OUR CUSTOMERS

CA IDENTITY MANAGER SAVES TNT OVER $1M ANNUALLY ON PASSWORD RESET COSTS

IN A RECENT SURVEY, 75% OF SURVEYED ORGANIZATIONS IMPROVED USER PRODUCTIVITY “SIGNIFICANTLY” WITH CA IDENTITY MANAGER

79% OF SURVEYED ORGANIZATIONS SIMPLIFIED THEIR COMPLIANCE PROGRAM WITH CA SECURITY SOLUTIONS


CA Security Customers Worldwide (small representative sample)

TRANSPORTATION & MANUFACTURING

FINANCIAL SERVICES

HOSPITALITY, RETAIL & SERVICES

TELECOM & TECHNOLOGY

HEALTHCARE

PUBLIC SECTOR

IT SERVICES

http://images.google.com/imgres?imgurl=http://www.landstar.com/InTheNews/downloads/Landstar(vertical)_web.jpg&imgrefurl=http://www.landstar.com/InTheNews/logos.html&h=147&w=162&sz=15&hl=en&start=1&tbnid=-FFRqDPXFl6PcM:&tbnh=89&tbnw=98&prev=/images?q=landstar+logo&svnum=10&hl=en&lr=

http://images.google.com/imgres?imgurl=http://www.landstar.com/InTheNews/downloads/Landstar(vertical)_web.jpg&imgrefurl=http://www.landstar.com/InTheNews/logos.html&h=147&w=162&sz=15&hl=en&start=1&tbnid=-FFRqDPXFl6PcM:&tbnh=89&tbnw=98&prev=/images?q=landstar+logo&svnum=10&hl=en&lr=

http://www.bancacrfirenze.it/crf/jsp/index.jsp

http://www.bancacrfirenze.it/crf/jsp/index.jsp

http://www.cw.com/

http://www.cw.com/

http://www.bce.ca/en/

http://www.bce.ca/en/

http://www.ebaptisthealthcare.org/

http://www.ebaptisthealthcare.org/

http://www.comcast.com/default.html

http://www.comcast.com/default.html


This is business,rewritten by software™


Legal Notice

Copyright © 2015 CA. All rights reserved. Office 365 is either a registered trademark or trademark of Microsoft Corporation in the United States and/or other

countries. All trademarks, trade names, service marks and logos referenced herein belong to their respective companies. No unauthorized use, copying or

distribution permitted.

THIS PRESENTATION IS FOR YOUR INFORMATIONAL PURPOSES ONLY. CA assumes no responsibility for the accuracy or completeness of the information. TO

THE EXTENT PERMITTED BY APPLICABLE LAW, CA PROVIDES THIS DOCUMENT “AS IS” WITHOUT WARRANTY OF ANY KIND, INCLUDING, WITHOUT LIMITATION,

ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT. In no event will CA be liable for any loss or

damage, direct or indirect, in connection with this presentation, including, without limitation, lost profits, lost investment, business interruption, goodwill, or

lost data, even if CA is expressly advised of the possibility of such damages.

Certain information in this presentation may outline CA’s general product direction. This presentation shall not serve to (i) affect the rights and/or obligations

of CA or its licensees under any existing or future written license agreement or services agreement relating to any CA software product; or (ii) amend any

product documentation or specifications for any CA software product. The development, release and timing of any features or functionality described in this

presentation remain at CA’s sole discretion.

Notwithstanding anything in this presentation to the contrary, upon the general availability of any future CA product release referenced in this presentation,

CA may make such release available (i) for sale to new licensees of such product; and (ii) in the form of a regularly scheduled major product release. Such

releases may be made available to current licensees of such product who are current subscribers to CA maintenance and support on a when and if-available

basis.

The information and results illustrated here are based upon each identified customer’s unique experiences with the referenced software product in a variety of environments, which may include production and non-production environments. Past performance of the software products in such environments is not necessarily indicative of the future performance of such software products in identical, similar or different environments.

Technology

Driving Digital Transformation with Identity-centric Security