Faster Onboarding, Reliable Deactivation and Efficient Change Management. See more at: http://hitachi-id.com/documents/

1. 1 Hitachi ID Identity Manager
Managing the User Lifecycle
Across On-Premises and
Cloud-Hosted Applications
Entitlement administration and governance:
Automation, requests, approvals, recertification, SoD and RBAC.
2 Agenda
• Corporate
• Hitachi ID Identity Manager
• Recorded Demos
• Technology
• Implementation
• Differentiation
3 Corporate
© 2017 Hitachi ID Systems, Inc. All rights reserved. 1

2. Slide Presentation
3.1 Hitachi ID corporate overview
Hitachi ID delivers access governance
and identity administration solutions
to organizations globally.
Hitachi ID IAM solutions are used by Fortune
500
companies to secure access to systems
in the enterprise and in the cloud.
• Founded as M-Tech in 1992.
• A division of Hitachi, Ltd. since 2008.
• Over 1200 customers.
• More than 14M+ licensed users.
• Offices in North America, Europe and
APAC.
• Global partner network.
3.2 Representative customers
© 2017 Hitachi ID Systems, Inc. All rights reserved. 2

3. Slide Presentation
3.3 Hitachi ID Suite
4 Hitachi ID Identity Manager
4.1 Compliance / internal controls
Challenges Solutions
• Slow and unreliable deactivation when
people leave.
• Orphan and dormant accounts.
• Users with no-longer-needed access.
• Access that violates SoD policies or
represents high risk.
• Unreliable approvals for access requests.
• Audit failures and regulatory risk.
• Automate deactivation based on SoR
(HR).
• Review and remediate excessive access
(certification).
• Block requests that would violate SoD.
• Analyze entitlements to find policy
violations, high risk users.
• Automatically route access requests to
appropriate stake-holders.
© 2017 Hitachi ID Systems, Inc. All rights reserved. 3

4. Slide Presentation
4.2 Access administration cost
Challenges Solutions
• Multiple FTEs required to setup,
deactivate access.
• Additional burden on platform
administrators.
• Audit requests can add significant strain.
• Automate access setup, tear-down in
response to changes in systems of record
(SoRs).
• Simple, business-friendly access request
forms.
• Route requests to authorizers
automatically.
• Automate fulfillment where possible.
• Help auditors help themselves:
– With certification, auditors focus on
process, not entitlements.
– Reports and analytics.
4.3 Access changes take too long
Challenges Solutions
• Approvers take too long.
• Too many IT staff required to complete
approved requests.
• Service is slow and expensive to deliver.
• Automatically grant access:
– Where predicted by job function,
location, ...
– Eliminate request/approval process
where possible.
• Streamline approvals:
– Automatically assign authorizers,
based on policy.
– Invite participants simultaneously,
not sequentially.
– Enable approvals from smart-phone.
– Pre-emptively escalate when
stake-holders are out of office.
• Automate fulfillment where possible.
© 2017 Hitachi ID Systems, Inc. All rights reserved. 4

5. Slide Presentation
4.4 Access requests are too complicated
Challenges Solutions
• Requesting access is complex:
– Where is the request form?
– What access rights do I need?
– How do I fill this in?
– Who do I send it to, for approval?
• Complexity creates frustration.
• Auto-assign access when possible.
• Simplify request forms.
• Intercept "access denied" errors:
– Navigate lead users to appropriate
request forms.
• Compare entitlements:
– Help requesters select entitlements.
– Compare recipient, model user
rights.
– Select from a small set of
differences.
• Automatically assign authorizers based
on policy.
5 Features
© 2017 Hitachi ID Systems, Inc. All rights reserved. 5

6. Slide Presentation
5.1 HiIM features
Inputs → → Processes →
• Monitor SoRs (automation).
• Systems and apps - current state.
• Request portal:
– Self-service.
– Delegated.
– Access admin.
• Web services API.
• Request forms.
• Approval workflows.
• Access certification.
• Manual fulfillment.
• Analytics.
→ Policies → → Outputs
• Segregation of duties.
• Risk scores.
• Role based access control.
• Authorizer, certifier selection.
• Visibility / privacy protection.
• Connectors to 110 systems and
applications.
• E-mail.
• Create/update/close tickets.
• Send events to SIEM.
5.2 Identity and entitlement lifecycle automation
• Using Hitachi ID Identity Express, we recommend full automation of identity and entitlement
lifecycles out of the gate:
– Joiners, movers, leavers processes.
– Password management, strong authentication and federation.
– Change requests, approval, review/certification.
– Driven by both SoR data and requests.
• No need to "clean up" entitlements before automating access changes.
• Roles can be added later: not a pre-requisite.
• Automate first, clean up afterwards:
– Unlike with competitors, automation is pre-configured and easy.
– Start with basic integrations, add connectors over time.
– Leverage automation and user knowledge to help clean up.
– Add roles and expand automation over time.
© 2017 Hitachi ID Systems, Inc. All rights reserved. 6

7. Slide Presentation
5.3 Monitoring systems of record
• Any target system can function as a system of record
(SoR).
• Examples: HR apps, SQL databases, CSV files, ...
• Hitachi ID Identity Manager can monitor multiple SoR’s:
– Multinationals: regional HR systems.
– Colleges: students vs. faculty/staff.
• Map attributes to user profiles and prioritize.
• Automatically submit access requests in response to
detected changes.
• Users can submit pre-emptive or corrective requests:
– New hire not yet in HR.
– HR data is wrong.
– Override SoR data until HR updates it.
• Request portal handles users who never appear in SoRs:
– Contractors, partners, etc.
5.4 Requester usability
• Users rarely know where or how to request access!
• Windows shell extension, SharePoint error page:
– Intercept "Access Denied" errors.
– Navigate user to appropriate request URL.
• Compare users:
– Compare entitlements between the intended recipient and a
reference user.
– Select entitlements from the variance.
• Search for entitlements:
– Keywords, description, metadata/tags.
• Relationship between requester and recipient:
– What recipients can the requester see?
– What identity attributes are visible?
– What kinds of requests are available?
© 2017 Hitachi ID Systems, Inc. All rights reserved. 7

8. Slide Presentation
5.5 Robust, policy-driven workflow
• Workflow invites stake-holders to participate in processes:
– Approve or reject a request.
– Review entitlements and recertify or remediate.
– Fulfill an approved request.
– Extensible. e.g., audit cases.
• Stake-holders are invited based on policy:
– No flow-charts or diagrams required.
– Process is simple, transparent and secure.
– Routing may be based on relationships, resource ownership, risk.
• The process is robust, even when people aren’t:
– Invite N participants, accept response from M (M<N).
– Simultaneous invitations by default (sequential made sense for
paper forms).
– Automatically send reminders.
– Escalate (e.g., to manager) if unresponsive.
– Check out-of-office message, pre-emptively escalate.
– Accessible from smart phone, not just PC.
5.6 Reports, dashboards and analytics
• Over 150 reports built in:
– Many include multiple modes (e.g,. dormant vs. orphan accounts).
– Identities, entitlements, history, system operation, trends, etc.
– Easy to add custom reports.
• Many dashboards included as well.
• Run interactively or schedule (once, recurring).
• Deliver output (HTML, CSV, PDF):
– Interactively.
– In e-mails.
– Drop files on UNC shares.
– Stream results via web services.
• Actionable analytics:
– Feedback from reports to requests.
– Automated remediation.
• Database is normalized, documented – can use 3rd party tools too.
6 Recorded Demos
© 2017 Hitachi ID Systems, Inc. All rights reserved. 8

9. Slide Presentation
6.1 Intercept Access Denied Dialogs
Animation: ../../pics/camtasia/v10/higm-A-request-folder.mp4
6.2 Authorization of a request for security group membership
Animation: ../../pics/camtasia/v10/higm-B-request-approve.mp4
6.3 Request approved, user can access the folder
Animation: ../../pics/camtasia/v10/higm-C-approved-open-file-nb.mp4
6.4 Mobile request approval
Animation: ../../pics/camtasia/v10/approve-request-group-membership-via-mobile-access-app-1.mp4
6.5 Compare user entitlements
Animation: ../../pics/camtasia/v10/hiim-model-after-ui.mp4
6.6 Application-centric certification
Animation: ../../pics/camtasia/v10/hiac-complete-app-centric-2.mp4
6.7 Add contact to phone
Animation: ../../pics/camtasia/v9/add-contact-to-phone-1/add-contact-to-phone-1.mp4
6.8 Actionable analytics: Disable orphan accounts
Animation: ../../pics/camtasia/v10/report2pdr-disable-orphan-accounts-1.mp4
7 Technology
© 2017 Hitachi ID Systems, Inc. All rights reserved. 9

10. Slide Presentation
7.1 Multi-master architecture
“Cloud”
Reverse
web
proxy
VPN server
IVR server
Load
balancers
E-mail
system
Ticketing
system
HR
Hitachi ID
servers
Hitachi ID
servers
Firewalls
Proxy server
(if needed)
Mobile
proxy
SaaS apps
Managed
endpoints
Managed endpoints
with remote agent:
AD, SQL, SAP, Notes, etc
z/OS - local agent
MS SQL databases
Password synch
trigger systems
Native password
change
Manage
Mobile UI
AD, Unix, z/OS,
LDAP, iSeries
Validate pw
Replication
System of
record
Tickets
Notifications
and invitations
Data center A
Data center B
Remote data center
TCP/IP + AES
Various protocols
Secure native protocol
HTTPS
© 2017 Hitachi ID Systems, Inc. All rights reserved. 10

11. Slide Presentation
7.2 Key architectural features
“Cloud”
SaaS apps
Data center A
Data center B
Remote data center
TCP/IP + AES
Various protocols
Secure native protocol
HTTPS
Reach across firewalls
Load balanced
On premise and SaaS
BYOD enabled
Replicated across data centers
Horizontal scaling
7.3 Internal architecture
• Multi-master, active-active out of the box.
• Built-in data replication between app nodes:
– Fault tolerant.
– Secure - encrypted.
– Reliable - queue and retry.
– App nodes need and should not be co-located.
• Native, 64-bit code:
– 2x faster than .NET.
– 10x faster than Java.
• Stored procedures:
– For all data lookups, inserts.
– Fast, efficient.
– Eliminates client/server chatter.
• Modern crypto: AES-256, SSHA-512
© 2017 Hitachi ID Systems, Inc. All rights reserved. 11

12. Slide Presentation
7.4 BYOD access to on-premises IAM system
The challenge Hitachi ID Mobile Access
• Users want access on their phones.
• Phone on the Internet, IAM on-prem.
• Don’t want attackers probing IAM from
Internet.
• Install + activate iOS, Android app.
• Proxy service on DMZ or cloud.
• IAM, phone both call the proxy - no
firewall changes.
• IAM not visible on Internet.
Outbound connections only
DMZ Private corporate
network
Personal
device
FirewallFirewall
Internet
(3)
Message passing system
(1)
Worker thread:
“Give me an HTTP
request”
(2)
HTTPS request:
“Includes userID,
deviceID”
IAM server
Cloud
proxy
© 2017 Hitachi ID Systems, Inc. All rights reserved. 12

13. Slide Presentation
7.5 Included connectors
Many integrations to target systems included in the base price:
Directories:
Any LDAP, Active Directory,
NIS/NIS+.
Servers:
Windows NT, 2000, 2003,
2008[R2], 2012[R2], Samba.
Databases:
Oracle, Sybase, SQL Server,
DB2/UDB, Informix, Progress,
Hyperion, Cache, ODBC.
Unix:
Linux, Solaris, AIX, HPUX, 24
more variants.
Mainframes, Midrange:
z/OS: RACF, ACF2,
TopSecret. iSeries,
OpenVMS.
HDD Encryption:
McAfee, CheckPoint,
BitLocker, PGP.
ERP:
JDE, Oracle eBiz,
PeopleSoft, PeopleSoft HR,
SAP R/3 and ECC 6, Siebel,
Business Objects.
Collaboration:
Lotus Notes, iNotes,
Exchange, SharePoint,
BlackBerry ES.
Tokens, Smart Cards:
RSA SecurID, SafeWord,
Vasco, ActivIdentity,
Schlumberger, RADIUS.
WebSSO:
CA Siteminder, IBM TAM,
Oracle AM, RSA Access
Manager.
Help Desk:
ServiceNow, BMC Remedy,
SDE, HP SM, CA Unicenter,
Assyst, HEAT, Altiris, Clarify,
RSA Envision, Track-It!, MS
System Center
Cloud/SaaS:
WebEx, Google Apps, MS
Office 365, Success Factors,
Salesforce.com, SOAP.
7.6 Rapid integration with custom apps
• Hitachi ID Identity Manager easily integrates with custom, vertical and hosted applications using
flexible agents .
• Each flexible agent connects to a class of applications:
– API bindings (C, C++, Java, COM, ActiveX, MQ Series).
– Telnet / TN3270 / TN5250 / sessions with TLS or SSL.
– SSH sessions.
– HTTP(S) administrative interfaces.
– Web services.
– Win32 and Unix command-line administration programs.
– SQL scripts.
– Custom LDAP attributes.
• Integration takes a few hours to a few days.
• Fixed cost service available from Hitachi ID.
© 2017 Hitachi ID Systems, Inc. All rights reserved. 13

14. Slide Presentation
8 Implementation
8.1 Hitachi ID professional services
• Hitachi ID offers a complete range of services relating to Hitachi ID Identity Manager, including:
– Needs analysis and solution design.
– Fixed price system deployment.
– Project planning.
– Roll-out management, including maximizing user adoption.
– Ongoing system monitoring.
– Training.
• Services are based on extensive experience with the Hitachi ID solution delivery process.
• The Hitachi ID professional services team is highly technical and have years of experience deploying
IAM solutions.
• Hitachi ID partners with integrators that also offer business process and system design services to
mutual customers.
• All implementation services are fixed price:
– Solution design.
– Statement of work.
© 2017 Hitachi ID Systems, Inc. All rights reserved. 14

15. Slide Presentation
8.2 ID Express
Before reference implementations:
• Every implementation starts from
scratch.
• Some code reuse, in the form of
libraries.
• Even simple business processes have
complex boundary conditions:
– Onboarding: initial passwords,
blocking rehires.
– Termination: scheduled vs.
immediate, warnings, cleanup.
– Transfers: move mailboxes and
homedirs, trigger recertification.
• Complex processes often scripted.
• Delay, cost, risk.
With Hitachi ID Identity Express:
• Start with a fully configured system.
• Handles all the basic user lifecycle
processes out of the box.
• Basic integrations pre-configured (HR,
AD, Exchange, Windows).
• Implementation means "adjust as
required" not "build from scratch."
• Configuration is fully data driven (no
scripts).
• Fast, efficient, reliable.
© 2017 Hitachi ID Systems, Inc. All rights reserved. 15

16. Slide Presentation
8.3 ID Express - Corporate: details
• Integrations:
– SQL-based HR SoR.
– AD domain
– Exchange domain (mailboxes)
– Windows filesystem (homedirs)
• Entitlements:
– Login IDs.
– Group memberships.
– Roles.
• User communities:
– Employees.
– Contractors/other.
• Configuration:
– Based on user classes, rules tables
and lookup tables.
– Near-zero script logic.
• Automation:
– Onboard/deactivate based on SoR.
– Identity attribute propagation.
• Self-service:
– Password, security question
management.
– Update to contact info.
– Request for application, share, folder
access.
• Delegated admin:
– Same as self-service, plus recert.
• Approval workflows:
– IT security (global rights).
– HR/managers (approve for
each-other).
• Recertification:
– Scheduled.
– Ad-hoc.
© 2017 Hitachi ID Systems, Inc. All rights reserved. 16

17. Slide Presentation
8.4 Services impact of ID Express
Initial planning (5/5 days)
Document old processes (30/5 days)
Design new processes (30/5 days)
Deploy software (2/2 days)
Basic integrations (5/5 days)
Implement new processes (30/5 days)
Test, debug, adjust (30/10 days)
Production migration (2/2 days)
Pilot test, adjust (20/15 days)
Advanced integrations (30/30 days)
Test, debug, fix (15/15 days)
Production migration (2/2 days)
Test in prod., feedback, fixes (5/5 days)
Get feedback (15/5 days)
Implement new processes (30/5 days)
Test, debug, adjust (15/5 days)
Production migration (2/2 days)
Retest, adjust (10/10 days)
Documentation (5/5 days)
9 Differentiation
© 2017 Hitachi ID Systems, Inc. All rights reserved. 17

18. Slide Presentation
9.1 HiIM differentiation (1/3)
Feature Details Competitors
Hitachi ID Identity Express
• Pre-configured
processes, policies.
• Full implementation or
menu of components.
• Rich processes.
• Faster deployment.
• Low implementation risk.
• Slow, risky deployment.
• Never get around to J/M/L
process automation.
Requester usability
• Intercept "access denied"
errors.
• Compare entitlements of
recipient, model users.
• Usability aid for
requesters.
• Hard to find request
portal.
• Users don’t know how to
request access.
• Low user adoption.
• Reduced ROI.
SoD actually works
• Hierarchy of roles,
groups.
• Roles can contain
groups, more roles.
• Groups can contain other
groups.
• SoD defined at one level,
violation may happen at
another.
• Hitachi ID Identity
Manager reliably detects,
prevents violations.
• Fail to detect some
violations.
• Users can bypass
controls.
• False sense of security.
• Audit failures.
• Regulatory risk.
© 2017 Hitachi ID Systems, Inc. All rights reserved. 18

19. Slide Presentation
9.2 HiIM differentiation (2/3)
Feature Details Competitors
Active-active architecture
• Multiple servers.
• Load balanced.
• Geographically
distributed.
• No single point of failure.
• Scalable.
• Single points of failure.
• Costly to scale.
• Slow to recover from
disasters.
Smart phone access
• Android and iOS apps.
• Cloud-hosted proxy.
• No public URL.
• Approvals, 2FA, contact
download, etc.
• Require a public URL.
• Less secure / rarely
permitted.
• No viable BYOD strategy.
• Impacts security, approval
SLA.
Actionable analytics
• Link report output to
request input.
• Automated remediation.
• Immediate or scheduled.
• No coding.
• Fewer reports, analytics.
• No automated
remediation.
© 2017 Hitachi ID Systems, Inc. All rights reserved. 19

20. Slide Presentation
9.3 HiIM differentiation (3/3)
Feature Details Competitors
Governance, provisioning in
one product
• Governance: requests,
approvals, certification,
SoD, RBAC, analytics.
• Provisioning:
connectors, J/M/L
process automation.
• Single, integrated
solution.
• Some focus on
governance (no
remediation, no J/M/L
process automation).
• Others focus on
provisioning (no
certification, limited
analytics).
• Higher total cost.
• Integration risk.
Policies built on
relationships
• Relationships drive all
policies in Hitachi ID
Identity Manager.
• Who can a user search
for?
• What data is visible?
• What changes are
requestable?
• Who will be asked to
approve?
• Escalation path?
• Hierarchical access
controls.
• Script code for
exceptions.
• Costly, risky.
• Hard to configure,
maintain.
10 Summary
An integrated solution for managing identities and entitlements:
• Automation: onboarding, deactivation, detect out-of-band changes.
• Self-service: profile updates, access requests.
• Governance: certification, authorization workflow, RBAC, SoD, analytics.
• Automatically manage identities, entitlements: 110 bidirectional connectors.
• Other integrations: filesystem, collaboration, SIEM, incident management.
• Rapid deployment: pre-configured Hitachi ID Identity Express.
Security, lower cost, faster service.
Learn more at Hitachi-ID.com/Identity-Manager
www.Hitachi-ID.com
500, 1401 - 1 Street SE, Calgary AB Canada T2G 2J3 Tel: 1.403.233.0740 Fax: 1.403.233.0725 E-Mail: sales@Hitachi-ID.com
Date: 2017-03-15 | 2017-03-15 File: PRCS:pres