Protegiendo el acceso y transacciones de su organización. Jorge Carbón

Presentación del tema: "Protegiendo el acceso y transacciones de su organización. Jorge Carbón"— Transcripción de la presentación:

1 Protegiendo el acceso y transacciones de su organización. Jorge Carbón jcarbon@cisep.com

2 Quienes somos Líder mundial de la industria de E-security. Creador de los mejore y mas utilizados algoritmos de encriptación utilizada alrededor del mundo. SSL, WAP, Certificado Digital y etc... Mas de 1 billón de software distribuidos con tecnología RSA. Empresa americana publica y estable durante mas de 2 décadas. Mas de 14.000 clientes alrededor del mundo. 87% de la lista das 100 empresas grandes del mundo. 88% de la lista dos 50 mayores bancos mundiales. Presencia en América del Sur desde hace más de 8 años. Mas de 1,200 clientes en América del Sur.

3 Dificultades de las organizaciones. Popularización de la Internet. Prevención de acceso remoto a usuarios, clientes, aliados. Facilidad de hackers obtener credenciales: - Phishing attack - Social Hackers. - Contraseñas estáticas. Dificultad de proveer y administrar una solución de identidad y controle de acceso ¿Quién está al otro lado de la línea?

4 What is Identity?

5 Need to access information Need to protect corporate resources The Business Problem

6 The Business Problem Passwords = poor security Difficult to remember Often shared and written down Easily cracked with freely available tools

7 Password Levels of Authentication Relative Strength Weaker Stronger No PolicyPolicy ++ + + Maximize security & maintain cost flexibility by matching level of authentication to value of service

8 Levels of Authorization Less Granular More Granular Security Policy: Time of Day Security Domain Group / Role Authentication Strength System SAP Oracle Domino Applications Add Delete Modify Application Functions Network Fields Data Stores Risk mitigation with fine-grained protection of your existing web-based resources

9 Solución de identidad y control de acceso Autenticación de dos factores para el acceso a: PC, Web, VPNs, Firewall, Wireless land, Windows…. El autenticador más utilizado al mundial con mas de 72% del mercado mundial. 523426

10 Two-factor Authentication Something you have, e.g. token, combined with something you know, e.g., a PIN Simple for users Zero footprint Non-repudiation; auditing capability No need to remember multiple passwords

11 Time Synchronous Two-factor Authentication RSA ACE/Server RAS, VPN, SSL-VPN WLAN web, more… RSA ACE/Agent or embedded APIs SeedTime Same Seed Same Time Same Algorithm userid: asmith PIN: 98mypin Tokencode: 234836 userid: asmith PIN: 98mypin Tokencode: 234836 Algorithm

12 Enterprise Authentication: Make Life Secure and Simple Simple Same authentication whether inside or outside the perimeter … online or offline Secure Single auditable log for all authentication Strong authentication from anywhere to anything No complex, costly password change policies

13 RSA SecurID Environments VPNs Windows Wireless Web portal Applications Federated Identity Trusted Websites Enterprise SSO

14 RSA SecurID for Microsoft Windows Online and offline authentication to Microsoft Windows

15 SecurID para Windows Pin + Conectado o no a la red Log de acceso Pin +

16 How It Works User on-line (Network Connected) RSA ACE/Server 2. UserID, passcode sent to RSA ACE/Server 5. UserID, Windows password supplied to AD Domain Controller 6. Kerberos Ticket supplied to desktop 1. UserID and passcode 3. RSA ACE/Server verifies authentication and tells RSA ACE/Agent to grant or deny access 4. RSA ACE/Server decrypts Windows password and passes it into Windows logon process 7. RSA ACE/Server prepares end user laptop to be able to perform offline authentication. RSA ACE/Agent

17 RSA offline module How It Works User off-line (Network disconnected) RSA ACE/Server 2. UserID, passcode Microsofts cached credentials 3. Authentication successful Laptop 1. UserID and passcode 5. UserID, Windows password supplied to cached credentials 6. Offline Kerberos ticket supplied to desktop 4. RSA offline module decrypts Windows password and passes it into Windows logon process

18 Control de acceso en su red. Single Sign On en su red Centralizacion de autenticacion Cliente servidor Variedad de autenticadores ***** ®

19 Password Problem Exists and is Worsening Systems/Application Access is not secure, because there are too many applications, so users write down passwords ! Changing Passwords more frequently makes it worse ! Streamlining authenticators leverages investment and tightens security Source: IDC / Deutsche Bank Alex. Brown ~75% of all Enterprise applications are not yet Web-based!

20 RSA SecurID Passage 4.0 RSA SecurID Passage 4.next + PIN, or + BIO, or + PIN + BIO SSO Credentials SID SW Token Seed Smartchip PWDs Emergency Access Password Web User Authentication Windows PC & Nework Application or Platform Client/Server Citrix Mainframe VPN/Dial-up E-mail Desktop Windows Authentication Policy Applications Authentication Policy RSA SecurID for Windows + PIN RSA Authentication Client RSA Authentication Agent SSO Credentials RSA Passage Client Summary

21 Enhance Security Integrates with RSA Securitys strong two-factor authenticators Automates rigorous password policies transparently ***** ®

22 Enhance Security Innovative IntelliAccess technology Secure emergency access Self-service for forgotten passwords or lost authenticators Patent-pending security technology from RSA Labs Mothers birthdate (MM/DD/YY): Mothers Maiden Name: Fathers Middle Name:

23 Controle de acceso en su Web IntranetExtranet Password Identificación del perfil del usuario Autorización Single Sign On F.I.M

24 Problem How do you manage the identity of a growing number of users… Partners Customers Employees

25 Access Channels: Intranet, Extranet, Portal, Wireless Problem Silo Access Mgmt. Silo Access Mgmt. Silo Access Mgmt. Silo Access Mgmt. Silo Access Mgmt. EmployeesCustomersPartners HR, Financial Mgmt. e-CRM Supply Chain Mgmt. Industry Specific e-Commerce …and their secure access to enterprise Web resources in a scalable, cost-efficient manner ….

26 Problem …across a heterogeneous IT infrastructure? Databases Mainframe Security Systems Directories Other Systems (Legacy, etc.)

27 Enforcing Business Policy Web Access Management IntranetExtranet Data Stores Enterprise Apps. App. ServersWeb Servers

28 Access Channels: Intranet, Extranet, Portal, Wireless The Access Control Challenge Silo Access Mgmt. Silo Access Mgmt. Silo Access Mgmt. Silo Access Mgmt. Silo Access Mgmt. EmployeesCustomersPartners HR, Financial Mgmt. e-CRM Supply Chain Mgmt. Industry Specific e-Commerce

29 Access Channels: Intranet, Extranet, Portal, Wireless Web Single Sign-on Web Access Management Solution EmployeesCustomersPartners HR, Financial Mgmt. e-CRM Supply Chain Mgmt. Industry Specific e-Commerce SSO

30 Certificado digital User RSA Keon Certificate Authority RSA Keon Key Recovery Module Web Server RSA Keon Root Signing Service RSA Keon Web PassPort & Validation Clients RSA Validation Manager RSA Keon Web PassPort Server RSA Keon Registration Authority - Infraestructura de emisión, registro y revocación de certificados. - Certificados internos, publico o SSL. - Escalable.

31