Managing Identity from the Cloud: Transformation Advantages at VantisLife Insurance
Download as PPTX, PDF3 likes2,787 views
The document discusses IBM's Cloud Identity Services, which offer a comprehensive identity and access management (IAM) solution as a cost-effective and agile alternative to traditional on-premise systems. It details the benefits of reducing total ownership costs, improving deployment speeds, and enabling flexibility for organizations facing IAM challenges. A case study on Vantislife Insurance highlights how they transitioned to this cloud-based IAM system to enhance security, compliance, and operational efficiency while minimizing the need for in-house specialized skills.
Managing Identity from the Cloud: Transformation Advantages at VantisLife Insurance
- 1. © 2015 IBM Corporation Managing Identity from the Cloud Transformation Advantages at VantisLife Insurance Eric Maass Director, IAM Strategy, IBM Jim Lovelace VP of IT, VantisLife Insurance Co.
- 2. Trends
- 3. Evolutionary Themes of IAM Technical Scope of IDM and WAM IDM, WAM, IGA, PIM, Federation, Intelligence, etc. IAM as a Tool of Policy Enforcement IAM as a Tool of Compliance and Intelligence IAM as a Project IAM as a Program IAM as a Cost of Doing Business IAM as a Business Differentiator IAM Infrastructure and Expertise On- Premise IAM in the Cloud Evolutionary Shift of IAM Traditional View Modern View IAM is shifting to become an ongoing program that delivers intelligence, meets regulatory compliance requirements, adds value differentiation, and unburdens the organization
- 4. Expanding Ecosystem of Identities and Assets Identity Management Access Management People Assets Suppliers Vendors Resellers On-Premise Applications Social Sites and Identities Partners and Channels SaaS, PaaS, and IaaS Mobile Devices, Apps, and Identities
- 5. Challenges Our Clients Are Facing • Constrained Budgets • Lack of funding, newly constrained IT budgets • Limited Deployment Windows / Dependent Project Schedules • Necessity to deploy quickly, dependent project schedules being held up on IAM • Difficulty Acquiring and Retaining Specialized Skills • Limited availability of specialized skills in high-end IAM product suites, certification, training, and retention • Falling Behind on Product Versions • Inability to keep up with upgrades, patches, and general lifecycle challenges • Inability to Integrate Assets Quickly & Remain Agile • Growing portfolio of assets, slow to integrate • Lack of Stability and Operations Management • Difficulty stabilizing infrastructure, tuning, and providing transparent high-quality service levels
- 6. Overview of Cloud Identity Services
- 7. IBM Cloud Identity Services – What Is It? • The IBM Cloud Identity Services provide clients with a unique way to acquire Identity and Access Management technologies – as a multi-tenant service, offered from the public cloud. • The IBM Cloud Identity Services are based upon IBM’s market-leading IAM software products (e.g. ISAM, ISIM, FIM, etc), providing clients with enterprise class IAM capabilities in a cost- effective, timely, and agile cloud delivery model. Cloud Identity Services
- 8. IBM Cloud Identity Services - Tackling Our Clients’ Most Critical Challenges Reduce total cost of ownership Improve agility and flexibility Expedite deployment Reduce skills requirements Reduce ownership costs over on-premises infrastructure • Infrastructure (hardware, software) • Personnel costs • Maintenance, operations, support • Soft costs (opportunity, agility, etc.) Enable ability to act and respond more quickly and nimbly • Policy and progress changes • Asset integration Get our clients to their desired end state more quickly • Start-up time / time-to-value • Upgrade and maintenance lifecycle • Dependency value Reduction in need for specialized skills • Acquisition • Training • Retention
- 9. Identity Management Access Management Identity Federation User provisioning Automated lifecycle management User self-service Role governance and compliance Web single-sign-on Centralized access control policy Strong authentication Federated SSO Business-to-business federation Full spectrum of IAM capabilities delivered from the Cloud Key Statistics 14M+ users 57+ countries of user origin Millions of hourly transactions Enterprise, B2B,and B2C users Capabilities and Technology Comprehensive Cloud-based IAM solution built upon IBM’s best-in-class IAM software Global delivery capabilities provided by IBM’s market leading Managed Security Services Unlike competitive cloud IAM services, IBM’s Cloud Identity Service provides deep functionality for enterprise clients Automation and templates result in rapid integration and faster time to value IBM’s Cloud Identity Service provides a less expensive and faster-time-to value alternative to traditional IAM deployments IBM Cloud Identity Service at a glance
- 10. IAM from the Cloud Cloud Identity Services IBM Cloud Identity Services can be utilized to outsource an organization’s full or partial IAM infrastructure to the cloud Eliminates the need for the client to deploy and maintain on-premise IAM infrastructure. Can integrate with enterprise applications and directories, providing equivalent capabilities of market-leading IAM software suites. Attractive to clients who are looking to minimize costs, time to deployment, improve organizational agility, reduce in-house specialized skills, and plan with greater confidence. Attractive to green-field deployments of IAM or migrations (moving clients from their on-premise IAM infrastructure, regardless of vendor, to the cloud).
- 11. IAM for Cloud, Mobile, and Social Cloud Identity Services IBM Cloud Identity Services can be utilized to bridge / extend client IAM infrastructure to new cloud, mobile, and social use cases. Enables clients to extend existing IAM infrastructure for new cloud, mobile, or social use cases without the need to rip-and-replace on-premise IAM infrastructure. Provides a cost-effective and timely solution for clients looking to garner new value from their existing IAM infrastructure or the IBM Cloud Identity Services platform.
- 12. A New Unified and Integrated Service Management Strategy • Globally Integrated Management • Global Infrastructure Platform – IBM SoftLayer • Unified Software Development Lifecycle Management – IAM Software Development – Cloud Identity Services Software Development • Professional Services – IBM Global Technology Services Infrastructure • Compute • Storage • Networks • Cloud IaaS Software • IAM Software • Development • Testing • Quality / Certification Services • Delivery • Operations • Support • Project Management IBM Global and Integrated Management IBM is able to offer a completely horizontally and vertically integrated set of services spanning infrastructure, software, and services due to the acquisition of Lighthouse Security Group, while strategically integrating the company’s people and assets into IBM’s Global Technology Services (GTS) and Software Group (SWG).
- 13. Capabilities and Technology Overview
- 14. Capabilities - High Level Overview of the Strategic Platform • Identity Management • User Provisioning – 70+ App / Protocol Connectors • Identity Lifecycle Automation • Self Service – User Registration – Password Reset – Username Recovery – Profile Management – Delegated User Management – Access Request & Approval – Recertification Approval • Identity Governance – Dynamic Role Provisioning – Recertification – Approval Workflow • Audit & Reporting • Ad-Hoc Reporting – 100+ Audit Event Types – Graphical, Text, and Drill-Down – Report Scheduling • Audit Feed – Semi-Real-Time Audit Event Data Feed to Client SIEM or RDBMS Web Access Management – Authentication • UID/PW Forms, Basic Auth, X.509, and others OOTB – Single Sign On (SSO) • SSO via HTTP Headers, Kerberos, PKI X.509, Credential Vault, and others OOTB – Authorization • Group, Role, and Attribute Based Authorization Policies • URL Stateful Inspection by Proxy Federation – IdP and SP Capabilities – SSO to SaaS Applications and Private 3rd Parties – Federated Provisioning with 3rd Parties – Security Token Service (STS) for Credential Issuance, Validation, and Exchange – SAML, WS-Fed, Oauth, OpenID, and others. – Social Network Federation (Facebook, Google+, Twitter, etc) API and Misc. – REST API Provides Programmatic Access to All Functions of the Service (e.g. user, role, and policy management). – API Supports Native Mobile App Integration. – Akamai Edge Network Integration Support
- 15. Web Access Management and Federation Use Cases
- 16. Identity Management Use Cases
- 17. Cloud Data Center Operations On Board Services Methodology Repeatable processes for onboarding enterprise customers IBM Cloud Identity Services Framework Strategy IBM Security Identity & Access Management Platform Technology Middleware Automation and Multi-tenancy (Compilers, rules engines, controllers, logical and physical asset management, integration layer, data access layer) Governance and Self Service Software (Web Administration Console – J2EE and Flash / Flex UI, self service apps – portal, registration, password reset, and username recovery)
- 19. Deployment Highlights • Public Cloud • By default, IBM Cloud Identity Services is offered as a “Public Cloud” offering – meaning, clients will connect to it via network (e.g. site-to-site VPN and/or WAN connections) and simply use its services remotely. • Multi-Tenant • By default, nearly all components of the IBM Cloud Identity Service is offered in a multi-tenant manner. This means: – Clients have their own logical instances of services; they will share physical instances of hardware and base software with other clients, leading to economies of scale. – Client data will coexist on physical hardware, but it will be logically isolated, and appropriate access controls will prevent comingling or bleed-over between tenants. – Clients may select optional subscription services that permit them to have completely separate LDAP directories (dedicated) where coexistence with other client directory data is not acceptable. – Certain optional components of the system may only be deployed in a single-tenant fashion for scale, security, or other rationale. • Integration with On-Premise IAM • The IBM Cloud Identity Service may be used completely independent of any other IAM system, as is the case with most client deployments; however, clients may also opt to integrate the service with one or more existing on-premise IAM products or services (e.g. the Cloud Identity Service may integrate with an on- premise IDM platform to consume identity data as a Source of Record).
- 21. Client On-Ramp Process • Client On-Ramp Guide • Master Design Artifact (MDA) • Defines the Process • Orients Stakeholders • Educates Client on System Capabilities and Options • Captures Client Configuration Choices • Captures Client Sign-Off Incrementally during Process
- 22. Client On-Ramp Goals • Educate the Client • Clients must be educated on system capabilities, limitations, and options to ensure they are a long-term, satisfied subscriber. • Set Expectations • Clients must be given a clear set of expectations including time-frame and responsibilities. • Coordinate All Stakeholders • Clients must have clear insight into stakeholders, their roles, and impact to the project. • Control the Process • The process must be controlled in a manner that is proven and has risk mitigation embedded. • Expedite Delivery of Services • The ultimate goal is to bring the client live as quickly and safely as possible.
- 23. Comprehensive Master Design Artifact (MDA) Master Design Artifact (MDA) A comprehensive Master Design Artifact (MDA) guide within the On-Ramp process captures all details regarding the client’s Cloud Identity Service configuration. Education along the way ensures the client understands their options and system capabilities. Sign-offs ensure agreement and ability to move ahead.
- 24. Education and Workbook Education Followed by Workbook Exercise Education and Workbook Exercises The guide provides client education on system capabilities followed by workbook exercises to capture the client’s desired configurations. IBM staff configuration manage the workbook and all selected options.
- 25. MDA Sign-Off Process Incremental MDA Sign Off Clients “sign-off” on chosen configuration options along the way to ensure: Client understands options chosen IBM and client are in agreement Progress on configurations can be incrementally carried out in a rapid fashion The sign-off process also protects the client and IBM from thrashing (change in configuration) during the on-ramp.
- 26. Operations
- 27. Highly Available Services • Highly Available • All IBM Cloud Identity Services are designed for High Availability, with redundancies including: – Clutered applications – Dual network paths (bonded NICs) – RAID storage arrays / SANs – Replicated LDAP servers – Clustered RDBMS – Multiple ISP paths • Disaster Recovery • All IBM Cloud Identity Services are replicated daily to off-site warm-standby Disaster Recovery (DR) systems, including: – Full System VMs – Configuration Data – Identity Data – Event and Audit Log Data • Uptime • The IBM Cloud Identity Services are designed for 99.9% or greater uptime.
- 28. IBM Cloud Identity Services Locations • Sites: • Stamford, CT • Dallas, TX • San Jose, CA • London, UK • Paris, France
- 29. Client Experience – VantisLife Insurance Company
- 30. Who is Vantis Life? • Life insurance and annuities through financial institutions • $5 billion of life insurance in force • $900 million in assets • Vantis products sold by appointed bank and credit union employees • 85% of business processed through web-based broker-agent portal
- 31. Our Challenges • VantisLife experienced significant growth from 2004 thru 2007, driving the organization to change a number of ways it did business. • Because the web accounts for Vantis’ most significant route to market, many of these changes in business process, tooling, and capabilities centered around Information Technology and our web presence. • Vantis’ business is largely broker-based, requiring broker agents to book and manage business (e.g. policies) through Vantis’ agent portal. • 30 bank/credit union partners in CT to 100+ nationwide • 300 broker / agent users to more than 5,000 institutional users • Supporting conventional IAM around Vantis’ agent portal was becoming laborious – consuming both time and limited IT resources • Manually provisioning agent accounts • Managing credentials manually • Granting application access • Maintenance of organically built IAM environment • Authentication - labor intensive • Buried in forms, paperwork, timeliness
- 32. Challenges – continued • Tooling and Efficiency • Vantis determined it needed a smarter approach to IAM • New approach required: – Less manual process and overhead on limited IT staff – Ability to delegate certain identity functions to brokers and agents (e.g. Self Registration, Password Reset, Account Management). – Ease of implementation – no sharp learning curve or long-term overhead for on-going skills and management of the IAM system. • Security and Compliance • Height of financial crisis – 2008 timeframe • Vantis’ larger banking partners were becoming increasingly sensitive to IT measures around security and compliance. • Vantis wished to strategically position itself to be ready for increased focus on security, compliance, and potential new regulatory measures.
- 33. Decision-Making Process • Vantis considered a number of options to address its strategic initiative of increasing security and compliance, as well as IAM tooling and efficiency: • Organically Built IAM – Continue with organic IAM software strategy – build and maintain in- house • Traditional IAM Deployment – Procurement, build-out, and management of a commercial vendor on- premise IAM solution • Cloud IAM – Procurement and integration with a cloud-based IAM solution • Vantis had previously built an organic IAM solution consisting of various capabilities: • Authentication and Authorization • User and Group Management • Single Sign-On (SSO) • Vantis weighed its options regarding organic, traditional commercial deployment on-premise, and cloud (Software-as-a-Service)
- 34. Our Solution • Vantis determined its values for a next generation IAM system would be: • Total Cost of Ownership (TCO) – Vantis was seeking a cost-effective approach to IAM that enabled the business to achieve enterprise-grade IAM while doing so on a budget • Skills – Vantis was seeking a solution that would not force an investment in on-staff skills in complex IAM technologies • Time-to-Deployment – Vantis had a critical time-frame with two large banking relationships dependent upon the availability of its new IAM platform • Security – Vantis was seeking a solution that could raise the bar in its security and compliance standards, which was consequently being sought by the company’s banking partners • Scalability – Vantis was seeking a solution that would easily grow with its rapidly expanding business, including both technical scale but also availability of features/functions that may become necessary as its business needs expanded • Engaged IBM (formerly Lighthouse Security Group) for security review • State of existing technology – effectiveness of controls in authentication, authorization, auditing, and identity/credential management • Made decision to go with IBM Security Access Manager for Web (formerly Tivoli Access Manager for e-Business) and Tivoli Federated Identity Manager • Made decision augment IBM SW with a Cloud solution (IBM Cloud Identity Service) • Provided added benefits of lower TCO, lesser on-staff skills requirement, and quicker time-to- deployment • Three (3) years of cloud services were deemed less expensive than initial on-premise deployment IBM CON
- 35. Our Solution – continued • Vantis Internal Discussions and Decision Criteria: • Concerns regarding being an early adopter – IBM Cloud Identity Service (formerly Lighthouse Gateway) was only just launched • Was the cloud secure? • With heightened sensitivity to security (height of financial crisis), how would our partners perceive our decision? – Impact for new banking partners as well as review of our strategic shift to cloud for existing partners • Concerns regarding how our external auditors may evaluate a decision to use cloud IAM • Requirement for Vantis key decision makers (COO and VP of IT) to achieve buy-in on a cloud IAM strategy from its Board of Directors
- 36. Cloud Identity Services Our Deployment Experience • Contract Process Considerations • Service Level Agreements • Out-Year Affordability – Post initial three year term cost considerations • Data Privacy – controls, policies, and measures in the subscription agreement • Deployment Process • Deployed in 6 six weeks – contract signing to go-live • IBM / Lighthouse professional security services performed integration and configuration work in cooperation with Vantis’ application owners – Branding / look-and-feel for user-facing web pages of the system (e.g. login, self service, etc) – Integration of Vantis’ initial top 3 web applications – Testing – functional and regression – User experience planning – e.g. initial self registration of all broker agents • Seamless transition for all users • Necessity to have a smooth on-boarding process for brokers – simple to use, self explanatory… just plain works! • Provided a better life experience for our users IBM CON Policy Quotes Application Process Account Mgmt.
- 37. Expansion of Services • B2C Expansion • Vantis had initially launched its IBM CIS (Lighthouse Gateway) services for B2B – its broker agents • Vantis had top-down direction to begin supporting B2C use cases with its web presence (e.g. selling direct to consumer) • Vantis quickly deployed a secondary instance of the IBM Cloud Identity Service for its consumer-facing web applications and users. – Policy Quoting – Application Process – Limited Account / Policy Maintenance • Federated SSO Use Case Expansion – Quicklife • Vantis had requirements to expand its IAM solution to begin supporting federated use cases with multi-partner quoting platform (Quicklife) • Vantis needed to establish ability to act as a federated Service Provider (SP) – Ability to seamless provide quotes into third-party quoting platform (Quicklife) – Ability to seamlessly allow Quicklife agents to SSO into Vantis agent portal (Agentweb) to continue the policy booking process – Ability to support all federated use cases with standard SAML assertions and protocol • Easy implementation
- 38. Future Enhancements • Enhanced Self Service • Delegated User Administration – Leveraging Cloud Identity Service (CIS) Self Service Portal’s delegated user administration functions – Allowing “power users” at brokers to manage their own VantisLife agent users on our system • Self Service Access Request – Leveraging CIS Self Service Portal to enable agents to electronically request access to applications and/or application roles within the VantisLife portfolio of web apps. • Identity Governance • Recertification – Leveraging CIS recertification capability to begin pushing agents through an electronic access recertification process IBM CON
- 39. An Early Success • Utilizing IBM’s Cloud Identity Service, VantisLife was able to: • Deploy an enterprise class IAM solution in under six weeks • Avoid significant costs traditionally associated with IAM platforms • Keep its IT staff focused on projects that enable VantisLife to be a competitive life insurance company • Provide its users with an intuitive, easy-to-use platform to manage their identities and associated access to VantisLife applications • Position the company for future growth, including the ability to rapidly “turn on” new IAM capabilities as demand requires • Help “Future-Proof” the company’s compatibility with emerging technologies, standards, and regulatory requirements 38
- 40. Engaging
- 41. Engagement Process Initial Scoping • Client provides IBM with an overview of project requirements. • IBM provides client with education on Cloud Identity Services features and capabilities. • IBM performs initial scoping of required features, user counts, integrated applications, and options. Non-Binding Initial Estimate • Estimate of project costs (including services and subscription) based upon initial scoping. • IBM may present estimates as a range along with other information to help the client understand potential drivers in the estimate. SOW Scope Workshop • If the provided estimate is deemed accepted to the client, IBM will perform a SOW Scope Workshop. • Half-to-full day workshop is performed at client site with key stakeholders to drill into project specifics. • The workshop is intended to allow IBM to produce a detailed SOW and refined pricing information. SOW • An executable SOW is drafted and delivered to the client, along with any Terms and Conditions, for signature.
- 42. Questions and More Information • Contact: • IBM Security – Eric Maass Director, IAM Strategy emaass@us.ibm.com – Ed Terry Cloud Identity Sales Leader eterry@us.ibm.com On the web: http://www-935.ibm.com/services/us/en/it-services/security- services/cloud-identity-service/
- 43. Notices and Disclaimers Copyright © 2015 by International Business Machines Corporation (IBM). No part of this document may be reproduced or transmitted in any form without written permission from IBM. U.S. Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM. Information in these presentations (including information relating to products that have not yet been announced by IBM) has been reviewed for accuracy as of the date of initial publication and could include unintentional technical or typographical errors. IBM shall have no responsibility to update this information. THIS DOCUMENT IS DISTRIBUTED "AS IS" WITHOUT ANY WARRANTY, EITHER EXPRESS OR IMPLIED. IN NO EVENT SHALL IBM BE LIABLE FOR ANY DAMAGE ARISING FROM THE USE OF THIS INFORMATION, INCLUDING BUT NOT LIMITED TO, LOSS OF DATA, BUSINESS INTERRUPTION, LOSS OF PROFIT OR LOSS OF OPPORTUNITY. IBM products and services are warranted according to the terms and conditions of the agreements under which they are provided. Any statements regarding IBM's future direction, intent or product plans are subject to change or withdrawal without notice. Performance data contained herein was generally obtained in a controlled, isolated environments. Customer examples are presented as illustrations of how those customers have used IBM products and the results they may have achieved. Actual performance, cost, savings or other results in other operating environments may vary. References in this document to IBM products, programs, or services does not imply that IBM intends to make such products, programs or services available in all countries in which IBM operates or does business. Workshops, sessions and associated materials may have been prepared by independent session speakers, and do not necessarily reflect the views of IBM. All materials and discussions are provided for informational purposes only, and are neither intended to, nor shall constitute legal or other guidance or advice to any individual participant or their specific situation. It is the customer’s responsibility to insure its own compliance with legal requirements and to obtain advice of competent legal counsel as to the identification and interpretation of any relevant laws and regulatory requirements that may affect the customer’s business and any actions the customer may need to take to comply with such laws. IBM does not provide legal advice or represent or warrant that its services or products will ensure that the customer is in compliance with any law.
- 44. Notices and Disclaimers (con’t) Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products in connection with this publication and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products. IBM does not warrant the quality of any third-party products, or the ability of any such third-party products to interoperate with IBM’s products. IBM EXPRESSLY DISCLAIMS ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. The provision of the information contained herein is not intended to, and does not, grant any right or license under any IBM patents, copyrights, trademarks or other intellectual property right. • IBM, the IBM logo, ibm.com, Bluemix, Blueworks Live, CICS, Clearcase, DOORS®, Enterprise Document Management System™, Global Business Services ®, Global Technology Services ®, Information on Demand, ILOG, Maximo®, MQIntegrator®, MQSeries®, Netcool®, OMEGAMON, OpenPower, PureAnalytics™, PureApplication®, pureCluster™, PureCoverage®, PureData®, PureExperience®, PureFlex®, pureQuery®, pureScale®, PureSystems®, QRadar®, Rational®, Rhapsody®, SoDA, SPSS, StoredIQ, Tivoli®, Trusteer®, urban{code}®, Watson, WebSphere®, Worklight®, X-Force® and System z® Z/OS, are trademarks of International Business Machines Corporation, registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at: www.ibm.com/legal/copytrade.shtml.
- 45. Thank You Your Feedback is Important! Access the InterConnect 2015 Conference CONNECT Attendee Portal to complete your session surveys from your smartphone, laptop or conference kiosk.
Editor's Notes
- #10: Lighthouse Security Group at a glance Industries in left to right order: Business Services: Pitney Bowes, United Group Limited Insurance / Finance: VantisLife Insurance Company, Countrywide Insurance Company, Quincy Mutual Consumer Goods / Retail: Molson, Coors, Campbell’s, Kohl’s Healthcare: eVariant, Baxter Higher Education: Capella University Media / Publishing: Scholastic Automotive: Ford
- #18: Unlike other cloud IAM offerings, which may have been recently built from the ground-up and offer limited capability, maturity, and tend to lack breadth of IAM features, IBM’s cloud identity offering is built on-top of the world’s leading IAM software from IBM. This provides IBM’s cloud identity offering with more than a decade of solid, market-tested and proven software at its foundation. The cloud identity offering’s IBM foundation has been “put to the test” with thousands of successful deployments world-wide, servicing many of the world’s largest organizations and holds a long-running position as the most widely deployed IAM software world-wide. Furthermore, IBM’s Cloud identity offering is flexible and extensible for enterprise clients who don’t fit in tight box.