Our SaaS CloudSSO – par excellence

Essentially that is what it is. Recently we announced our Force.com based Cloud SSO solution. What is unique about this is that we are the first (and as of now the ONLY) solution that will allow Force.com user identities to be federated not only across Force.com applications, but also across other cloud providers as well.

We provide Identity for the cloud in the cloud – now that is different, isn’t it?

I know, I know… there are about half of a dozen vendors that claim to provide a Cloud SSO solution. So why are we different or better than the others?

We provide a fusion, bringing together the best of McAfee and Intel.   We bring years of advanced security research ,  our multi-tenant offering cloud security suite from McAfee, coupled with Intel’s Identity offering that includes SSO, hardened provisioning/de-provisioning and an escalated authentication (OTP) solution.

Everyone knows that salesforce.com is all about the cloud and SaaS, right? But once you set up your users/ identities in the Force.com platform it can be only used there. If you need to setup another SaaS application then your administrator needs to setup the user base all over again. Even though there are tools available to make this process easier it is still a chore. Imagine if you could have the power to set up the identities and policies once and run forever. If your users have to remember only ONE password then you could enforce the passwords to be very strong. This would not only reduce the security risk (imagine a SaaS application having a weak password… what can be more dangerous than that) but it could also help with eliminating a lot of help desk password reset calls from frustrated users.

One pivotal and unspoken benefit is the  increase in productivity where a user can seamlessly navigate between applications.

Our solution also includes a hardened, proven provisioning/ de-provisioning which takes care of syncing identities across applications and across multiple cloud providers. And there is also a built-in escalated authentication of identity using a second form factor which comes in handy when someone tries to use sensitive applications. Our OTP (One Time Password) solution allows the users to provide the second factor (of what you have in addition to what you know).

If you missed our recent announcement about the beta release at RSA check it out here.

http://www.networkworld.com/news/2012/022712-intel-cloud-sso-256621.html

http://software.intel.com/en-us/blogs/2012/02/27/introducing-cloud-idaas-intel-cloud-sso/

For more details check us out IntelCloudSSO.com

Andy Thurai — Chief Architect & CTO, Application Security and Identity Products, Intel. Andy Thurai is Chief Architect and CTO of Application Security and Identity Products with Intel, where he is responsible for architecting SOA, Cloud, Governance, Security, and Identity solutions for their major corporate customers. In his role he is responsible for helping Intel/McAfee field  and technical teams and customer executives. Prior to this role he has held technology and architecture leadership and executive positions with L-1 Identity Solutions, IBM Datapower, BMC, CSC, and Nortel. His interests and expertise include Cloud, SOA, identity management, security, governance, and SaaS. He holds a degree in Electrical and Electronics engineering and has over 20+ years of IT experience.

 

 

 

Cloud Access 360 2.0 version released

We’re happy to announce general availability of Intel Expressway Cloud Access 360 (ECA 360) 2.0 release. This new release adds a range of exciting new features designed to simplify and improve our customers ability to manage user’s access to popular cloud applications. Key new features and benefits include:

Built-in SSO portal

An out-of-box SSO portal is available with the product that can run standalone or embedded inside
existing portals such as Sharepoint. Users authenticate once to the portal
and enjoy convenient, seamless SSO access to any authorized cloud app. As SSO
portals expose keys to the kingdom, login to it can be protected with 2-factor
authentication using mobile based One Time Password (OTP) offered through the
bundled OTP module.

More connectors

New out-of-the-box connectors are  available for popular cloud apps such as Microsoft Office365, Cisco WebEx,
Box.Net, Service-Now, SugarCRM, Zoho, EchoSign, Schoology, and Joomla.

Transparent HTTP
form-based SSO

Not every SaaS application
support SAML based federation today. This feature allows customers to bring non-SAML
apps into the SSO portal providing convenient, seamless access to users and
enabling IT to achieve better control and visibility on SaaS application
usage. This is achieved by enabling users to register user ID and password
once on a web site and capturing the data for transparent SSO the next time the
user accesses the app. The process is transparent to the user as they don’t even
see the log-on screen.

Salesforce as an Identity
Provider

Instead of authenticating the user against Active Directory, ECA 360 allows the user to be authenticated using
Facebook, Google, Yahoo, and any OpenID provider. With this release, Salesforce
as an Identity Provider has been added to this list. This enables our customers
to let its contractor, partner and affiliate users to login into ECA 360 SSO
portal using Salesforce credentials and further access cloud applications
they are authorized to access.

Enterprise-class
scalability

ECA 360’s ability to support more than 10,000 concurrent user authentications has been tested and
verified.

Higher performance and
availability

ECA 360 administrators can now run multiple instances in a clustered environment.

Other improvements

These include: support for short URL entry in a mobile browser, new
compliance reports, and various bug fixes.

To learn more about the new and improved ECA 360 v2, please visit our web site at www.intel.com/go/identity.

Trusted Client to Cloud Access

Cloud computing has become an integral part of all IT decision making today across industries and geographies. This market is growing at a rapid pace. By 2014, IDC expects public cloud spending to rise to $29.5 billion growing at 21.6 percent per year. At the same time, Forrester predicts the cloud security market to grow to $1.5 billion by 2015. This is good news, yet there are many CIOs sitting on the fence and not jumping on the opportunity cloud computing presents as they worry about security of data and applications. The figure below lists survey results from top CIOs when asked about their top of mind concern for using cloud services by TechTarget.

Loss of control, Compliance implications, and Confidentiality and auditing topped the results. Under these 3 themes, the issues they listed are:

•          They find it hard to trust cloud providers security model

•          Manage proliferation of user accounts across cloud application providers

•          Extended enterprise boundary complicates compliance

•          Shared infrastructure, if the cloud gets hacked so do you

•          Audit log silos on proprietary cloud platforms

This blog post lists a potential solution to address these issues and more.

Security Layers

First, lets look at the various layers that are required to secure cloud applications and data.

You need to protect applications and data for assurance and compliance, access control, and defend against malicious attacks at the perimeter. Yet, the weakest link remains the client as malware and phishing attacks can send requests as if it were coming from a human user. To achieve end-to-end security, you need to look holistically at how to provide “trusted client to cloud access”. You can watch a webinar on this topic I recently did with security expert Gunnar Peterson.

Solution

One solution to this problem is to have a trusted broker that provides the glue between client security and cloud security. It should be able to determine if cloud applications are being accessed from trusted and attested client devices or not, and block access from all non-trusted clients. One way to get client attestation is through Intel® Identity Protection Technology (IPT) which embeds 2nd factor authentication in the processor itself.

While a trusted broker enforces above check it should also be able to provide supplemental security on top of what cloud applications provide by offering:

  • Federated Single Sign-On (SSO) using industry standards such as SAML, OAUTH and OpenID
  • 2 factor strong authentication with convenient soft OTP token support
  • Elevated authentication (term to represent step-up authentication on a per request basis, coined by Mark Diodati of Burton group in his latest report on Authentication Decision Point Reference Architecture)
  • Automated account provisioning and deprovisioning with automated identity attribute synchronization to ensure that all identity attributes across enterprise and cloud applications never go out-of-sync
  • Centralized audit repository with common audit record across cloud applications
  • Orphan account reporting to catch unauthorized account creation by administrators in cloud applications
  • And, a single dashboard to get 360 degree visibility on how cloud applications are being accessed by users (aka user activity monitoring)

Such a “Trusted Broker” software can insure that Enterprises adopt cloud applications providing tools to achieve “Control, Visibility, and Compliance” when accessing cloud applications. View  more on Intel’s solutions in this space.

Industry initiatives

Cloud Security Alliance (CSA) is working feverishly to provide awareness and guidance with reference implementations to address some of the security concerns listed earlier in this blog post. At the CSA summit 2011 held at RSA conference 2011, I presented a roadmap for Trusted Cloud Initiative (TCI) which is one of the sub groups of CSA. In it’s reference architecture, TCI lists the following use cases for trusted access to the cloud.

TCI also published a whitepaper covering identity and access control for cloud applications.

Summary

While cloud application providers continue to enhance their security posture, it’s in the best interest of enterprises to supplement it with additional security controls using technologies such as “Trusted Broker” that enable end-to-end secure client to cloud access and provide 360 degree visibility and compliance into how various cloud applications are being accessed by enterprise users. One such implementation of a “Trusted Broker” is provided by Intel Expressway Cloud Access 360 product. Visit http://www.dynamicperimeter.com to learn more.

 

Vikas Jain, Director of Product Management for Application Security and Identity Products with Intel Corporation has over 16 years experience in the software and services market, with particular expertise in cloud security, identity and access management, and application architecture. Prior to joining Intel, Vikas has held leadership roles in product management and software development at a wide-range of technology companies including Oracle, Oblix, Wipro and Infosys.

You can follow him on twitter @ VikasJainTweet

 

Follow

Get every new post delivered to your Inbox.

Join 139 other followers