RSA SECURID ACCESS

SIDFLIX SERIES:
ZERO TO HERO WITH SECURID

Craig Dore Vinod Nair

Lead IAM Strategist – RSA APJ Lead Presales Architect – RSA APJ
Australia | New Zealand | SE Asia | India | Korea | Japan Australia | New Zealand | SE Asia | India | Korea | Japan
craig.dore@rsa.com vinod.nair@rsa.com

 Internal Use - Confidential

 STARRING

Craig Dore Vinod Nair

2
Lead ID Strategist, APJ Lead ID Architect, APJ
 Internal Use - Confidential
 IN THE PREVIOUS EPISODE…
A Quick Recap

 Internal Use - Confidential

 WHAT WAS CO VERED…
TOKEN PROFILES Best Practices:
• Use “Over the Air” Provisioning!
OR
• Typically requires the RSA Web Tier Software
• The most secure way and automated method to distribute software tokens
• Provides Email or QR Code activation

SIEM and SNMP Best Practices:

• Use SIEM for security alerting and correlation
• Use SNMP for system health
• Use RSA for specific guidance
• Online Help is invaluable here

Quick Search and Dashboard Efficiency Tips:

• Click the ‘Home’ button and do a quick search for a user
• Dashboard is everything you need to manage / view user info
• The username at the top includes a fly-out menu for additional settings/assignment

The RSA Link Community An amazing resource:

• Community forums – ask questions!
• Better yet, ANSWER QUESTIONS too! Are you an expert?
• Encourage your customers to use
• Live Tech Support chat coming soon!
4

 Internal Use - Confidential

 CONGRATS!

 Internal Use - Confidential

 DOUBLE
CONGRATS!

 Internal Use - Confidential

 EPISODE 2 :
What’s This Cloud and MFA Stuff?

 Internal Use - Confidential

 AGENDA SI DFLI X EP ISO DE 2:
W H AT ’ S T H I S C L O U D A N D M FA S T U F F ?

 Introducing the SecurID Access Cloud Authentication Service

 What does the Cloud Service Do?
 Main Components
o “MFA”
o The Scary Sneaky Identity Router
o Conditional Access Policies
o Identity Sources
o My Page – Self-service
o The Risk Engine
 Tying it together
 And… what’s next?

8 C O N F I D E N T I A L

 Internal Use - Confidential

 LET’S HAVE A QUICK ‘SELLING’
CONVERSATION

 Internal Use - Confidential

 Agnostic Hybrid Threat aware

• Not tied to a • Deploy anywhere • Risk-based and

single technology • Resilient failover real time
stack capabilities
VPN • Combat insider
• RSA covers the • Provides threat
‘100%’ – users, coverage for • 360o awareness –
applications, cloud, perimeter network,
privileges and on-prem application and
• Zero-trust by devices
default • Provides a means
to eliminate
phishing

10

 Internal Use - Confidential

 All SaaS users are mobile users

11

 Internal Use - Confidential

 12

 Internal Use - Confidential

 SO ME STAT S

“63% of breaches stemmed from

compromised or stolen credentials”

“81% of breaches stemmed from

compromised or stolen credentials”
“Stolen credentials / phishing remain the
number one attack vector.”
13

 Internal Use - Confidential

 R S A S E C UR I D A C C E S S – M O D E RN M FA

 Single MFA licence includes all of these MFA methods

Provisionless TouchID® / FIDO

Push Notification FaceID®
OTP (1 tap approve) (iPhone X+) Samsung FP
(U2F +
(Token) Passwordless)

MODERN MFA
R S A14 A u t h S o l u t i o n s
 Internal Use - Confidential
 REMEMBER
THIS
STUFF?
TOKEN PROFILES Best Practices:
• Use “Over the Air” Provisioning! CTKIP, blah blah…
• Typically requires the RSA Web Tier Software
OR
• The most secure way and automated method to
distribute software tokens
• Provides Email or QR Code activation
• Needs profiles to specify distribution method, etc.

15

 Internal Use - Confidential

 I N S TA N T O N B O A R D I N G

User signs in Scans QR. Done.

16

 Internal Use - Confidential

 SE CURID ACCES S CAPABI LITI ES
Pervasive MFA Risk and Context
Certified and supported Access and Machine Learning

MACHINE
LEARNING
RISK PASS RISKY DENY

Role Device Location Behavior App

Push Mobile OTP Biometrics Text Msg Voice Call

Risk
HW Token SW Token FIDO Proximity Wearables
Security

Modern MFA Methods Assurance Levels

Secure and Convenient Challenge according to the level of risk or privilege

17

 Internal Use - Confidential

 MFA to Secure Admins
MFA to Secure VPNs MFA to Secure Cloud Apps & Privileged Access

MFA with Next Gen Firewalls Identity Assurance with

18 (Palo Alto Networks) VMware Workspace ONE
 Internal Use - Confidential
 19

 Internal Use - Confidential

 20

 Internal Use - Confidential

 LET’S GET INTO IT
What does the Cloud Authentication Service provide?

21

 Internal Use - Confidential

 CLO UD SERV ICE SUMMARY
Modern MFA
MFA App called SecurID Authenticate
o Non-expiring soft token
o Push-to-Approve
o Biometric
Desktop PC MFA
HW FIDO Support (e.g. Yubikey), SW FIDO coming soon
SMS Telephony (Voice/SMS OTP)
Support for existing SecurID Token fleet (HW, SW, OnDemand)
Risk and Policy Engine
• Real-time and automated machine learning engine
o Looks at dozens of attributes, makes 1000
correlations for every access request
o SIEM can be utilised to alert on high risk events
• Conditional access policies use any LDAP attribute,
Network ranges, Geolocation, Country, Trusted
Browser, Authentication Sources
22
 Internal Use - Confidential
INTEGRATIONS
• SAML v2 (IDR IDP)
• SAML v2 (Cloud IDP) (aka Federation or Relying party
• RADIUS
• APIs (Auth, Event, Administration)
• Windows 10 MFA Agent
• MacOS MFA Agent (coming soon)
• Many direct-to-cloud RSA Agents (e.g. Citrix Storefront,
Linux)
Benefits
• Reduced on-premise footprint to manage
• Instant on-boarding of MFA and FIDO users
• Hugely flexible, hybrid with many points of
redundancy
• Fits into Enterprise ecosystem (Apps, Monitoring,
Helpdesk, SIEM, etc.)
• Patching is automated; Features added constantly
 A U T H E N T I C AT O R S A P P L I C AT I O N S

Cloud

On-Prem
VPN 500+ certified integrations.
Thousands more supported
PAM through open standards
SID700
SID800
SID900
WAM
HW Token

iOS Desktop
Android Authentication
Windows Traditional OTP Agent / RADIUS / SDK VDI
Mac OSX
SW Token
Manager
SDK Network

Gateway Legacy
HTTP
ODA/RBA

23

 Internal Use - Confidential

 B E S T I D E N T I T Y A S S U R A N C E P L AT F O R M
Dynamic Identity Confidence Scoring Policy & Context
A U T H E N T I C AT O R S A P P L I C AT I O N S

Behavior Location Device External Role Application Preference

FIDO Push SaaS

RISK PaaS

IaaS
Proximity Mobile OTP
Modern MFA
Cloud Authentication
SAML / WS-Fed / OIDC
Service Web

Mobile

Modern MFA
Wearables Biometrics

Traditional OTP
Cloud

On-Prem
SMS Voice Call
VPN 500+ certified integrations.
Thousands more supported
PAM through open standards
SID700
SID800 Identity Router WAM
SID900
HW Token

iOS Desktop
Android Authentication
Windows Traditional OTP Agent / RADIUS / SDK VDI
Mac OSX
SW Token
Manager
SDK Network

Gateway Legacy
HTTP
ODA/RBA

24

 Internal Use - Confidential

 IDENTITY: A MULTI -FACE TED BUSI NESS ISS UE

Cloud 3rd Party Compliance

Adoption Trust
Integration
Costs User
(Time, complexity, Experience
resources)
Operational
Business ROI
Costs
Agility

25

 Internal Use - Confidential

 LET’S GET DIRTY
(Technically speaking…)

26

 Internal Use - Confidential

 WELCOME
TO
CLOUD!

27

 Internal Use - Confidential

 WELCOME
TO
CLOUD!

28

 Internal Use - Confidential

 OUR
FIRST TIP!

29

 Internal Use - Confidential

 YEAH,
U S E T H AT.

30

 Internal Use - Confidential

 FI RST ST EPS .
Create more admins Tips and Best Practices:

• Administrators cannot share the same email across multiple tenants

• Two Roles – Helpdesk and Super Admin – why only 2?
• Admin accounts are not inherited from Identity Source (LDAP) – why?
• Even APIs can have Administrator or Helpdesk privileges
• Be sure to enforce password change at first logon

Get the Identity Router Image Tips and Best Practices:

• You’re not ready to install this

yet…
• Requirements next slide

31

 Internal Use - Confidential

 THE SCARY SNEAKY IDENTITY ROUTER
(Psst, it’s not so scary)

32

 Internal Use - Confidential

 THE IDENTITY ROUTER
Hi there! I’m used to do a
I’m Mr. Identity bunch of things,
Router! My such as talking to
friends call me the Cloud
IDR for short! Service!

33

 Internal Use - Confidential

 THE IDENTITY ROUTER
Yum yum slurrrp.
Hey Mr. Cloud Mmm users. <belch>
Service! I see that Gimme gimme
you’re lonely up gimme…
there. Want some
users?

Hey Mr. Identity

Store! Mind if I
read some users Hey! Yeah dude
from you? here you go!

Hemlata

Enterprise Connector

Identity Store
34

 Internal Use - Confidential

 THE IDENTITY ROUTER
Golly, that was So what else
fun! I just read should I do
10,000 users. Mr. today? Hmm…
Cloud service was
hungry!

35

 Internal Use - Confidential

 THE S NEAKY SCARY IDENTI TY RO UTER
Core Features Tips and Best Practices:

Enterprise Connector (Required) • For rapid prototyping or POC deployments, simply use the EC Mode and add the
• Synchronizes identities other features later
• Sends passwords for validation • Identity Router supports both single and dual NIC configurations. For the easiest
path from zero to hero use the dual NIC configuration.
RADIUS Server (Optional)
• Responds to RADIUS requests
• Includes checklist attributes and return
attributes

Single Sign-On Portal (SSO)) (Optional)

• Protected applications can be displayed
here
• Portal includes an IDR SAML IDP
• REST-based Custom Portal API
available for full customization
• Integrates with an “Integrated Windows
Authentication” plugin for MS IIS
Webserver

36

 Internal Use - Confidential

 THE I DENTITY ROUTE R CONT’D
Requirements
VMWare
• VMWare ESXi 5.5+ + VSphere
• Minimum Disk 54GB
• RAM 8GB (16GB for SSO)
• 4 x Virtual CPUs
• E1000 Virtual NIC (x2 for SSO)
Hyper-V
• Win 2012 R2 or Win 2016
• Minimum Disk 54GB
• RAM 8GB (16GB for SSO)
• 4 x Virtual CPUs
• Synthentic Net Adaptor (x2 for SSO)
37
 Internal Use - Confidential
Requirements Clusters:
• Clusters control which features
AMI Machine Image are enabled
• Start with the default cluster
• Family Type: General Purpose
• Type: t2 Large and create more as needed
• vCPUs: 2 • Each cluster can contain 3 load
• Memory: 8GB balanced IDRs
• Can have up to 12 clusters,
Amazon Cloud Environments more than you’ll ever need
• Access to t2.large or better instance types
• Virtual Private Cloud with private and public
subnets
• Route Tables, Security Groups, and Network
ACLs that allow traffic between the identity
router and all other components in your
deployment
• DHCP Option Sets that specify all DNS
servers required for your deployment
• Elastic IP addresses (if your organization
manages its own DNS service)
 NETWORK RE QUIREMENTS
DNS (UDP 53)

REQUIRED

Public DNS entry and Root-Signed Cert

needed for SSO Deployments

Internal DNS entry recommended but not

strictly required

NTP (UDP 123)

REQUIRED, most envs have one

Syslog (UDP 514)

Optional, but best practice

LDAP Directory (TCP 636)

REQUIRED

Private Interface (TCP 443)

For IDR Management GUI Access
38
* SSH for troubleshoot (TCP 22)

 Internal Use - Confidential

 LET’S GO.

 Username:
idradmin
 Password (shh!):
s1mp13

39

 Internal Use - Confidential

 FRIENDLY
WELCOME
SCREEN .

40

 Internal Use - Confidential

 Enter - TAB -
Data – Enter
- TAB - F10! Don’t you dare
forget to check
this box.

Management IP
address &
gateway.

Did we say F10?

Don’t forget F10!
41

 Internal Use - Confidential

 Don’t
forget to
Commit!

42

 Internal Use - Confidential

 Pay attention to
what it tells you.
You’re not done
yet!

43

 Internal Use - Confidential

 IDR ADMIN
CONSOLE
GUI
• Same U/PW as Console
• Bookmark this thing because:
• It is where the IDR gets registerd
to the cloud tenant
• Final networking config if needed
• It contains log bundle download
for troubleshooting

44

 Internal Use - Confidential

 IDR ADMIN
CONSOLE
GUI
• Confirm network settings
• Can add a transparent proxy
here if needed

45

 Internal Use - Confidential

 CLOUD
GUI
• Initiate a new IDR Setup in the Cloud
GUI

• After config information is entered, a

registration code is displayed.
• Save the following:
• Registration Code
• Authentication Service Domain

46

 Internal Use - Confidential

 IDR MGT GUI
• Click “Connect Administration
Console”
• Fill in the regcode and auth
service domain
• Wait for victory.

• After the registration information is

entered, a series of checks will
progress and the registration
process and post-checks will
complete.

• Common trouble:
• Connectivity
• DNS Resolution
• Do a SSH WGET to the Auth URL from
the IDR (same idradmin account)
• (SSH needs to be enabled in Diagnostics)

47

 Internal Use - Confidential

 Return to the Cloud GUI

• Scroll down and you will see

the System Status area

• Allow ~ 10 minutes ish-ish

• If you see the magic green

circle you are up and running!

48

 Internal Use - Confidential

 CONGRATS!

49

 Internal Use - Confidential

 WHAT’S NEXT?
We’ve got the IDR, but we’re not cool quite yet.

50

 Internal Use - Confidential

 51

 Internal Use - Confidential

  View detailed IDR
status on the IDR
page
 Notice we have
some stuff left to
do… (Identities)
 If Heartbeat is
red…uh oh

52

 Internal Use - Confidential

 One SUPER Important Tip

Blue is “new”

Green is “clean”

53

 Internal Use - Confidential

 WE NEED IDENTITIES!

54

 Internal Use - Confidential

 55

 Internal Use - Confidential

 56

 Internal Use - Confidential

 57

 Internal Use - Confidential

  Vinod to share screenie
 Common issues
 Root DN
 Bind ID
 Email as usern
58

 Internal Use - Confidential

  Vinod to share screenie
 Common issues
 Bind ID
 Email as username

59

 Internal Use - Confidential

  Mandatory

60

 Internal Use - Confidential

 61

 Internal Use - Confidential

 62

 Internal Use - Confidential

 63

 Internal Use - Confidential

 Victory!

64

 Internal Use - Confidential

 OK NOW WE’RE ALMOST THERE
Policies!

65

 Internal Use - Confidential

 Assurance Levels:
• High, Medium and Low
Assurance
• Three buckets for MFA methods
• Up for debate which are high
and low

Policies:
• Control how and when users
auth
• Optionally filter the users that
the rule applies to
• Access can be subject to futher
conditions or rules based on
attributes such as:
• Geolocation
• Trusted Networks
• Country
• Trusted Browser
• Identity Confidence
• High Risk User
• Policies can have a lot of rules,
but simple is better
• Finally, the policy can make the
user’s access subject to step-up
authentication based on
Assurance Levels!
66

 Internal Use - Confidential

 My Page Self-Service
 A 1-stop shop for MFA
and FIDO activation
 Head to Platform > My
Page
 We will configure with our
new Policy, just for test
purposes

67

 Internal Use - Confidential

 LETS ENROLL A USER WITH MFA
Using...a Policy!

68

 Internal Use - Confidential

 69

 Internal Use - Confidential

 70

 Internal Use - Confidential

 ‘ M Y PA G E ’ S E L F -S E RV I C E A P P A CT I VAT I O N

 Pay attention!  Automated: Administrator does nothing other than set up a relevant
policy
Go to GOOGLE PLAY or
 Is secured in many ways (e.g. IP Adress, Group/Role, SMS, etc.)
Apple Store and get:  Customisable Logo
 Pre-deployed in the Cloud
RSA
71
SecurID Authenticate
 Internal Use - Confidential
 ‘ M Y PA G E ’ S E L F -S E RV I C E A P P A CT I VAT I O N

72

 Internal Use - Confidential

 ‘ M Y PA G E ’ S E L F -S E RV I C E A P P A CT I VAT I O N

Conditional Value
Emergency
• Country =
Vietnam
+ Access Code

73

 Internal Use - Confidential

 S u p p or t i n g P o l i c y

74

 Internal Use - Confidential

 RISKY BUSINESS
AKA, “Adaptive Authentication”, “Risk-Based Authentication”, “RBA”,
“Risk Engine”, “User Entity Behavioural Analytics”, “UEBA”, “UBA”

75

 Internal Use - Confidential

 THE RISK ENGINE
Mmm Ken is
cool…mmm yum.
Hi Ken!! Nice to
see you again!
You’re right on
time as usual
and are in the
office early in
Tokyo!

Ken
76

 Internal Use - Confidential

 THE RISK ENGINE
Mmm Ken is
cool…mmm yum.
Hi Ken!! Nice to
see you again!
You’re right on
time as usual
and are in the
office early in
Tokyo!

Ken
77

 Internal Use - Confidential

 THE RISK ENGINE
Mmm Ken is
cool…mmm yum.
Hi Ken!! Nice to
see you again!
You’re right on
time as usual
and are in the
office early in
Tokyo!

Ken
78

 Internal Use - Confidential

 THE RISK ENGINE
Mmm errrr… What is this sorcery?
looks risky, yuck. • Real time monitor
• Machine learning
Hi Ken! Nice to
• Makes 1000 decisions
see you again? for every access request
You’re a bit late • 3 Major categories:
today! And uh, o Location
you seem to be o Behaviour
in Russia? o Device
Привет? • Takes action based on
identity confidence of High
or Low
• Constraint:
only works over the
Web (browser) or
certain agents

“Ken”
Step-up Challenge!
79

 Internal Use - Confidential

 VI SIBIL IT Y INTO RISK Denied
BEYOND THE SCORE, INTO THE BLACK BOX
INTELLIGENT
Risk Level

User User Resource

Resource
 Admin  I.P. Data
 Executive  Classified
 Employee  Public
Granted
Context
 Network
 Location
 Behavior
 Country
 Agent
 Browser

Step-Up (L/M/H)
‒ Token
‒ Biometric
‒ Push

80

 Internal Use - Confidential

 R I S K E N G I N E V I S U A L I Z AT I O N I N P R O D U C T D A S H B O A R D

How many users How many users

had risk scoring were high or low
applied to them? confidence?

81

 Internal Use - Confidential

  Identity
Confidence
Attribute
 Low or High
confidence

82

 Internal Use - Confidential

 LETS TALK…SAML!
</saml:Subject>

83

 Internal Use - Confidential

 This is the
cool part

84

 Internal Use - Confidential

 Link: https://community.rsa.com/community/products/securid/blog/2016/05/19/need-a-demo-saml-service-provider-we-got-you-covered

85

 Internal Use - Confidential

 86

 Internal Use - Confidential

  Control if it’s displayed in the Portal
 Adjust the icon
 Name the tooltp
 Portal URL is auto-generated

 Choose allow everyone or select a

policy

87

 Internal Use - Confidential

 LET’S TALK…
Visibility with Syslog/SIEM

88

 Internal Use - Confidential

 • Craig has done a blog article – posting soon
INTEGRATION • We can send you a reviewed draft if you like
WITH SIEM • Docs: https://community.rsa.com/docs/DOC-96950

IDR
Events Cloud Events (API)

89

 Internal Use - Confidential

 Configure IDR
based events to
syslog here

Cloud-based
events (e.g.
Cloud IDP) must
be obtained:
• Through RSA
support
• API

90

 Internal Use - Confidential

 TROUBLESHOOTING
Lots of ways...

91

 Internal Use - Confidential

 See all cloud
events as they
happen

92

 Internal Use - Confidential

 93

 Internal Use - Confidential

 The RSA Link Community

An amazing resource:
• Community forums – ask questions!
• Better yet, ANSWER QUESTIONS too! Are you an expert?
• Encourage your customers to use
• Live Tech Support chat coming soon!

94

 Internal Use - Confidential

 LET’S SUMMARISE
Tying it all together

95

 Internal Use - Confidential

 ALL OF T HIS DRIV ES TO BUSINE SS BENEF ITS
Controls &
visibility

Cloud 3rd Party Compliance

Adoption Trust
Integration
Costs User
(Time, complexity, Experience
resources)
Operational
Business ROI
Costs
Agility

Easy to integrate Speed to Value for Simplicity for end

and manage full coverage investment users AND admins

96

 Internal Use - Confidential

 Summary

Consolidation We cover the 100% FIDO Enterprise Ready

The World is Bigger Hybrid is a cornerstone

then just 1 vendor
97

 Internal Use - Confidential