Transcript WHO WILL BENEFIT FROM THIS TALK • • • • Solutions architects DLP developers Identity Management developers Information Lifecycle app developers TOPICS • • • Overview of platform investments for Dynamic Access Control Making it real with.

WHO WILL BENEFIT FROM THIS TALK
•
•
•
•
Solutions architects
DLP developers
Identity Management developers
Information Lifecycle app
developers
TOPICS
•
•
•
Overview of platform
investments for Dynamic Access
Control
Making it real with File access
control on Windows 8 File
Servers
Demo of a cloud based .NET app
using new access control
constructs
WHAT YOU’LL LEAVE WITH
•
•
•
Understand targeting access,
auditing and encryption policy
based on classification
Understand concepts to Develop
products and LOB applications
that use classification and native
Windows Server 8 access, audit
and encryption policies
Understand .NET enhancements
to support building claims aware
applications
Customer challenges
Growth of users
and data
?
Distributed
computing
Regulatory and
Business Compliance
?
Budget
Constraints
CSO/CIO
department
“I need to have
the right
compliance
controls to keep
me out of jail”
Infrastructure
Support
“I don’t know
what data is in my
repositories and
how to control it”
Content Owner
IW
“Is my important
data appropriately
protected and
compliant with
regulations – how
do I audit this”
“I don’t know if I
am complying
with my
organization’s
polices”
WHAT IS THIS REALLY ABOUT?
WHY SHOULD YOU CARE
Platform Investments in
Windows 8 (Dynamic Access
Control)
Plumb claims into the core Authentication platform via Kerberos with Active Directory
Enhance Authorization platform for files to author and manage richer access policies with claims
Enhance audit platform for files to drive efficient Audit controls across the Enterprise
Project User & Device Claims for consumption by .NET apps
Improve File Management infrastructure for Files in Win8
User claims
User.Department = Finance
User.Clearance = High
Device claims
Device.Department = Finance
Device.Managed = True
Resource properties
Resource.Department = Finance
Resource.Impact = High
ACCESS POLICY
Applies to: @Resource.Impact == “High”
Allow | Read, Write | if (@User.Clearance == “High”) AND (@Device.Managed == True)
Plumb claims into the core Authentication platform via Kerberos with Active Directory
Enhance Authorization platform for files to author and manage richer access policies with claims
Enhance audit platform for files to drive efficient Audit controls across the Enterprise
Project User & Device Claims for consumption by .NET apps
Improve File Management infrastructure for Files in Win8
WHAT’S NEW
Windows 8 Token
Owner
Group
User
Groups
Claims
Device
Groups
Claims
Plumb claims into the core Authentication platform via Kerberos with Active Directory
Enhance Authorization platform to author and manage richer access policies with claims
Enhance core audit platform to drive efficient Audit controls across the Enterprise
Project User & Device Claims for consumption by .NET apps
Improve File Management infrastructure for Files in Win8
UPDATED ACL MODEL
Windows 7
New in Windows 8
Example
User.memberOf (USA-Employees)
AND User.memberOf (Finance-Division)
AND User.memberOf (Authorization-Project)
User.Division = ‘Finance’
AND User.CostCenter = 20000
User.Division = ‘Finance’
AND Device.ITManaged = True
IF (Resource.Impact = ‘HBI’)
ALLOW AU Read User.EmployeeType = ‘FTE’
• Claims support in ACEs managed as SDDL strings
• Added / removed from SDDL strings via standard string manipulation functions
ENHANCEMENTS
Plumb claims into the core Authentication platform via Kerberos with Active Directory
Enhance Authorization platform to author and manage richer access policies to files with claims
Enhance core audit platform to drive efficient Audit controls for files across the Enterprise
Project User & Device Claims for consumption by .NET apps
Improve File Management infrastructure for Files in Win8
WHAT’S NEW
Plumb claims into the core Authentication platform via Kerberos with Active Directory
Enhance Authorization platform to author and manage richer access policies for files with claims
Enhance core audit platform to drive efficient Audit controls for files across the Enterprise
Project User & Device Claims for consumption by .NET apps
Improve File Management infrastructure for Files in Win8
Windows 8
AD FS 2.1
Plumb claims into the core Authentication platform via Kerberos with Active Directory
Enhance Authorization platform to author and manage richer access policies with claims
Enhance core audit platform to drive efficient Audit controls across the Enterprise
Project User & Device Claims for consumption by .NET apps
Improve File Management infrastructure for Files in Win8
Location based
In-box content
classifier
Manual
3rd party
classification plugin
Automatic classification
Application
// instantiate new classification manager
FsrmClassificationManager cls =
new FsrmClassificationManager();
//get defined properties
ICollection c = cls.EnumPropertyDefinitions
(_FsrmEnumOptions.FsrmEnumOptions_None);
// inspect each property definition
foreach (IFsrmPropertyDefinition p in c)
{
/*...*/
}
Match file to policy
Classify file
Access control
Audit control
Retention
RMS Encryption
Other actions
Building the file server
solution using the Windows
infrastructure
Identify data
Control access
Audit access
Protect data
Manual tagging by content
owners
Expression based access
conditions with support for
user claims, device claims
and file tags
Central audit policies that
can be applied across
multiple file servers
Automatic RMS protection
for Office documents
based on file tags
Central access policies
targeted based on file tags
Expression based auditing
conditions with support for
user claims, device claims
and file tags
Near real time protection
soon after the file is
tagged
Access denied remediation
Policy staging audits to
simulate policy changes in
a real environment
Extensibility for non Office
RMS protectors
Automatic classification
(tagging)
Application based tagging
Making it real through demos
Demo Overview
Information security
Windows 8
Domain
Controller
• Tom: Information Security operations
responsible for regulatory and business
compliance
Server Admin:
• Chris: File Server administrator
Content owner:
• Joe: Manages the data shares for the finance
department
IW:
• Tim: Vendor for the
Operations department
Tim–Vendor for
the operations department
Windows 8
File Server
In Active Directory:
Windows 8
Active Directory
• Create resource property definitions
On File Server:
Resource
Property
Definitions
• Identify information
 Tagging information by owner
 Automatic classification
 Line Of Business applications
Content owner
Applications
Windows 8
File Server
RSA DLP Enterprise Manager
RSA DLP Network
RSA DLP Datacenter
RSA DLP Endpoint
Email
Web
EDUCATE





















ENFORCE







DISCOVER
MONITOR
File shares
SharePoint
Databases
Connected PCs
Disconnected PCs
Windows 8
Active Directory
Resource
Property
Definitions
RSA DLP W8
classifier
Content owner
Applications
Windows 8
File Server
here
here
here
To: File Server administrators
To Content Owners
here
In Active Directory:
Windows 8
Active Directory
• Create claim definitions
• Create resource property definitions
• Create central access policy
Claim
Definitions
Access
policy
In Group Policy:
Resource
Property
Definitions
• Send central access policies to file servers
On File Server:
• Apply access policy to the shared folder
• Identify information
At Runtime:
• User tries to access information
End User
Allow
/
Deny
Windows 8
File Server
Windows 8
Active Directory
In Active Directory:
• Create claim definitions
• Create resource property definitions
Claim
Definitions
Resource
Property
Definitions
Audit Policy
In Group Policy:
• Create global audit policy
On File Server:
• Identify information
At Runtime:
• User tries to access information
End User
Audit
/ No
Audit
Windows 8
File Server
Windows 8
Active
Directory
Claim
Definitions
Audit Group
Policy
Collect
Resource
Property
Definitions
• Agentless
Event Data
Collection
• Unmatched
Device
Support
Audit
/ No
Audit
End
User
Windows 8
File Server
• Remote
or
Local
Collection
Analyze
• Purpose Built
Relational
Database
• Regulations &
Internal Policy
• Comprehensive
Event Taxonomy
Prioritize
• Intelligent
Incident
Investigation
Visualization
• Advanced
Correlation
Remediation
Development Opportunities
DLP and File management Applications
Security Audit Collection and Analysis Applications
•
•
•
•
•
•
•
•
Automatic classification engines
RMS protection for non-Office documents
Client and Server integration with DLP solutions
Tagging for Office, email and other applications
Audit event collection to a central repository
Compliance access audit reports
Forensic analysis audit analysis
Real time analysis and alerts on access events
Governance Risk and Compliance Applications
• Data management based on classification
• Automation of control activities
• Monitor and report on information governance
Identity Management Applications
• User provisioning
• Policy authoring and staging
• What if analysis for policies
System management across the enterprise
• Applying and monitoring central authorization policies
• Deploying and monitoring automatic classification rules and
actions
• Managing device state on domain joined computers
RELATED SESSIONS
 SAC-425T: Building security auditing solutions for compliance and
forensic analysis
 SAC-426T: Using classification for access control and compliance
 SAC-858T: Identity and access management for Windows Azure
apps
http://forums.dev.windows.com
http://bldw.in/SessionFeedback
APPENDIX