1CE

1CE Capabilities

User

Define

  • It is common for users to have different entitlements within an application
  • An administrator may have access to support tickets for certain groups, while another user may have access only to support tickets for certain groups
  • You can define flexible rules for determining which entitlements each user receives with 1ce, since it imports your organization’s entitlement definitions from each individual app

Define

  • To prevent former employees from accessing enterprise data, it is critical to deprovision users or off-board them
  • Off-boarding users can be effectively stopped by 1ce
  • As Active Directory synchronizes users in real time, disabling a user in a target application takes effect within seconds and not minutes or hours

Access management (AM) is the process of identifying, tracking, controlling, and managing authorized or specified users’ access to a system, application, or any IT instance

  • It is a broad concept that encompasses all policies, processes, methodologies, and tools to maintain access privileges within an IT environment
  • An access management process involves granting access to valid users and prohibiting access to invalid users
  • AM is typically used with identity access management (IAM)
  • Identity management creates, provisions and controls different users, roles, groups and polices, whereas AM ensures that these roles and policies are followed
  • An AM-based application/system stores the different user roles and their profiles, and process user access requests based on the data/profile/roles

Autonomous Access lets you fast-track trusted users with options like passwordless authentication while preventing attackers by treating each login request differently based on its risk score

  • Trusted User – Users who log in at the same time and location using the same device are considered low-risk
  • Login goes smoothly for the user
  • Anomalous Behaviour – Unusual circumstances can arise when a familiar user logs in using a new device or at an unusual time. The user is challenged to step up
  • Known Threat – High-risk user, almost certainly malicious and possibly a bot, who has failed several automated login attempts
  • There is the option of resolving or blocking requests

Identity

What is Autonomous Identity?

  • With Autonomous Identity, you can see who has access to what, providing contextual awareness to your security teams
  • Autonomous Identity uses artificial intelligence (AI) to collect, analyse, and identify access blind spots based on data collected by machine learning techniques
  • Achieve regulatory compliance
  • Mitigate risks
  • Reduce costs

Directory Services

Define custom graphs or access ad-hoc graphs with a click of a button:

  • Unifying network resources is achieved through directory services, which store, organize, and provide access to directory information
  • Identifying network resources by their network names and defining their naming structures is done by directory services
  • A directory service provides users with access to resources without having to know where devices are physically located, allowing them to view protocol and network topology information
  • In a service delivery platform, it is a central repository of information that is part of a network operating system

In addition to IAM services, 1CE Identity Cloud offers a comprehensive identity management platform

With 1ce Identity Cloud, you can manage the complete lifecycle of identities including:

  • Flexible and extensible user journeys
  • Application management
  • Identity management
  • SAML Single Sign-On
  • Real-time identity synchronization between cloud and on premises
  • Policy enforcement using ForgeRock Identity Gateway
  • Device-profiling authentication in user journeys using our SDK

A web application, API, and microservice can be integrated with 1CE Identity Gateway

  • Only authenticated Business is allowed in the application
  • 1ce Identity cloud is needed for authentication
  • The application requires some attributes of the authenticated user to be transferred as HTTP heads
  • The application will use this information to epitomize user experience
  • In this use case IG is integrated with 1ce Identity Cloud, but this could be 1ce Access Management (AM) in your terrain

Identity Governance

Erected on a foundation of artificial intelligence and machine literacy, the 1ce Identity Security Platform delivers the right position of access to the right individualities and resources at the right time — matching the scale, velocity, and changing requirements of moment’s cloud- acquainted, ultramodern enterprise.

1ce Identity Management fully automates the entire identity lifecycle management process

  • With Autonomous Identity, you can see who has access to what, providing contextual awareness to your security teams
  • Consumers Acquire customers faster and retain them by delivering a great experience that includes self-service, social registration, and more
  • Workforce Easily create and provision new users, manage access to applications and resources, and quickly revoke access as needed

Define

Define flexible storage periods for different data sets:
  • It can be challenging for many organizations to balance security and user experience, and legacy systems can only complicate the process
  • The use of a modern identity platform that incorporates today’s security principles into custom user journeys is essential for IAM leaders to deliver a secure and frictionless user experience
  • With its extended features that provide additional functionality and security, 1CE Intelligent Access, formerly Intelligent Authentication, helps you balance functionality and security
  • You can create customized and secure user journeys without writing a single line of code with login analytics, intelligent self-service, and a drag-and-drop interface

Application

1ce makes easy to enable single sign-on and user provisioning for enterprise applications. 1ce proactively maintains the integrations and adds new application to its identity and access management solution.

When identifying and operating SSO, you need to be aware of the different protocols and standards. These include:

  • SAML is an open standard for encoding text into machine language and exchanging identifying information.
  • It has become one of the core standards for SSO and is used by many application providers to validate authentication requests.
  • SAML 2.0 is optimized for web applications and can send information through a web browser.

SAML 2

SAML 2.0 is an updated version of the original SAML standard that was designed to address some of the limitations and security weaknesses of the original SAML specification. SAML 2.0 provides several significant improvements and enhancements over SAML, including:
  • Better performance: SAML 2.0 provides faster processing times and improved network efficiency compared to SAML.
  • Increased security: SAML 2.0 includes a number of security enhancements, including encryption of assertions, improved signature algorithms, and support for digital signatures.
  • Improved flexibility: SAML 2.0 provides greater flexibility in terms of how and when assertions can be made and processed. This allows for a more seamless integration with existing security infrastructures.
  • Better Interoperability: SAML 2.0 includes more robust mechanisms for ensuring interoperability between different implementations, allowing for a wider range of applications to work together.

What is OAuth?

  • OAuth is an open standard authentication protocol that encrypts identity information and transmits it securely between applications.
  • This allows users to access data from other applications without having to manually verify their identity.
  • This is especially useful for native mobile applications.

OpenID Connect

1ce makes easy to enable single sign-on and user provisioning for enterprise applications. 1ce proactively maintains the integrations and adds new application to its identity and access management solution.

When identifying and operating SSO, you need to be aware of the different protocols and standards. These include:

 

  • OIDC is an extension of OAuth 2.0, which adds information about users and enables SSO.
  • This allows multiple applications to use one login session.
  • For example, users can log into a service using their Facebook or Google account instead of entering their credentials.

1ce makes easy to enable single sign-on and user provisioning for enterprise applications. 1ce proactively maintains the integrations and adds new application to its identity and access management solution.

When identifying and operating SSO, you need to be aware of the different protocols and standards. These include:

 

  • Kerberos is a ticket-granting protocol that allows mutual authentication, enabling a user and a server to authenticate each other over an insecure network connection.
  • It has become one of the core standards for SSO and is used by many application providers to validate authentication requests.
  • It is commonly used for authentication in Windows environments and for software applications like email clients.

1ce makes easy to enable single sign-on and user provisioning for enterprise applications. 1ce proactively maintains the integrations and adds new application to its identity and access management solution.

When identifying and operating SSO, you need to be aware of the different protocols and standards. These include:

  • In addition to traditional SSO, many organizations use physical tokens to allow users to securely connect to applications.
  • The token typically requires the user to input a PIN, to enable two-factor authentication.
  • Software on the computer interacts with the encryption key on the smart card to authenticate the user.
  • Smart cards are considered very secure, but they can still be obtained by attackers (for example, if the user loses the card), and are expensive to deploy.

Organisation

  • In addition to IAM services, 1CE Identity Cloud offers a comprehensive identity management platform
  • You can deploy applications anywhere: on-premises, in your own private cloud, or in any public cloud
  • Flexible and extensible user journeys
  • Application management
  • Identity management
  • SAML Single Sign-On
  • Real-time identity synchronization between cloud and on premises
  • Policy enforcement using ForgeRock Identity Gateway
  • Device-profiling authentication in user journeys using our SDKs

What is Identity Authentication

Define services and create service trees to perform impact analysis:

  • Identity authentication is the process of verifying the identity of a user or service, based on this information, a system then provides the user with the appropriate access
  • It may ask them for a username and password, or it may need to scan their thumb on a fingerprint reader
  • Employees using the system need to verify their identity via an authentication process
  • Define service weights for custom service status calculation
  • Calculate your business service availability based on service weights or number and percentage of unavailable child services
 

Business services provide full support for multi-tenant environments with a flexible permission schema:

  • Define roles with limited access to particular services
  • Secure your roles with read or write permissions for your service trees

SLA Monitoring

Define services and service components with custom SLA calculation logic:

  • Analyze status of related services to perform SLA calculation
  • Decrease SLA when either single or all of the components of a service are in a problem state.
  • Create service trees for complex SLA calculations of individual services
  • Access daily/weekly/monthly/yearly overviews of your service SLAs

Zero Trust Architect

Zero Trust security layers

User Identity

  • Zero Trust starts with identity, verifying that only the people, devices and processes that have been granted access to your resources can access them.

 

A holistic approach to Zero Trust should extend to your entire digital estate – inclusive of identities, endpoints, network, data, apps, and infrastructure. Zero Trust architecture serves as a comprehensive end-to-end strategy and requires integration across the elements. Although the ZT approach is primarily focused on protecting data and services, it protects all enterprise resources (devices, infrastructure components, applications, virtual and cloud components) and targets (end users, applications, and other non-human entities) can and should be extended to include to include information from sources). Zero Trust, principle is to verify explicitly, apply least privileged access and always assume breach. This workshop is to enable you to transform into a Zero Trust Architecture for your organization.

  • Monitor your Docker containers
  • Web server backends – IIS, Apache, Nginx and more
  • Database backends such as MySQL, PostgreSQL, Microsoft SQL, MongoDB and more
  • Monitor any operating system – Linux, Windows, Solaris, BSD, MacOS and more
  • Cloud services such as AWS, Amazon cloud, Google cloud and more
  • IP telephony services

Zero Trust security layers

Device – Endpoints
  • Next comes asssessing the security compliance of device endpoints – the hardware accessing your data – including the IoT systems on the edge.

 

A holistic approach to Zero Trust should extend to your entire digital estate – inclusive of identities, endpoints, network, data, apps, and infrastructure. Zero Trust architecture serves as a comprehensive end-to-end strategy and requires integration across the elements. Although the ZT approach is primarily focused on protecting data and services, it protects all enterprise resources (devices, infrastructure components, applications, virtual and cloud components) and targets (end users, applications, and other non-human entities) can and should be extended to include to include information from sources). Zero Trust, principle is to verify explicitly, apply least privileged access and always assume breach. This workshop is to enable you to transform into a Zero Trust Architecture for your organization.

Keep track of your Kubernetes deployment on every level

  • Automatic discovery and monitoring of Kubernetes nodes and pods
  • Create dashboard to visualize the status of your Kubernetes nodes and pod

Kubernetes monitoring also enables you to monitor Kubernetes components, such as:

  • kube-controller-manager
  • kube-apiserver
  • kube-scheduler
  • kubelet
1ce is also capable of monitoring pods, nodes and Kubernetes components in the Redhat OpenShift container infrastructures.

Seamlessly deploy 1ce within your infrastructure

Platform-agnostic out-of-the-box cloud monitoring:
  • Connect to any cloud API endpoint over HTTP
  • Leverage 1ce discovery features to improve the observability of your cloud environment
  • Automatically discover and start monitoring your cloud entities and components
  • Represent your cloud infrastructure in a single pane of glass view with 1ce maps and dashboards
Monitor your AWS EC2 instances with the official 1ce templates:
  • Collect metrics and events from your AWS EC2 instances
  • Automatically discover and start monitoring your AWS EBS instance volumes

VMware Monitoring

Connect 1ce to your VMware instance and automatically discover VMware guests, clusters, hypervisors and datastores:

  • Monitor your VMware endpoints without deploying any additional agent software
  • Customize the discovered monitoring endpoints and collect additional information

Monitor VMware metrics such as:

  • VMware alarm status
  • VMware guest state
  • VMware guest and hypervisor performance metrics
  • Datastore IOPS read/write metrics
  • Datastore performance counters
  • VMware event log entries
  • VMware Hypervisor and vSphere Distributed Switch network metrics

1ce also provides an official template for VMWare SD-WAN VeloCloud component discovery and monitoring:

  • Gateway state and utilization
  • Edge state, uptime, version, and more
  • Link network statistics
  • SDWan peers and peers path metrics

Customize your integration with API

Create automation workflows and integrate with other systems using well-documented JSON RPC API:
  • Automate management via API
  • 200+ different methods available
  • Create new applications to work
  • Integrate 1ce with third party software: Configuration management, ticketing systems
  • Retrieve and manage configuration and historical data
  • Create named API tokens with expiry date for secure access to API

Visualization

Zero Trust Perception centers around giving an unmistakable and exhaustive perspective on an association’s organization and security framework. Visual representations of network components, user identities, devices, and the connections between them are all part of it. Security teams can use this visualization to see user access patterns, identify potential security risks, and gain insight into the network’s overall topology.

Analytics

Data from a variety of sources, including device behavior, user authentication records, and network logs, are used in Zero Trust Analytics. Anomalies, suspicious activities, and the network’s security posture are all assessed using advanced analytics methods like behavioral analysis and machine learning. Security teams can use these analytics to make better decisions and take the right steps to reduce potential threats.

Orchestration & Automation

Zero Trust Orchestration and Automation is the application of automated procedures and centralized control mechanisms to the network infrastructure of an organization in order to implement and manage Zero Trust security principles. It includes the coordination of different security advances, approaches, and work processes to uphold access controls, ceaselessly screen client exercises, and answer security occasions continuously.

  • Identity (IAM): Zero Trust Orchestration and Automation make use of IAM solutions to create solid user identities, verify users, and grant access to resources using the principle of least privilege. The user provisioning and deprovisioning processes can be streamlined by automated IAM workflows, ensuring that access rights are granted and revoked promptly in response to policy changes or user lifecycle events.
  • Microsegmentation and segmentation of the network: As part of the Zero Trust model, orchestration and automation tools aid in the implementation of microsegmentation and segmentation strategies for networks. They automate the process of breaking up the network into smaller, isolated segments, making it possible for businesses to restrict lateral movement within the network and impose granular access controls. Automated policies guarantee that authorized traffic is permitted only between segments.
  • Analytical Threat Intelligence: To automatically identify and respond to potential threats, orchestration and automation solutions combine security analytics capabilities with threat intelligence feeds. These tools are able to automatically detect anomalies, trigger alerts, and initiate pre-defined response actions, such as isolating compromised devices or blocking suspicious traffic, by continuously analyzing network logs, user behavior, and threat intelligence data.
  • Points of Enforcement and Policy Enforcement: Coordination and Mechanization stages assist associations with implementing access arrangements reliably across their organization foundation. Security teams are able to define and manage policies from a single interface thanks to their centralized policy management. These policies are put into action in real time by automated enforcement points like firewalls, access control lists, and network gateways, ensuring that access decisions follow Zero Trust principles.
  • Remediation and Response to Incidents: In a Zero Trust environment, incident response procedures are streamlined by automation and orchestration tools. In order to automatically generate alerts, initiate incident response workflows, and coordinate the actions of various security tools and teams, they integrate with security incident and event management (SIEM) systems. Security incidents are lessened by automated response actions like isolating compromised devices, blocking malicious traffic, or starting forensic data collection.
  • Compliance and ongoing monitoring: Solutions for orchestration and automation make it possible to continuously monitor activities on the network, user actions, and compliance with security policies. In order to guarantee that the Zero Trust principles are adhered to, they provide visibility into the network in real time, identify security flaws or policy violations, and initiate automated responses. Organizations can demonstrate compliance with regulatory requirements through automated audits and reporting capabilities.