"Risk, Reach, and Return: Everything Today's CISO Needs to Know About Using SSO to Succeed in the Web 2.0 Era" is a Sun white paper (registration required) that provides the CISO with the information necessary to make informed choices in extending the enterprise’s reach with minimal risk and maximum return on the technology employed in the effort.

The paper observes that the unspoken maxim governing Web 2.0, "open yet secure," sounds like an oxymoron. Still, it is the state to which every enterprise must aspire in order to succeed in the Web 2.0 era, the paper contends. Being open yet secure means extending the organization’s reach to more partners, vendors, customers, and others outside the enterprise in more ways — while still controlling the amount of risk to which the organization is exposed as a result. Complicating the challenge further is the need to realize an acceptable return on the technology used to achieve the right risk:reach ratio for the enterprise.

Among the topics under discussion in the white paper are:

• How SSO has evolved from an internal tool for secure access to one that enables secure access from beyond the enterprise

• How to take the fright factor out of some of the common fears associated with taking SSO beyond the enterprise today

• How to define the criteria for choosing the right identity-based technology approach and the ideal vendor for SSO initiatives

• How to delineate practical steps to take to get started on an SSO initiative

• How to avail yourself of Sun’s comprehensive approach and industry leadership in addressing the challenges associated with creating an open yet secure enterprise

The principal issue for the CISO, the paper asserts, is discovering a way to address both internal and external needs without over-complicating the technology infrastructure or overtaxing the IT budget in the process. Federation is the saving grace in this instance, the paper contends, because it creates opportunities to expand business reach by building federated connections to SaaS applications, partner services, affiliate services, acquisitions/subsidiaries, business process outsourcing, and third-party hosted portals, among others. The development of repeatable, scalable processes is the key here.

Seeking to address the conventional fears around the issues of extranet access management, federation, and secure Web services, the paper dispels them one by one, maintaining that the process is not complicated; it is not time consuming; it is not expensive; nor is it too risky.

The paper outlines the features that any solution capable of meeting the continually evolving challenges of implementing SSO, which include:

• It must have comprehensive capabilities and that does not require multiple licenses, separate products, and separate infrastructure to address multiple requirements.

• The architecture must be flexible and modular, enabling the enterprise to roll out capabilities as they are needed. It should also have the flexibility to easily integrate with existing identity and access management solutions already in place.

• The solution should be standards-based and scalable (SAML, WS-Federation, and WS-Trust are suggested.

• The solution should require minimal customization and should come from a vendor familiar with such issues as provisioning, role management, directory services, and compliance management, along with the issues involving SSO challenges of extranet access management, federation, and secure Web services.

• The solution should be open source rather than proprietary and should have a pricing model that supports growth.

The paper next features a brief section on getting started and then turns to a consideration of Sun Open SSO Enterprise, a solution that meets all the requirements enumerated above. In addition, Sun also has available a portfolio of solutions that includes Sun Identity Manager software; Sun Role Manager software; Sun directory Server Enterprise Edition and Sun OpenDS Standard Edition; and a range of support, professional, managed, learning and partner services for its customers to choose from.

The paper concludes with links to a number of success stories demonstrating the efficacy of Sun OpenSSO Enterprise that include the experiences of BC Hydro, the government of Norway, Swisscom Mobile AG; and Western Michigan University, to mention only some of them.

More Information

Sun OpenSSO

Enabling IP, Resource, Environment-based Authentication with OpenSSO

Protecting Applications with OpenSSO and Policy Agents

Enabling, Writing, Deploying Web Services Security Using OpenSSO WSS Agent [...read more...]

		fullsource
Print Email Current Profile Archive Blog Generate newsletter