2010 Cisco and/or its affiliates. All rights reserved.

Cisco Confidential 1 Cisco Confidential 2010 Cisco and/or its affiliates. All rights reserved. 1
Applying Cloud Identity to
Real Life: an Enterprise
Case Study
David Jones
Information Security Architect
November 3
rd
2011
2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2
Remember when
Larry said the Cloud
didnt exist?
2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 3
Normal people have
been Cloudy for
years.
2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 4 Cisco Confidential Cisco Confidential 2010 Cisco and/or its affiliates. All rights reserved. 4
If everybody specializes in what
theyre good at, were better off. If we
ignore logical divisions of labor and all
try to be our own butcher, baker, and
brewer, its a short, slick slope to
hoarding duck feathers and living in
suburban petting zoos.

Grayson Schaffer on Adam Smiths The Wealth of Nations
Outside Magazine, March 2009
2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 5
In the beginning
Proprietary Agents
1000 different user profile provisioning
processes
Dedicated Hardware
Passwords out there

2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 6
90+ IT Federated Connections
350+ Total Cloud Providers in Use

2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 7
Win: SAML, OAuth, SCIM, REST
Lose: OpenId, SPML, SOAP
2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 8
<saml:NameID
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
user@mail.example.org
</saml:NameID>
<saml:Conditions
NotBefore="2004-12-05T09:17:05Z"
NotOnOrAfter="2004-12-05T09:27:05Z">
<saml:AudienceRestriction>
<saml:Audience>https://sp.example.com/SAML2</saml:Audience>
</saml:AudienceRestriction>
</saml:Conditions>
2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 9
POST /token HTTP/1.1
Host: server.example.com
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

grant_type=authorization_code&code=i1WsRn1uB1
&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb



Note: previous versions of Oauth required a client_id like &client_id=s6BhdRkqt3 in the grant type

2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 10
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
Cache-Control: no-store
Pragma: no-cache
{
"access_token":"2YotnFZFEjr1zCsicMWpAA",
"token_type":"example",
"expires_in":3600,
"refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
"example_parameter":"example_value
}
2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 11
2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 12 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 12 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 12 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 12 Cisco Confidential 12 2010 Cisco and/or its affiliates. All rights reserved.
Increasingly Commoditized Options = No
Longer a Captive Customer of IT!
! But where is our Data going?
Measure
Manage
Secure
Scale
2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 13
The amount of critical intellectual property that
would be copied onto Cloud Provider systems
without thought of loss
The number of cloud providers that are not
concerned with the co-mingling of their customers
data
2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 14

HIPAA requires we limit who has access to
medical records, how can we keep track of it if our
PaaS provider is using a 3
rd
party for storage that
we dont know about?
Or if they want to outsource their backups to yet
another?
2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 15
2009 Cisco Systems, Inc. All rights reserved. Cisco Confidential Sec Arch 042310 16
Evolution of Blueprint Capabilities
Network
Perimeter
Identity
Management
Service
Management
Data
Governance
Policy &
Orchestration
Classification
& Compliance
External
Identity Model
1
2
3
2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 17
2009 Cisco Systems, Inc. All rights reserved. Cisco Confidential CAB Sec Arch 0610 18
!And why Point-to-Point Federation wont scale
EVERNOTE
Your
Company
2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 19
2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 20
Thank you.