Automating SiteMinder Policy Management Using Perl API supplied by SiteMinder

Install Siteminder docs. then refer Perl API Policy doc for more stuff. Below is an just idea.what I did. It won’t compile if you just copy/paste :) . This script brings following ideas.
Creating
1. Connection to siteminder Policy server.
2. Webagent
3. Webagent Group.
4. Custom Auth Scheme
5. Domains
6. Realm Under Domains
7. Rules under Realms
8. Policy for the above rule.
9. Adding response to above policy, add users to policy etc.
Just refer and get an idea and you can implement your scripts easily. Good Luck & post me comment if you need anything




#! /usr/bin/perl -w
use Netegrity::PolicyMgtAPI;
# Author - Gopi
# Refer Siteminder policy API for methods arguments.
# Creating Connection to Policy Server.
$policyapi = Netegrity::PolicyMgtAPI->New();
if(!defined $policyapi)
{
die "\nFATAL: Unable to create Policy Server Connection \n";
}

print "Creating Policy Server Connection Session ..... \n";
$mysession = $policyapi->CreateSession($smuser,$smpwd,$smhost);
if(!defined $mysession)
{
die "\nFATAL: Unable to create Session \n";
}




#print "Here is a list of configured domains:\n";
#@domains = $mysession->GetAllDomains();
#foreach $domain(@domains) {
# print $domain->Name() . "\n";
#}
#@agents = $mysession->GetAllAgents();
#foreach $myagent (@agents) {
#print "Agent Name = " . $myagent->Name() . "\n";
#}
print "Creating Webagent with Name as -> myWebAgent Name ....\n";
$myagent = $mysession->CreateAgent("myWebAgent Name",
$mysession->GetAgentType("Web Agent"),
"Descritption for myWebAgent");
if(!defined $myagent)
{
die "\nFATAL: Unable to create Agent -> myWebagent Name";
}
print "Creating Webagent group -> myWebAgent Group \n";
$myagentgroup=$mysession->CreateAgentGroup("my WebAgent Group",
$mysession->GetAgentType("Web Agent"),
"myWebAgent Group Description");




if(!defined $myagentgroup)
{
die "\nFATAL: Unable to create Agent group for myWebAgnet Group";
}




# Adding Webagent to WebAgent Group
print "Adding Webagent myWebAgent Name to myWebAgent Group ";
$myagentgroup->Add($myagent);
#
print "Creating new AuthScheme -> myCustomAuth" ;
$schemeparameter="Whatever is your Custom Scheme parameters Here";
#Creating Auth Scheme
# Below is not fully populated method. See CreateAuthScheme for full syntax and method parameteres.
$authscheme=$mysession->CreateAuthScheme("myCustomAuth",
$mysession->GetAuthScheme();
# Creating Domain
print "Creating Domain -> myDomain \n";
$mydomain=$mysession->CreateDomain("myDomain","myDomain Description");
print "Adding User Directory search order \n";
# Adding User Directory search order.
$mydomain->AddUserDir($mysession->GetUserDir("1st Directory Name"));
#Creating REALMs
# Netegrity::PolicyMgtDomain->CreateRealm( realmName, agent, authScheme [, realmDesc]
# [, resFilter] [, procAuthEvents] [, procAzEvents]
# [, protectAll] [, maxTimeout] [, idleTimeout]
# [, syncAudit] [, azUserDir] [, regScheme] )
#Creating root realm
print "Creating REALM -> Protect / All \n";
$rootrealm=$mydomain->CreateRealm("myProtect all",$myagentgroup,
$authscheme,"Protect all from / ",
"/",1,1,1,43200,3600,0,
$mysession->GetUserDir("Directory Name"));
# Creating for ex:- Get,Post Rule for above Realm.
print "Creating Get,Post Rule for REALM Protect / All \n";
$rootrule=$rootrealm->CreateRule("Get,Post /","Get Post Rule","GET,POST","*");
#

More Here

Courtesy:http://gdesaboyina.wordpress.com/2009/08/08/automating-siteminder-policy-management-using-perl-api-supplied-by-siteminder/

More about → Automating SiteMinder Policy Management Using Perl API supplied by SiteMinder

Web Service Security – Oracle Web Service Manager Quick Start – Simple Steps

Here I choose to install OWSM in stand-alone mode.

Installation steps (windows OS):

• Install Oracle Web service manager soa_windows_x86_ws_mgr_101310.zip. Unzip and install.
• Start–> Programs, make sure you’ve Oracle WSM – OWSMHome1
• Your OWSM setup is ready
• Start–>Programs–>Oracle WSM – OWSMHome1–>Start Server
• To stop server, Start–>Programs–>Oracle WSM – OWSMHome1 –> Developer Prompt. Type the command  wsmadmin stop <password>

Integration Steps:

• I prepared a web service and deployed it into Tomcat [Building a web service is out of scope of this post, you may google around to find good examples]
• Log into web service gateway manager with credentials: admin/oracle
• In this example, OWSM is running on a stand-alone OC4J server and web service running on Tomcat Server. Idea is to use OWSM as security gateway for web services of Tomcat.
• First create a gateway by filling a simple form from Policy Management Tab:
• 
• After successful registration of Gateway. Now ‘am gonna use this gateway for my sample web service running on tomcat
• 
• Click on creating Policies now
• Default Policies for Request would by ‘logging’ mechanism, click on “Add Step Below” to add File Authenticator

• 
• On successful policy creation you should click on ‘Commit’ for the changes to take place (this is important otherwise policies will not be enforced). Now you should see a policy link adjacent to gateway. Click on it to see the just created policy. Now you are done!
• Note: OWSM is capable of authenticating against: LDAP, Siteminder, File, Active directory, Oracle Access Manager. It is capable of SAML token based authentication, Certificate/Signature verification, encryption/decryption and lot many things. Guess what! you don’t need to make a single line of code change or add any code to provide security to your web services. That’s the best part of it… For this post, we just considered file authenticator

• Now since we’ve used File Authenticator, you should prepare a file from where you would want to validate username and password against.
• You may store password in simple plain-text or MD5. For simplicity, store user credentials in simple plain text in a file say .htpwd stored at c:\ in a format (username:password).

first:java1
username:password123

OWSM builds a a new WSDL URL, which should be exposed to the client but not the endpoint web service wsdl url. So that, client uses OWSM WSDL to access web services. Original web service link should never be exposed, doing so clients would be able to access the endpoint bypassing gateway! ‘am sure you don’t want to do that…
From Tools–>Test Page in OWSM, write a sample client to connect to the web service by pointing the URL to OWSM WSDL. Run the client that’s it!
Helpful links:

Here is a step-by-step quick start guide

Best things about OWSM:

• security code is separate from web services, this is really good and provides high cohesion and less coupling. However there is additional overhead of running a separate server for security
• Audit logging mechanism to know who accessed my web service, what was the request and what was the response delivered
• Overall latency of my web services
• Custom Reports on security issues

More Here

Courtesy:http://dailyraaga.wordpress.com/2010/12/03/web-service-security-oracle-web-service-manager-quick-start-simple-steps/

More about → Web Service Security – Oracle Web Service Manager Quick Start – Simple Steps

Access certification technology helps financial firm with compliance

With a new regulatory requirement for internal controls similar to those required for public companies by the Sarbanes-Oxley Act (SOX), privately held Western & Southern Financial Group realized it needed to boost its ability to verify user IT access rights.


The Cincinnati-based Fortune 500 company, which provides life insurance, retirement planning and investment products, used the COBIT and COSO frameworks to develop general IT controls to comply with the amended Model Audit Rule from the National Association of Insurance Commissioners (NAIC).


In the process, it found areas it needed to focus on, said Mark Pfefferman, assistant vice president and director of the identity and access management program at Western & Southern Financial Group. One area was making sure employees have appropriate access rights, and monitoring and certifying those access rights, he said.


The company decided to build out its identity management platform by implementing the Novell Access Governance Suite. The product, based on an OEM partnership that Provo, Utah-based Novell has with access governance vendor Aveska, provides automated access certification. (Novell agreed to be acquired by Attachmate Corp. last week). Western & Southern also is working with Deloitte & Touche LLP, which provides an enterprise roles management methodology.

The software allows Western & Southern to validate a user has the correct role and access rights by having the user's manager verify them. The suite, which consists of the Novell Roles Lifecycle Manager and the Novell Compliance Certification Manager, also enables the company to verify access rights for users who don't have roles, but do have access to sensitive systems. "Access Governance Suite is flexible enough to allow us to do that," Pfefferman said.


In addition to helping with compliance through access certification, the suite helps with role management. Previously, Pfefferman's engineering team was producing voluminous paper documentation of roles and all the systems the role can access, but now the team puts all those roles and entitlements directly into Access Governance Suite.


"So we skip that big pile of paper up front," Pfefferman said. "It's been a good tool for managing that whole role creation and maintenance process."


Western & Southern uses the suite in combination with Novell Identity Manager, which provides provisioning and de-provisioning functionality. The company uses Identity Manager to automatically synchronize user identity information across multiple systems.


Newly hired associates in the home office are automatically provisioned with the appropriate access rights before they show up for work, for what Pfefferman describes as "day zero productivity." Terminated associates are automatically de-provisoned. He estimates that the software has reduced the time spent on user provisioning by 80%.


Western & Southern evaluated a couple other provisioning platforms but chose Novell because its product was the most cost effective, Pfefferman said. Plus, the company was already a Novell customer. The Novell products integrated well together and also integrated with third-party packages, such as the Serena Software Inc. workflow system Western & Southern uses for the roles-based access process, he added.


Gartner Inc. estimated earlier this year that the worldwide identity and access management software market will grow from $9.2 billion last year to $9.9 billion this year. Compliance, audit and analytics requirements are the main factors driving IAM purchases, along with operational efficiency and improved integration across IAM products, according to Gartner.


Bruce Spooner, product manager of Access Governance Suite at Novell, said vendors like Aveska developed access certification technology in response to customers needing help with meeting auditors' requirements.


While the suite provides role lifecycle management, enterprises can't think of it as a magic button for role development; companies need to layer over an enterprise role methodology, which professional services firms can help with, Spooner said.

More Here

Courtesy:http://searchfinancialsecurity.techtarget.com/news/article/0,289142,sid185_gci1524209_mem1,00.html?mboxConv=searchSecurity_RegActivate_Submit&

More about → Access certification technology helps financial firm with compliance

Cloud computing technologies and financial services

You'd have to be living under a rock these days to avoid hearing about the benefits of cloud computing. Heck, even Microsoft is promoting the cloud in its Windows 7 television commercials. But does a technology that's pitched to consumers have a place in a highly regulated industry like financial services? Analysts and IT professionals agree: Maybe, in the future.


"The cloud is certainly on everyone's radar, but there are a lot of issues still to be resolved on the process and regulatory side," said Kevin McPartland, senior analyst at Tabb Group, a Westborough, Mass.-based research and advisory firm focused on capital markets.


"Banks are not using commercial external clouds like Amazon and Google. If they use external clouds, it will be many years away. But quite a few are looking into internal clouds for IT systems, testing and less mission-critical apps. The cost savings that can be had are so big, it's impossible for CIOs to ignore the opportunity," McPartland said.


Cloud computing technologies promise cost savings as a result of more efficient resource utilization. In the case of public clouds (or commercial external clouds), all the hardware is managed by the cloud provider. The customer pays only for the computing resources it uses and no more. A private cloud (or internal cloud) is a computing architecture that delivers services to users behind a firewall. IT departments still save on hardware because they see better utilization of resources, which are delivered dynamically.

Lack of visibility = a lack of security


In the case of private clouds, the organization has complete control over its data and security. However, public clouds offer little in the way of service-level agreements and visibility into security, thanks to their distributed nature. A customer's data can be stored and moved between any number of data centers located around the world. "One of the phrases I've heard is, 'It's 5:00, do you know where your data is?,'" said Doug Johnson, vice president of risk management policy at the American Bankers Association.


"It's important for us to know what the security provisions are. Banks are used to having data internally or at a third-party data center where they can go and kick the tires. That's a challenge when computing is distributed," Johnson said.


This lack of visibility into the security of a cloud environment changes the way banks and other organizations in highly regulated industries must think about risk management. "An infrastructure that you know something about is inherently less risky than one you don't know anything about," said George Reese, chief technology officer of enStratus Networks LLC, a Minneapolis-based provider of cloud infrastructure management. "But that doesn't mean a public cloud is less secure than a private data center environment. It just means that you'll always have less information about that environment from which to make decisions about security," Reese said.


Case in point: A cloud provider might take a Fort Knox approach to security. But a lack of knowledge about the external data center represents a tremendous risk to a potential customer, explained Reese. "In order to be secure in the cloud, you need to be able to get answers to questions about what the provider is doing in the cloud," he said.


To further complicate matters, there is a lack of regulatory guidance associated with cloud computing technologies. "The regulations were written decades ago before the technology existed, so they don't address issues related to the cloud. These unknowns keep banks away," McPartland said.


The big audit firms try to stay ahead of the game by understanding how technology works, but they offer only limited guidance. "They have their interpretations of the law, but a law firm or audit firm opinion is still not a regulatory blessing," McPartland said.


While cloud computing providers are responsible for proving compliance to potential customers, regulators may see the matter differently. "Regulators may say that it doesn't matter what downstream providers promise. A bank could get all the promises they want but still be liable," said Paul Miller, founder of U.K.-based consulting firm, Cloud of Data.


Erring on the side of caution, many banks are choosing to wait for guidance from regulators on how they should view cloud computing technologies. "The SEC clearly has its hands full with implementation of regulations, so this is low on the list of priorities. It will be a couple years before [banks receive any guidance]," McPartland said.


Those banks that wish to move forward with public cloud computing are advised to go slowly. "Take the applications and use cases that you think might work in a cloud environment and try them one at a time. Do as much due diligence as possible to make sure the technology is within the letter and spirit of the law," McPartland said.


"Make sure your contract and SLA are water tight. Put in place some kind of inspection regime. At the end of the day, take a calculated risk," Miller said.


Private clouds: Cost savings and security


For many banks, a calculated risk is understandably too much to stomach. Instead, they are considering an internal cloud. "There is a lot of traction on the internal cloud front. Drivers are cost savings more than anything else," McPartland said.


Such is the case for McHenry Savings Bank, based in McHenry, Ill. The full-service community bank runs all of its storage in a private cloud. "At first we only virtualized the server farm, then we realized the advantages and moved all of the desktops to the cloud as well. Now everything connects to two storage units," said Bryan Nash, senior vice president of IT and chief information officer of McHenry Savings Bank.


Workstations connect to the internal cloud for applications and local storage via a Pano Device from Redwood City, Calif.-based Pano Logic Inc. The Pano Device is a stateless desktop computing hardware device that connects input-output devices like keyboards and display devices to a virtualized Microsoft Windows OS running in the data center. This setup has eliminated resource utilization issues for end users. "Now if they need more horsepower, it's there for them. As long as I have resources available," Nash said, "I can make them available to more people, and I can always add to it. I had a SAN that was filling up, so I added another in the cloud."


The internal cloud and virtualized desktops save McHenry Savings Bank money in a number of areas. The bank now saves more than $1,000 a month in electricity costs alone. But it has also experienced savings in labor. The IT department no longer has to deal with physical end-user machines going bad, and all administration tasks are centralized in the cloud. The department, which consists of two full-time and one part-time personnel, manages 135 virtual machines and 12 hosts, plus routers, switches and security.


Moving all storage to an internal cloud has also improved security. "Before every desktop was vulnerable, people could store data on their local PC, hook up USBs. Now if someone steals a Pano, they get nothing. They can't plug in USB devices or CD burners," Nash explained.

More Here

Courtesy:http://searchfinancialsecurity.techtarget.com/news/article/0,289142,sid185_gci1524267,00.html

More about → Cloud computing technologies and financial services

Out-of-band authentication boosts security but isn't failsafe

As the use of online banking by consumers and businesses has risen, so has the crime associated with it. The FBI and other authorities have issued alerts about a steep rise in online banking crime, much of it targeted at small and midsize businesses, municipalities and non-profits. The crooks steal passwords and account numbers, hack into bank accounts and transfer out funds. In some cases, the losses have been catastrophic , including at least one company that reportedly was on the brink of bankruptcy afterwards.


To bank managers like Laura Briscoe, vice president of information security at Stillwater National Bank and Trust Company (SNB), a subsidiary of Southwest Bancorp Inc. headquartered in Stillwater, Okla., this surge of attacks against online banking customers was particularly troubling. First off, the criminals were getting in by planting malware on the customers' PCs, which is not something a bank can prevent. Second, the money was often sent out of the country, after it was first moved to a dummy account in the U.S., making it virtually impossible to get it back. Yet Briscoe knew customers still expected banks to protect their money, despite the difficulties.


"The fraud wasn't due to anything on the banks' end. It was usually the customer's computer that was infected and their passwords stolen. But once the money is gone, it's gone, and you don't want a customer who's had a million dollars sent out of the country and can never get it back," Briscoe said.

To increase the level of security, many banks use software or hardware tokens, either to identify the user to the bank's website or to generate a one-time password. But because criminals can circumvent the two-factor security provided by tokens, SNB and other banks are opting to deploy out-of-band authentication.


The technology can automatically place a phone call to any customer attempting to transfer a large amount of money out of their account. Customers can have the calls come to their mobile phone or POTS (Plain Old Telephone Service) number, and can use a PIN, text response or voice print to authorize the transaction. If a user's PC and account have been hacked, the phone call may be the only chance to catch it.


"We decided we had to take [the second authentication] off of the computer, period. Even tokens are getting successfully hacked now, so this seemed like the only practical option for us," Briscoe said.


Robert Vamosi, research analyst at Javelin Strategy & Research, noted that out-of-band authentication is growing in usage, but still is mostly used for high-value transactions. "If you want to move $10,000, then the bank is likely to want to make sure you are who you say you are, and they bring out the big guns for a high-risk transaction," he said


SNB uses PhoneFactor Inc.'s hosted service, the Universal Banking Gateway. Overland Park, Kan.-based PhoneFactor also sells an on-premise version of its software. Other vendors include Authentify Inc.,Entrust and StrikeForce Technologies Inc. Briscoe chose PhoneFactor's hosted service because it worked better with the bank's third-party online banking service. She also liked the short amount of time required -- usually a minute or less -- to authenticate a transaction. To make sure it would be easy for customers to use, she initially rolled it out to just a handful of clients in September. The bank now has nearly every customer using it, and will begin requiring them to use it in early 2011.


"For the customer, it's not a big change. It's seconds on the clock before your phone is ringing, and the recording tells you the amount and what it's for. Then you enter your PIN and the system approves it," she said. "Everything on the [PC] screen remains the same. It just freezes for a minute while this is going on."


Clever crooks thwart even best security


Where there's a will, there's a way, and a determined criminal can find a way around most security measures. With out-of-band authentication, a hacker may attempt to get the customer's phone number changed on the account, substituting the crook's phone number.


"[A hacker] can say to the bank, I've changed my phone number, and the bank may say OK, we'll call both numbers to make sure, and then the criminals will flood the original number with crank calls," Vamosi said.


Hence, the technology's effectiveness depends on the bank adhering strictly to policies against making changes to an account without phone confirmation, or transferring money without that extra authorization.


The mobile phone may also prove to be a weak spot in out-of-band-authentication, according to Vamosi, who noted that people who use the same smartphone for Web banking as well as SMS authentication aren't operating in the spirit of the out-of-band approach. Also, smartphones have the ability to bypass the phone carrier and contact the Internet directly.


"That allows the bad guys to take control of the Wi-Fi connection," he said.


Also, this fall researchers uncovered a new technique developed by the infamous Zeus banking Trojan that is designed to circumvent SMS-based out-of-band authentication and relies on customers using a smartphone with Web access and tricking them into clicking on a malicious Web link in an SMS message.


Nevertheless, the odds that a hacker will go through the effort to target an account with that extra security, given there are lots of easier ones to hack, go down substantially said Diana Kelley, founder of SecurityCurve, an IT security consulting firm.

More Here

Courtesy:http://searchfinancialsecurity.techtarget.com/news/article/0,289142,sid185_gci1525331,00.html

More about → Out-of-band authentication boosts security but isn't failsafe