IdentityBased Network Access Control Case Study

1
Identity-Based Network Access ControlCase
Study
2
Wellstar Health Systems

• 600,000 Customers
• 10,000 Employees
• Five Hospitals
• Urgent Care Centers
• Physicians Group
• Homecare
• Hospice

3
Access Requirements

• Granular Access Control
• Control access based on Identity
• All Apps, Files, and Networks
• Policy enforced by location, device,
  authentication
• Audit requirements for PCI, HIPAA
• Network Plug and Play
• Cross-platform integration
• Network changes minimized
• Manage from existing ID stores
• Clientless solution
• Transparent User Experience
• Autologon from Windows
• SSO for all Web and File access
• High performance

Know who is connecting to what
Easy to manage
Easy to use
4
Environment

• Windows NT4/2000/XP/2003
• Linux (Redhat and SuSE)
• HP Unix
• 475 Devices with SSH/Telnet Access
• Also looking to control devices, pumps, monitors
  and other SSH or telnet supported devices for
  vendor access

5
Identity-Based Solution
Resources
Identity-Based Policy Engine
Users
Files
User Identity
Web Applications
Device Identity
Hosts
Networks
Location Identity
Active Directory
ClientServer Apps

• Authorization based on multiple Identities
• Policy set on directory and enforced by policy
  engine
• Precise, Identity-based auditing for regulatory
  compliance and enforcement of contractual
  obligations / liabilities

6
Easy Management
Vendor Support group IT Resource Zone Only 24x7
IT Zone
IT Resources
Policy Enforcement
Policy Creation
Work Order

• Vendor logs in
• Policy is checked and evaluated
• DNS names resolved
• Current location evaluated
• HIC check
• FW ACLs generated

• Access is granted
• Detailed audit log

7
Fine Grained Access Control
Internet
Guest Zone
Extranet Zone
Files, Email, Extranet
IT Zone

• Policy Updated Real Time
• Users Cannot View/Discover Unauthorized Resources
• Full Log and Audit
• No User Training Required

IT Resources
Restricted Zone
Data Center ERP, HR, Finance
Production Zone
8
Wellstar Solution

• Control Unmanaged PCs
• IT Vendor access
• Mobile Employees
• Heterogeneous environment
• Manage Risk
• Enforce access control policy
• Prevent discovery and access
• Protect Sensitive Information
• Zone Based Access
• Vendors can access Vendors system
• Employees can access employee systems
• Compliance HIPAA, PCI

Employees
Guests/Contractors
Anonymous Guests
Mobile Employees
Internet
Network Admission
Access Control
Data Center
Secure Application
9
Thank You!