Identity & Access Management
-
Upload
dominic-poole -
Category
Documents
-
view
20 -
download
0
description
Transcript of Identity & Access Management
Identity & Access Management
DCS 861 Team2Kirk M. Anne
Carolyn Sher-DecaustisKevin Kidder
Joe MassiJohn Stewart
The Problem
• How do you establish a digital ID?• How do you “guarantee” somebody’s ID?• How do you prevent unauthorized access?• How do you protect confidential ID data?• How do you “share” identities?• How do you avoid “mistakes”?
What is IdM/IAM?
• The Burton Group defines identity management as follows:– “Identity management is the set of business
processes, and a supporting infrastructure for the creation, maintenance, and use of digital identities.”
A more “complete” definition
• An integrated system of business processes, policies and technologies that enables organizations to facilitate and control user access to critical online applications and resources — while protecting confidential personal and business information from unauthorized users. http://www.comcare.org/Patient_Tracking/IPTI-Glossary.html
Identity Management
PolicyPolicy
Technology/InfrastructureTechnology/
InfrastructureBusiness
ProcessesBusiness
Processes
Enab
les Defines
Uses
ConfidentialInformation
Why is IdM/IAM important?
• Social networking• Customer/Employee Management• Information Security (Data Breach laws)• Privacy/Compliance issues• Business Productivity• Crime prevention
Directory Services
• Lightweight Directory Access Protocol (LDAP) • Stores identity information– Personal Information– Attributes– Credentials– Roles– Groups– Policies
Components of a digital identity
Biographical Information
(Name, Address)
Biographical Information
(Name, Address)
Biometric Information (Behavioral, Biological)Biometric Information (Behavioral, Biological)
Business Information(Transactions, Preferences)
Business Information(Transactions, Preferences)
Access Management
• Authentication/Single Sign On• Entitlements (Organization/Federation)• Authorization• Auditing• Service Provision• Identity Propagation/Delegation• Security Assertion Markup Language (SAML)
Access Management• Authentication (AuthN)– Three types of authentication factors
• Type 1 – Something you know• Type 2 – Something you have• Type 3 – Something you are
• Authorization (AuthZ)– Access Control
• Role-Based Access Control (RBAC)• Task-Based Access Control (TBAC)
– Single Sign On/Reduced Sign On– Security Policies
Levels of Assurance
Low HighData Classification/Privileges
Low
Hig
hRi
sk
LOA-1Little or no confidence
identity is accurateImpacts individual
LOA-2Confidence exists identity is accurate
Impacts individualand organization
LOA-3High confidence
identity is accurateImpacts multiple
people and organization
LOA-4Very high confidence
identity is accurateImpacts indiscriminate
populations
Buy TicketsBuy Tickets
Give DonationsGive Donations
Join a GroupJoin a Group
Apply to CollegeApply to College
Enroll in a CourseEnroll in a Course
Take a TestTake a Test
Manage My Calendar
Manage My Calendar
View My GradesView My Grades
View My VacationView My Vacation
Manage My Benefits
Manage My Benefits
Administer Course Settings
Administer Course Settings
Enter Course Grades
Enter Course Grades
Manage Student Records
Manage Student Records
Manage Financial Aid
Manage Financial Aid
Manage FinancialsManage Financials
Manage Other’s Benefits
Manage Other’s Benefits
Access to Biotechnology Lab
Access to Biotechnology Lab
Manage Research Data
Manage Research Data
Identity Life-Cycle Management
• User Management• Credential Management• Entitlement Management• Integration (Authoritative Sources of Record)• Identity Provisioning/Deprovisioning
“Student” Identity Life CycleAcceptedAccepted
PaidDeposit
PaidDeposit
RegisteredRegistered
Leave ofAbsenceLeave ofAbsence
WithdrawnWithdrawn
GraduatedGraduated
ProspectiveProspective
Federated Identity Management
• Business Enablement• Automatically share identities between
administrative boundaries– Identity Providers (IdP)– Service Providers (SP)
• Easier access for users (use local credentials)• Requires trust relationships
Research Areas• Public Safety
– Identity theft, cybercrime, computer crime, organized crime groups, document fraud, and sexual predator detection
• National Security– Cybersecurity and cyber defense, human trafficking and illegal
immigration, terrorist tracking and financing• Commerce
– Mortgage fraud and other financial crimes, data breaches, e-commerce fraud, insider threats, and health care fraud
• Individual Protection– Identity theft and fraud
• Integration– Biometrics, Policy assessment/development, Confidentiality, Privacy