Unifying framework for Identity management

(1)

Unifying framework for Identity management

Breakfast seminar Security-Assessment.com

(2)

Disclaimer

+ This is a slide pack that supports a narrative and needs to be accompanied by the presentation.

+ This slide pack is NOT self-explanatory.

+ If you were NOT present at this presentation, please do NOT use any of this presentation, because it is unlikely you will use it appropriately.

(3)

Overview

+ Identity management

▪ Purpose ▪ Context

+ Unifying Model for Identity Management

▪ Explanation

▪ Usage and applicability

(4)

Identity management – Concepts – Confusion

Access control _{Single Sign-On}

Accountability CRM PKI _Auditability Verification Validation Compliance Enrolment User management Certificates Authorisations Provisioning Permissions Tokens _Trust Identification Directories Password Workflow Registration _Privacy Anonymity _Biometrics Credentials Smart cards

(5)

Identity management – definition

From AGIMO’s Glossary:

(6)

Identity management – access management

Why – Purpose:

+ Access management – before the act

▪ Who has access to what?

▪ Ensure authorised people have access

and unauthorised people do not have access

+ Accountability – after the act

▪ Who has done what?

(7)

(8)

(9)

Identity management – model

Model for Identity management Model for Identity management Object Subject _{Access Control}

Any type of access Assets (valuable) Anyone/anything

(10)

(11)

(12)

Model – three layers

(13)

Model – identity & access subsystem

Outside

subsystem

(14)

Model – three columns

Subject

Claim/

(15)

Identity management model – access request

Access

request Authorisation

(16)

Identity management model – permissions

Permissions Access request

Subject

(17)

(18)

Identity management model – access decision

Permissions Access decision

Access rights

Decision to be made Claim/

Decision

Authorisation

(19)

(20)

(21)

(22)

Authentication

(Session credentials)

Identity management model – verification of credentials

(23)

Identity management model – credentials verified

Access decision Identification decision Subject’s credentials Authentication decision Reference credentials

Decision has been made

Authentication

(24)

(25)

(26)

(27)

(28)

(29)

(30)

Analysis – features of model

+ Holistic approach to identity management + Responsibilities, segregation of duties

+ Insourcing, outsourcing, sourcing + Architecture – SOA

+ Single customer-view + Single sign-on

+ Federation of identities

(31)

Benefits of identity management model

+ Descriptive and prescriptive

+ Applicable to logical world and physical world + Modularity

▪ Vendor independence / subsystem independence ▪ Basis for outsourcing decisions

+ Clear distinction authorisation – identification – authentication

▪ Improve auditability

Limitations to identity management model

+ Does not (explicitly) cover lifecycles

(32)

(33)