Identity and Access Management

Objectives Find a common background for discussing IAM Discuss problems and opportunities in the field Introduce terminology Highlight a possible future direction

Explosion of IDs Business Automation # of Digital IDs Applications Company (B2E) Partners (B2B) Customers (B2C) Mobility # of Digital IDs Internet Client Server Applications Mainframe Time Pre 1980’s 1980’s 1990’s 2000’s

Today’s Problems

Who am I? Who are you? Networks use multiple identity systems The Internet is no better Users get confused with all of these IDs Management and audit has difficulty keeping track of all these IDs The bad guys are quite happy

So many IDs!

Multiple Contexts

Making It All Better

Identity and Access Management

Roles Within Identity Metasystem Identity Providers Organisations, governments, even end-users They provide Identity Claims about a Subject Name, vehicles allowed to drive, age, etc. Relying Parties Online services or sites, doors, etc. Subjects Individuals and other bodies that need its identity established

Components and Terminology

What is Identity Management? Single Sign On Password Management Secure Remote Access Federation Role Management Web Services Security Provisioning Auditing & Reporting Directories Authorization Digital Rights Management Strong Authentication PKI

Identity and Access Management A system of procedures, policies and technologies to manage the lifecycle and entitlements of electronic credentials Directory Services Repositories for storing and managing accounts, identity information, and security credentials Access Management The process of authenticating credentials and controlling access to networked resources based on trust and identity Identity Lifecycle Management The processes used to create and delete accounts, manage account and entitlement changes, and track policy compliance

Benefits to take you forward IAM Benefits Benefits today (Tactical) Benefits to take you forward (Strategic) Save money and improve operational efficiency New ways of working Improved time to deliver applications and service Improved time to market Enhance Security Closer Supplier, Customer, Partner and Employee relationships Regulatory Compliance and Audit

Some Basic Definitions Authentication (AuthN) Verification of a subject’s identity by means of relying on a provided claim Identification is sometimes seen as a preliminary step of authentication Collection of untrusted (as yet) information about a subject, such as an identity claim Authorization (AuthZ) Deciding what actions, rights or privileges can the subject be allowed Trend towards separation of those two Or even of all three, if biometrics are used

The Benefits of IAM Save money Improve operational efficiency Reduce time to deliver applications and services Enhance security Enhance regulatory compliance Give more power to audit

Let’s Define IAM Terms Authentication (AuthN) Authorization (AuthZ) Verify that a person is who they claim to be This is where multi-factor authentication comes into play Identification and authentication are related but not the same Authorization (AuthZ) Deciding what resources can be accessed/used by a user Accounting Charges you for what you do

IAM is a Foundation Audit and Reporting Identity Management Account Provisioning & Deprovisioning Synchronisation Administration User Management Password Management Workflow Delegation Audit and Reporting Access Management AuthN AuthZ

Identity Management Tasks: create ,delete and manage user identity in computing environment .

Identity Management can be viewed as the following models The pure Identity Model : creation ,management and deletion of identity. User Access (log on ) model: allow user to register ,log in and log out . Smart card. The service model : system that deliver online ,on demand and role based service to users and their devices.

Access Control System Collection of mechanism that work together to create a security architecture to protect the assets of an information system.

Principle of access control management Mandatory Access control (MAC) Discretionary Access control (DAC) Access control list ( ACL) Rule Based Access control (RBAC) Role based Access control (ROBAC)

Principle of access control management Mandatory Access control (MAC):Who gains access to information Discretionary Access control (DAC): Access control mechanism for most desktop operating systems : UNIX. Restricted access Access control list ( ACL): list of file of users who are given the privilege of access to system or network resources. Like database and device. Rule Based Access control (RBAC): all rules and access permissions are defined by system administrator. Role based Access control (ROBAC): not only who or what process may have access to specific system resources but also type of access that is permitted .(development or testing group)

Access control techniques 1.User possessions : Tokens Memory Tokens : Storing information ATM Protection of pin code Smart Tokens : more powerful than memory tokens. Extension of Memory Tokens. More Integrated circuits into Memory Tokens

Access control techniques cont.. 2. Biometric Techniques Possession based Knowledge based Physiological based Behavioral biometric Multi biometric

Biometrics Applications Authentication system Network security Combating cybercrimes Biometrics enabled smart cards E-commerce and internet