1. Identity and Access Management

2. Objectives Find a common background for discussing IAM
Discuss problems and opportunities in the field
Introduce terminology
Highlight a possible future direction

3. Explosion of IDs Business Automation # of Digital IDs Applications
Company
(B2E)
Partners
(B2B)
Customers
(B2C)
Mobility
# of
Digital IDs
Internet
Client Server
Applications
Mainframe
Time
Pre 1980’s
1980’s
1990’s
2000’s

4. Today’s Problems

5. Who am I? Who are you? Networks use multiple identity systems
The Internet is no better
Users get confused with all of these IDs
Management and audit has difficulty keeping track of all these IDs
The bad guys are quite happy

6. So many IDs!

7. Multiple Contexts

8. Making It All Better

9. Identity and Access Management

10. Roles Within Identity Metasystem
Identity Providers
Organisations, governments, even end-users
They provide Identity Claims about a Subject
Name, vehicles allowed to drive, age, etc.
Relying Parties
Online services or sites, doors, etc.
Subjects
Individuals and other bodies that need its identity established

11. Components and Terminology

12. What is Identity Management?
Single Sign On
Password
Management
Secure Remote
Access
Federation
Role
Management
Web Services
Security
Provisioning
Auditing &
Reporting
Directories
Authorization
Digital
Rights
Management
Strong
Authentication
PKI

13. Identity and Access Management
A system of procedures, policies and technologies to manage the lifecycle and entitlements of electronic credentials
Directory Services
Repositories for storing and managing accounts, identity information, and security credentials
Access Management
The process of authenticating credentials and controlling access to networked resources based on trust and identity
Identity Lifecycle Management
The processes used to create and delete accounts, manage account and entitlement changes, and track policy compliance

14. Benefits to take you forward
IAM Benefits
Benefits today
(Tactical)
Benefits to take you forward
(Strategic)
Save money and improve operational efficiency
New ways of working
Improved time to deliver applications and service
Improved time to market
Enhance Security
Closer Supplier, Customer,
Partner and Employee relationships
Regulatory Compliance and Audit

15. Some Basic Definitions
Authentication (AuthN)
Verification of a subject’s identity by means of relying on a provided claim
Identification is sometimes seen as a preliminary step of authentication
Collection of untrusted (as yet) information about a subject, such as an identity claim
Authorization (AuthZ)
Deciding what actions, rights or privileges can the subject be allowed
Trend towards separation of those two
Or even of all three, if biometrics are used

16. The Benefits of IAM Save money Improve operational efficiency
Reduce time to deliver applications and services
Enhance security
Enhance regulatory compliance
Give more power to audit

17. Let’s Define IAM Terms Authentication (AuthN) Authorization (AuthZ)
Verify that a person is who they claim to be
This is where multi-factor authentication comes into play
Identification and authentication are related but not the same
Authorization (AuthZ)
Deciding what resources can be accessed/used by a user
Accounting
Charges you for what you do

18. IAM is a Foundation Audit and Reporting
Identity Management
Account Provisioning & Deprovisioning
Synchronisation
Administration
User Management
Password Management
Workflow
Delegation
Audit and Reporting
Access Management
AuthN
AuthZ

19. Identity Management
Tasks: create ,delete and manage user identity in computing environment .

20. Identity Management can be viewed as the following models
The pure Identity Model : creation ,management and deletion of identity.
User Access (log on ) model: allow user to register ,log in and log out . Smart card.
The service model : system that deliver online ,on demand and role based service to users and their devices.

21. Access Control System
Collection of mechanism that work together to create a security architecture to protect the assets of an information system.

22. Principle of access control management
Mandatory Access control (MAC)
Discretionary Access control (DAC)
Access control list ( ACL)
Rule Based Access control (RBAC)
Role based Access control (ROBAC)

23. Principle of access control management
Mandatory Access control (MAC):Who gains access to information
Discretionary Access control (DAC): Access control mechanism for most desktop operating systems : UNIX. Restricted access
Access control list ( ACL): list of file of users who are given the privilege of access to system or network resources. Like database and device.
Rule Based Access control (RBAC): all rules and access permissions are defined by system administrator.
Role based Access control (ROBAC): not only who or what process may have access to specific system resources but also type of access that is permitted .(development or testing group)

24. Access control techniques
1.User possessions : Tokens Memory Tokens : Storing information ATM Protection of pin code Smart Tokens : more powerful than memory tokens. Extension of Memory Tokens. More Integrated circuits into Memory Tokens

25. Access control techniques cont..
2. Biometric Techniques Possession based Knowledge based Physiological based Behavioral biometric Multi biometric

26. Biometrics Applications
Authentication system Network security Combating cybercrimes Biometrics enabled smart cards E-commerce and internet