1. Access Control and Markup Languages Pages 183 – 187 in the CISSP 1

2. Mark-up languages  A way to structure text and data sets  Control how it looks and some of the functionality 2

3. XML  As the web grew, we needed additional functionality beyond HTML Foundational standard providing a structure for other independent mark-up languages XML is like English and independent standards may be something like the difference between a lawyer's vocabulary and a doctor's vocabulary – different, but with the same underlying root.  XML for identity management and access control purposes  SPML  SAML  XACML 3

4. XML for identity management and access control purposes Service Provisioning Markup Language (SPML)  Allows for the exchange of provisioning data between applications & the automation of user management  Three main entities  Requesting Authority  Provisioning Service Provider (software that responds to requests)  Provisioning Service Target (carries out requests on the system)  See page 185 for a diagram 4

5. Security Assertion Markup Language (SAML)  Allows for the exchange of authentication and authorization data (ex. password, key, digital certificate)  Does NOT tell the receiving system how to interpret this data  Provides the authentication pieces to federated identity management systems  Transmission of SAML data is typically done over Simple Object Access Protocol (SOAP)  See Figure 3-8 on page 186  Allows for Service Oriented Architecture (SOA)  A way to provide independent services residing on different systems in one consistent manner 5 XML for identity management and access control purposes

6. Extensible Access Control Markup Language (XACML)  Express security policies and access rights  Access policies are developed in XACML but enforced through the software  Policies can be installed on multiple systems to ensure consistent security enforcement and management  3 Elements  Subject (Requesting Entity)  Resource (Requested Entity)  Action (Type of access) 6 XML for identity management and access control purposes