Welcome!

Blog Feed Post

Identity and Access Management - An Introduction

With the advent of Web 2.0 and onward, the rise of the terminology and concept we call Cloud Computing, coupled with an increase in the manner technologies are being used, not only by corporations but by individuals as well, comes an increased drive to ensure that risk is managed, effective security measures to protect identities are implemented, and efforts are expended to ensure privacy is maintained.

A few years ago, in their quest to implement and maximize on the benefits of Service-Oriented Architecture (SOA), researchers at Microsoft separated SOA into four areas (1) viz.

1.Identity and Access Management
2.Service Management
3.Entity Aggregation and
4.Process Integration
Accordingly the claim was that although these segments were technically challenging, navigating the challenges to a successful resolution would allow the groundwork required for critical IT foundations to be realized. This accomplishment in turn would then direct enterprises to a path where the full benefits of SOA could be obtained.

This article develops on an earlier article expanding on Identity and Access Management (IAM)

Identity and Access Management simply stated governs from a process and technical aspect, who has access/permission to perform an action on data and why. It can be categorised as being part of Identity and Privacy Services.

According to Frederick Chong it consists of three critical elements: policies, processes and technologies respectively.

With the growth of online attacks against corporations and individuals, Identity Management is now an intrinsic part of information security. Its aim is to establish accountability online, and can be used to reduce the risks of an unauthorized access to sensitive data and/or identity theft; thus contributing to privacy.

One can then view IAM as an amalgamation of business processes, technologies and policies which are utilized to manage and stipulate how digital identities are used when accessing resources.

Segmenting identity and access, we can view identity management in terms of three basic operations as follows:

1.The process of identifying an individual
2.The process of verification which authenticates a claim to a previously identified individual &
3.The authorization process after step 2 is completed which defines rights and privileges granted to an authenticated individual.
Following on this we can view the access portion of IAM as follows:

1.An entity - Requests Data
2.The Request is validated and granted or invalidated and denied
3.On validation. Requester is then granted defined privileges and assigned permissions on systems that is associated with an account the requester is related to e.g role based access control (RBAC) definitions say for a bank teller.
4.System Closes Access once granted operations are completed.

We can further expand these, to detail component of IAM as follows:

1.The Digital Identity - which can be viewed as a unique identifier with unique descriptive attributes of an individual, a group, device or service.
2.The Register -an information system populated with an identities: identity and attributes, here the identity's attributes level/s of trust will be defined. Of note: the accuracy of the identifying attributes is dependant on source of the data e.g. verifying SSN with SS Card etc and the credibility of the data gathering process.
3.Definitions as to how an identity's information is used.
4.A Process to manage change to an identity's attributes e.g. updating the system on a password reset by a user
5.The Process of de-registering an identity.
6.Secure Disposal of all identity information that has been de-registered.
These segments can be broadly incorporated within three main stages : Provisioning, Maintaining & De-Provisioning; which are all part of The Identity Life Cycle.

As identified in the earlier article, with the advent of web-services and the cloud, a natural progression with the topic of IAM is that of Federated Identity and Access Management.

So with all the technical details defined, why should an enterprise consider such a system ? By all means it appears to be costly, complicated and time consuming.

The answer in short: With an IAM implementation an enterprise can realize improvements in

•Security
•Risk Management
•Compliance
•Levels of Service ( both internal and external) and
•An overall reduction in an enterprises Operational expenditure (OPEX). This reduction will be realised as identity and access management processes mature and are formalized. This can lead to a significant portion of the process being able to become automated.
References

1.Frederick Chong 7/2004- Identity and Access Management- Microsoft Corporation.

2.Thomas J. Smedinghoff - Federated Identity Management:Balancing Privacy Rights, Liability Risks, and the Duty to Authenticate

Read the original blog entry...

More Stories By Jon Shende

Jon RG Shende is an executive with over 18 years of industry experience. He commenced his career, in the medical arena, then moved into the Oil and Gas environment where he was introduced to SCADA and network technologies,also becoming certified in Industrial Pump and Valve repairs. Jon gained global experience over his career working within several verticals to include pharma, medical sales and marketing services as well as within the technology services environment, eventually becoming the youngest VP of an international enterprise. He is a graduate of the University of Oxford, holds a Masters certificate in Business Administration, as well as an MSc in IT Security, specializing in Computer Crime and Forensics with a thesis on security in the Cloud. Jon, well versed with the technology startup and mid sized venture ecosystems, has contributed at the C and Senior Director level for former clients. As an IT Security Executive, Jon has experience with Virtualization,Strategy, Governance,Risk Management, Continuity and Compliance. He was an early adopter of web-services, web-based tools and successfully beta tested a remote assistance and support software for a major telecom. Within the realm of sales, marketing and business development, Jon earned commendations for turnaround strategies within the services and pharma industry. For one pharma contract he was responsibe for bringing low performing districts up to number 1 rankings for consecutive quarters; as well as outperforming quotas from 125% up to 314%. Part of this was achieved by working closely with sales and marketing teams to ensure message and product placement were on point. Professionally he is a Fellow of the BCS Chartered Institute for IT, an HITRUST Certified CSF Practitioner and holds the CITP and CRISC certifications.Jon Shende currently works as a Senior Director for a CSP. A recognised thought Leader, Jon has been invited to speak for the SANs Institute, has spoken at Cloud Expo in New York as well as sat on a panel at Cloud Expo Santa Clara, and has been an Ernst and Young CPE conference speaker. His personal blog is located at http://jonshende.blogspot.com/view/magazine "We are what we repeatedly do. Excellence, therefore, is not an act, but a habit."

Latest Stories
Mobile device usage has increased exponentially during the past several years, as consumers rely on handhelds for everything from news and weather to banking and purchases. What can we expect in the next few years? The way in which we interact with our devices will fundamentally change, as businesses leverage Artificial Intelligence. We already see this taking shape as businesses leverage AI for cost savings and customer responsiveness. This trend will continue, as AI is used for more sophistica...
Nordstrom is transforming the way that they do business and the cloud is the key to enabling speed and hyper personalized customer experiences. In his session at 21st Cloud Expo, Ken Schow, VP of Engineering at Nordstrom, discussed some of the key learnings and common pitfalls of large enterprises moving to the cloud. This includes strategies around choosing a cloud provider(s), architecture, and lessons learned. In addition, he covered some of the best practices for structured team migration an...
Recently, REAN Cloud built a digital concierge for a North Carolina hospital that had observed that most patient call button questions were repetitive. In addition, the paper-based process used to measure patient health metrics was laborious, not in real-time and sometimes error-prone. In their session at 21st Cloud Expo, Sean Finnerty, Executive Director, Practice Lead, Health Care & Life Science at REAN Cloud, and Dr. S.P.T. Krishnan, Principal Architect at REAN Cloud, discussed how they built...
Most technology leaders, contemporary and from the hardware era, are reshaping their businesses to do software. They hope to capture value from emerging technologies such as IoT, SDN, and AI. Ultimately, irrespective of the vertical, it is about deriving value from independent software applications participating in an ecosystem as one comprehensive solution. In his session at @ThingsExpo, Kausik Sridhar, founder and CTO of Pulzze Systems, discussed how given the magnitude of today's application ...
The “Digital Era” is forcing us to engage with new methods to build, operate and maintain applications. This transformation also implies an evolution to more and more intelligent applications to better engage with the customers, while creating significant market differentiators. In both cases, the cloud has become a key enabler to embrace this digital revolution. So, moving to the cloud is no longer the question; the new questions are HOW and WHEN. To make this equation even more complex, most ...
In his session at 21st Cloud Expo, Raju Shreewastava, founder of Big Data Trunk, provided a fun and simple way to introduce Machine Leaning to anyone and everyone. He solved a machine learning problem and demonstrated an easy way to be able to do machine learning without even coding. Raju Shreewastava is the founder of Big Data Trunk (www.BigDataTrunk.com), a Big Data Training and consulting firm with offices in the United States. He previously led the data warehouse/business intelligence and B...
As you move to the cloud, your network should be efficient, secure, and easy to manage. An enterprise adopting a hybrid or public cloud needs systems and tools that provide: Agility: ability to deliver applications and services faster, even in complex hybrid environments Easier manageability: enable reliable connectivity with complete oversight as the data center network evolves Greater efficiency: eliminate wasted effort while reducing errors and optimize asset utilization Security: imple...
In his Opening Keynote at 21st Cloud Expo, John Considine, General Manager of IBM Cloud Infrastructure, led attendees through the exciting evolution of the cloud. He looked at this major disruption from the perspective of technology, business models, and what this means for enterprises of all sizes. John Considine is General Manager of Cloud Infrastructure Services at IBM. In that role he is responsible for leading IBM’s public cloud infrastructure including strategy, development, and offering m...
With tough new regulations coming to Europe on data privacy in May 2018, Calligo will explain why in reality the effect is global and transforms how you consider critical data. EU GDPR fundamentally rewrites the rules for cloud, Big Data and IoT. In his session at 21st Cloud Expo, Adam Ryan, Vice President and General Manager EMEA at Calligo, examined the regulations and provided insight on how it affects technology, challenges the established rules and will usher in new levels of diligence arou...
The past few years have brought a sea change in the way applications are architected, developed, and consumed—increasing both the complexity of testing and the business impact of software failures. How can software testing professionals keep pace with modern application delivery, given the trends that impact both architectures (cloud, microservices, and APIs) and processes (DevOps, agile, and continuous delivery)? This is where continuous testing comes in. D
Modern software design has fundamentally changed how we manage applications, causing many to turn to containers as the new virtual machine for resource management. As container adoption grows beyond stateless applications to stateful workloads, the need for persistent storage is foundational - something customers routinely cite as a top pain point. In his session at @DevOpsSummit at 21st Cloud Expo, Bill Borsari, Head of Systems Engineering at Datera, explored how organizations can reap the bene...
Digital transformation is about embracing digital technologies into a company's culture to better connect with its customers, automate processes, create better tools, enter new markets, etc. Such a transformation requires continuous orchestration across teams and an environment based on open collaboration and daily experiments. In his session at 21st Cloud Expo, Alex Casalboni, Technical (Cloud) Evangelist at Cloud Academy, explored and discussed the most urgent unsolved challenges to achieve f...
The dynamic nature of the cloud means that change is a constant when it comes to modern cloud-based infrastructure. Delivering modern applications to end users, therefore, is a constantly shifting challenge. Delivery automation helps IT Ops teams ensure that apps are providing an optimal end user experience over hybrid-cloud and multi-cloud environments, no matter what the current state of the infrastructure is. To employ a delivery automation strategy that reflects your business rules, making r...
The 22nd International Cloud Expo | 1st DXWorld Expo has announced that its Call for Papers is open. Cloud Expo | DXWorld Expo, to be held June 5-7, 2018, at the Javits Center in New York, NY, brings together Cloud Computing, Digital Transformation, Big Data, Internet of Things, DevOps, Machine Learning and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding busin...
In a recent survey, Sumo Logic surveyed 1,500 customers who employ cloud services such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). According to the survey, a quarter of the respondents have already deployed Docker containers and nearly as many (23 percent) are employing the AWS Lambda serverless computing framework. It’s clear: serverless is here to stay. The adoption does come with some needed changes, within both application development and operations. Tha...